What is CrowdStrike, and how did it cripple so many computers? (2024)

Talk about irony: The software that paralyzed Windows computers around the world late Thursday night and early Friday morning was planted by a company that protects Windows computers against malware.

That company is CrowdStrike, a publicly traded cybersecurity firm based in Austin, Texas. It acknowledged the problem around 11 p.m. Thursday and started working on a solution, offering a work-around in the wee hours Friday and a fix a few hours later.

The vast sea of “blue screens of death” triggered by CrowdStrike’s error is a testament to the market-leading status of the company’s software, which detects and defends against malicious code planted by hackers. Its approach is known as “endpoint security” because it installs its defenses on devices that connect to the internet, such as computers and smartphones.

Advertisem*nt

According to the website 6sense.com, CrowdStrike has more than 3,500 customers, which represent about 1 out of 4 companies buying endpoint security. Although most of its customers are based in the United States, it has hundreds in India, Europe and Australia, 6sense reports.

Here’s a quick explanation for how things went wrong so quickly for so many Windows users around the world, including airlines, hospitals, banks and government agencies.

California

From LAX to hospitals to Starbucks, global tech outage brings chaos and frustration

The software issue was part of an update from cybersecurity company CrowdStrike, which protects computers for many of the biggest companies in the world.

July 19, 2024

The Falcon Sensor update

One of the selling points of CrowdStrike service is that it can improve its defenses rapidly as new threats are discovered. As part of that service, it continuously and automatically updates the Falcon Sensor software on its customers’ machines.

Advertisem*nt

Automatic updates are, under normal circ*mstances, a good cybersecurity practice because they prevent clients from having machines with outdated defenses on their networks. But the latest incident reveals the flip side of the coin.

According to CrowdStrike, the problem was triggered by a “single content update” for its customers with Windows PCs. The buggy code wasn’t detected until after it had been downloaded and installed on many of CrowdStrike’s clients’ machines.

Once loaded, the bad update interfered with core functions of the PC, causing Microsoft’s infamous blue error screen to pop up and convey a message along the lines of, “Your PC ran into a problem and needs to restart.” And as long as the update remained in place, restarting the machine led to the same errant result.

Advertisem*nt

The fix offered by CrowdStrike

CrowdStrike stopped sending out the faulty update early Friday morning, so machines that had not loaded it yet were spared the turmoil.

For machines caught in the cycle of blue-screen hell, the company initially offered step-by-step instructions for how to reboot Windows in a mode that would allow them to find and delete the buggy update. The drawback, as many commenters online noted, is that this machine-by-machine approach isn’t much help for organizations with hundreds or thousands of bricked PCs.

Business

Global IT collapse puts cyber firm CrowdStrike in spotlight

Behind a massive IT failure that grounded flights, upended markets and disrupted corporations around the world is one cybersecurity company: CrowdStrike Holdings Inc.

July 19, 2024

According to the tech website 404, Microsoft also suggested that rebooting a crashed machine multiple times — as many as 15 — could solve the problem.

Within a few hours, CrowdStrike was distributing a piece of software that removed the buggy code. This worked only for customers whose machines were able to connect to the internet and download the fix, though; everyone else would be left with the PC-by-PC work-around.

Scammers jump in

CrowdStrike Chief Executive George Kurtz issued an apology late Friday morning, promising that the company would “provide full transparency on how this occurred and steps we’re taking to prevent anything like this from happening again.” He also warned that bad actors online would try to take advantage of the incident, urging customers to be on the lookout and “ensure that you’re engaging with official CrowdStrike representatives.”

Sure enough, the company announced two hours later that it had found numerous instances of scammers trying to lure victims by posing as CrowdStrike technical support in emails or phone calls. Others were “posing as independent researchers, claiming to have evidence the technical issue is linked to a cyberattack and offering remediation insights.” And yet more were making bogus offers to sell software to fix the problem, the company said.

