The Crowdstrike Incident
Summary
In July 2024, a faulty software update from CrowdStrike, a leading cybersecurity firm, caused widespread system crashes on millions of Windows computers globally. This incident disrupted critical sectors such as transportation, healthcare, and finance, highlighting the vulnerabilities inherent in modern IT systems. This article gives us explanations about the technical backgrounds which are leading finally to the incident.
What is CrowdStrike?
CrowdStrike is the name of a publicly traded US company that provides information security and cybersecurity solutions. The company was founded in 2011 and has also assisted in investigating various cases of economic cyber espionage, including on behalf of the United States Department of Justice. Google is one of the main investors, and the company now has a market capitalization of about 65 billion US dollars. In 2013, the software product CrowdStrike Falcon was launched. CrowdStrike Falcon is a widely used Enterprise Detection and Response (EDR) protection software against cyber attacks. The product uses AI and machine learning technologies, among others, to ensure the protection of computer systems.
The Incident
On July 19, 2024, CrowdStrike released a update — Channel File 291 — for its Falcon Sensor software. This update introduced an additional input parameter (21 instead of the expected 20), which caused an out-of-bounds memory access. The error led to system crashes characterized by the “Blue Screen of Death” (BSOD) on affected Windows systems.
Technical Background
- Faulty Update: The update included 21 parameters while the Falcon Sensor was designed to handle only 20.
- Kernel-Level Access: The Falcon Sensor operates in “Ring Zero,” granting it deep access to Windows kernel resources. This design amplified the impact of the error.
- Race Condition: The file triggered a race condition during system startup, further contributing to crashes.
Impact
Approximately 8.5 million systems were affected globally. Key disruptions included:
- Airports: Flight delays and cancellations.
- Healthcare: Hospital systems were disrupted, delaying critical operations.
- Financial Services: ATM networks and payment systems experienced outages.
- Media: Sky News temporarily ceased broadcasting.
Linux and macOS systems were unaffected due to their different security architectures.
Response and Mitigation
- Manual Recovery: Affected systems required booting into safe mode to delete the faulty file manually.
- Patch Deployment: CrowdStrike released a corrected update within an hour of identifying the issue.
- Lessons Learned: The incident underscored the need for rigorous testing protocols and robust emergency response plans.