- Security experts believe that CrowdStrike’s recent software update, which caused global system crashes, likely did not undergo adequate quality checks before deployment.
- The faulty code in the Falcon sensor software update led to significant outages for companies using Microsoft’s Windows OS, affecting banks, airlines, hospitals, and government offices worldwide.
- The incident underscores CrowdStrike’s market dominance, with its software being used by over half of the Fortune 500 companies and major government bodies, including the U.S. Cybersecurity and Infrastructure Security Agency.
Security experts have reported that CrowdStrike’s routine update of its widely used cybersecurity software, which caused global crashes in clients’ computer systems on 19th July 2024, likely did not undergo sufficient quality checks before deployment.
The new version of its Falcon sensor software was intended to enhance security for CrowdStrike clients by updating the threats it defends against. However, faulty code in the update files led to one of the most extensive tech outages in recent years for companies using Microsoft’s Windows operating system.
The disruption affected global banks, airlines, hospitals, and government offices. Although CrowdStrike provided information to fix the affected systems, experts noted that restoring them would be time-consuming due to the need for manually removing the flawed code.
Steve Cobb, chief security officer at Security Scorecard, which was also affected, commented, “It looks like the vetting or sandboxing process for the code may have missed this file.”
Issues became apparent shortly after the update was rolled out, with users posting pictures on social media of computers displaying error messages, commonly known as “blue screens of death.”
According to Patrick Wardle, a security researcher specializing in threats against operating systems, identified the problematic code in his analysis. The issue was located “in a file that contains either configuration information or signatures,” with signatures being code that detects specific types of malware.
He suggested that the frequency of updates might have contributed to insufficient testing. “The frequency of updates is probably the reason why they didn’t test it as much,” he said.
The exact mechanism by which the faulty code entered the update and went undetected remains unclear.
John Hammond, principal security researcher at Huntress Labs, stated, “Ideally, this would have been rolled out to a limited pool first. That is a safer approach to avoid a big mess like this.”
Such incidents are not unprecedented. For example, McAfee’s buggy antivirus update in 2010 stalled hundreds of thousands of computers. However, the global scale of this outage highlights CrowdStrike’s significant market presence. Over half of Fortune 500 companies and numerous government bodies, including the top U.S. cybersecurity agency, the Cybersecurity and Infrastructure Security Agency, rely on CrowdStrike’s software.
Source: Reuters