Advertisem*nt

CrowdStrike identified at least 30 malicious websites that were involved in these cons.

Researchers at the internet security company Norton also warned about the emergence of fake domains and impersonation scams tied to the incident.

“Scammers can leverage social ads, emails and text messages to drive people to the bogus sites,” Norton warned. “These sites look legitimate and aim to extort personal or financial information, preying on the fear and doubt people may have related to the incident. Moreso, many times, fake domains have high search rankings, which can make them appear more credible.”

In an impersonation scam, con artists may send messages mimicking CrowdStrike’s branding to potential victims, claiming that they have been affected by the incident. The messages direct people to a fraudulent customer support line or web page, with a goal of stealing money or sensitive personal information, Norton said.

“This should serve as a cautionary tale, reminding people worldwide to remain extra vigilant as scammers use every angle and method to exploit them,” Luis Corrons, a Norton security evangelist, said in a statement.

The lessons from the CrowdStrike debacle

Some Macintosh and Linux users, who were immune to the CrowdStrike-induced upheaval, devoted a portion of their morning Friday to spiking the football on Windows, even though the problem wasn’t caused by Microsoft.

Other observers argued that the incident demonstrated the risk of having one potential point of failure affecting millions of computers — a problem that has been demonstrated repeatedly during the broadband era.

Advertisem*nt

Transportation Secretary Pete Buttigieg made a similar point at a news conference Friday in East Los Angeles. “A lot of people around the country and around the world are shocked to discover that a single issue with a single piece of software can have that many knock-on implications. So ... that’ll be a question that really goes to the design of our systems for the long term,” Buttigieg said.

“As a recovering computer science major,” Rep. Ted Lieu (D-Torrance) said on X, “I’m not surprised a faulty update by CrowdStrike took down Microsoft Windows. Always risks in giving another software program full or near full access to an operating system.”

For the record:

12:26 p.m. July 19, 2024An earlier version of this story reported that Steve Garrison was founder of Stellar Cyber in San Francisco. He is one of the founders, and the company is based in San Jose.

Steve Garrison, one of the founders of Stellar Cyber in San Jose, said it’s more important to figure out how to make improvements than to play the blame game. This incident, he said, underscores the need for companies to spend plenty of time checking the quality of their products in a controlled environment before releasing them to customers.

Another lesson, he said, is the need for companies, their competitors and their customers to work together as a community to spot problems. “What do we need to do to check the checkers of our supply chain?” he asked.

Politics

Will hackers, trolls and AI deepfakes upset the 2024 election?

AI is bending reality into a video game world of deepfakes to sow confusion and chaos during the 2024 election. Disinformation is a danger, especially in swing states.

April 30, 2024

Dan O’Dowd, a developer of security software for the military, said the fiasco demonstrates that we need better software in critical systems.

“The immense body of software developed using Silicon Valley’s ‘move fast and break things’ culture means that the software our lives depend on is riddled with defects and vulnerabilities,” O’Dowd said in a statement. “Defects in this software can result in a mass failure event even more serious than the one we have seen today.”

He added, “We must convince the CEOs and Boards of Directors of the companies that build the systems our lives depend on to rewrite their software so that it never fails and can’t be hacked. ... These companies will not take cybersecurity seriously until the public demands it. And we must demand it now, before a major disaster strikes.”

More to Read

  • Opinion: The CrowdStrike outage shows the danger of depending on Big Tech overlords

    July 23, 2024

  • Column: The CrowdStrike meltdown reminds us that the hacking problem doesn’t come only from outside

    July 23, 2024

  • L.A. County Superior Court hit by ransomware attack

    July 19, 2024

What is CrowdStrike, and how did it cripple so many computers? (2024)

FAQs

What is CrowdStrike, and how did it cripple so many computers? ›

According to CrowdStrike, the problem was triggered by a “single content update” for its customers with Windows PCs. The buggy code wasn't detected until after it had downloaded and installed on many of CrowdStrike's clients machines.

What is CrowdStrike and how did IT cripple so many computers? ›

Cybersecurity firm CrowdStrike (CRWD) said an error in one of its software updates for Microsoft's (MSFT) Windows knocked systems offline. The incident sent companies and government agencies across the globe into chaos, as they were unable to access the computer programs necessary for continued operations.

What exactly went wrong with CrowdStrike? ›

The root cause of the outage was a faulty sensor configuration update that specifically affected Windows systems. The channel file 291 update was never issued to macOS or Linux systems as the update deals with named pipe execution that only occurs on the Microsoft Windows OS.

How many computers are affected by CrowdStrike? ›

One day, after the CrowdStrike outage, Microsoft reported that 8.5 million Windows machines were affected by the error in the cybersecurity company's software update.

What is CrowdStrike and how does IT work? ›

CrowdStrike is the leader in next-generation endpoint protection, threat intelligence and response services. CrowdStrike's core technology, the Falcon platform, stops breaches by preventing and responding to all types of attacks — both malware and malware-free.

What was the cause of the CrowdStrike failure? ›

Microsoft confirms the analysis done by CrowdStrike last week. The crash was due to a read-out-of-bounds memory safety error in CrowdStrike's CSagent. sys driver. So they are saying something else caused the first blue screen, which corrupted the file, which causes every subsequent blue screen.

How much damage did CrowdStrike cause? ›

The worldwide financial damage has been estimated to be at least US$10 billion. Within hours, the error was discovered and a fix was released, but because many affected computers had to be fixed manually, outages continued to linger on many services.

Why is CrowdStrike down so much? ›

While investors were sleeping, CrowdStrike released a defective update to its software that caused Microsoft-based IT systems to go down.

What is the problem with CrowdStrike and Microsoft? ›

CrowdStrike blamed testing software for taking down 8.5 million Windows machines last month, but now a full root cause analysis offers more details. The main issue was a mismatch between the input fields expected by CrowdStrike's Falcon driver and the ones supplied in a content update.

How did CrowdStrike crash? ›

The update that was sent to CrowdStrike software on Friday was malformed, which caused the software to crash every time it started and tried to parse the update. Now, usually, when an application like Google Chrome or Microsoft Word crashes, only that one application crashes.

What is the root cause of the CrowdStrike incident? ›

CrowdStrike has published its root cause analysis about the update crash that turned off millions of Microsoft Windows devices globally. The crash occurred because there was a mismatch between the 21 inputs passed to the CrowdStrike content validator and the 20 supplied to the content interpreter.

Why are only some computers affected by CrowdStrike? ›

Kishore clarified, "The outage does not affect all Microsoft systems. It is specifically the systems with CrowdStrike's Falcon Sensor that are experiencing issues. Systems without this particular security software remain unaffected." This distinction explains why only a subset of computers faced disruptions.

How did CrowdStrike break the internet? ›

On July 19, a routine software update from cybersecurity giant CrowdStrike unleashed digital chaos across the globe, exposing the fragility of interconnected IT networks. Within hours, Windows-based systems worldwide crashed, displaying the dreaded “blue screen of death,” affecting 8.5 million devices globally.

Why is everyone using CrowdStrike? ›

CrowdStrike is a US cyber security company with a major global share in the tech market. Falcon is one of its software products that organisations install on their computers to keep them safe from cyber attacks and malware.

Who is the CrowdStrike's biggest competitor? ›

Top Competitors and Alternatives of Crowdstrike

The top three of Crowdstrike's competitors in the Endpoint Protection category are McAfee ePO with 21.21%, SentinelOne with 9.73%, Duo Security with 7.65% market share.

How did CrowdStrike outage happen? ›

The historic outage was the result of a faulty update from the cybersecurity company CrowdStrike that affected millions of computers running the Microsoft Windows operating system.

What exactly was the CrowdStrike bug? ›

The outage was caused by a defect found in a Falcon content update for Windows hosts. Mac and Linux hosts are not impacted. This was not a cyberattack. We are working closely with impacted customers and partners to ensure that all systems are restored, so you can deliver the services your customers rely on.

Why do so many companies use CrowdStrike? ›

One of the selling points of CrowdStrike service is that it can improve its defenses rapidly as new threats are discovered. As part of that service, it continuously and automatically updates the Falcon Sensor software on its customers' machines.

Top Articles
Pura Diffuser Blinking Red And Green : Troubleshooting Tips
Why is My Pura Blinking Red and Green? Reasons + Fix
Use Copilot in Microsoft Teams meetings
Phone Number For Walmart Automotive Department
St Als Elm Clinic
360 Training Alcohol Final Exam Answers
Craigslist Kennewick Pasco Richland
Free VIN Decoder Online | Decode any VIN
Ashlyn Peaks Bio
David Packouz Girlfriend
Magic Mike's Last Dance Showtimes Near Marcus Cedar Creek Cinema
Tamilblasters 2023
U.S. Nuclear Weapons Complex: Y-12 and Oak Ridge National Laboratory…
De Leerling Watch Online
Facebook Marketplace Charlottesville
Gma Deals And Steals Today 2022
Maplestar Kemono
Virginia New Year's Millionaire Raffle 2022
91 East Freeway Accident Today 2022
Site : Storagealamogordo.com Easy Call
Bible Gateway passage: Revelation 3 - New Living Translation
Busted News Bowie County
67-72 Chevy Truck Parts Craigslist
Construction Management Jumpstart 3Rd Edition Pdf Free Download
Craigslist Alo
Craigslist Dubuque Iowa Pets
Tuw Academic Calendar
Kimoriiii Fansly
'Insidious: The Red Door': Release Date, Cast, Trailer, and What to Expect
Pixel Combat Unblocked
The Fabelmans Showtimes Near Baton Rouge
TJ Maxx‘s Top 12 Competitors: An Expert Analysis - Marketing Scoop
950 Sqft 2 BHK Villa for sale in Devi Redhills Sirinium | Red Hills, Chennai | Property ID - 15334774
Google Flights To Orlando
DIY Building Plans for a Picnic Table
Swimgs Yuzzle Wuzzle Yups Wits Sadie Plant Tune 3 Tabs Winnie The Pooh Halloween Bob The Builder Christmas Autumns Cow Dog Pig Tim Cook’s Birthday Buff Work It Out Wombats Pineview Playtime Chronicles Day Of The Dead The Alpha Baa Baa Twinkle
Haunted Mansion Showtimes Near Cinemark Tinseltown Usa And Imax
Memberweb Bw
Gyeon Jahee
Ukg Dimensions Urmc
Woodman's Carpentersville Gas Price
Puretalkusa.com/Amac
Noaa Duluth Mn
Craigslist Malone New York
Tgirls Philly
Busted Newspaper Mcpherson Kansas
فیلم گارد ساحلی زیرنویس فارسی بدون سانسور تاینی موویز
Aloha Kitchen Florence Menu
Kate Spade Outlet Altoona
Turok: Dinosaur Hunter
Zadruga Elita 7 Live - Zadruga Elita 8 Uživo HD Emitirani Sat Putem Interneta
Fallout 76 Fox Locations
Latest Posts
Article information

Author: Greg Kuvalis

Last Updated:

Views: 5666

Rating: 4.4 / 5 (75 voted)

Reviews: 82% of readers found this page helpful

Author information

Name: Greg Kuvalis

Birthday: 1996-12-20

Address: 53157 Trantow Inlet, Townemouth, FL 92564-0267

Phone: +68218650356656

Job: IT Representative

Hobby: Knitting, Amateur radio, Skiing, Running, Mountain biking, Slacklining, Electronics

Introduction: My name is Greg Kuvalis, I am a witty, spotless, beautiful, charming, delightful, thankful, beautiful person who loves writing and wants to share my knowledge and understanding with you.