Friday, July 19th 2024
![Microsoft](https://tpucdn.com/images/news/microsoft-v1723816949774.png)
Faulty Windows Update from CrowdStrike Hits Banks and Airlines Around the World
A faulty software update to enterprise computers by cybersecurity firm CrowdStrike has taken millions of computers offline, most of which are in a commercial or enterprise environment, or are Azure deployments. CrowdStrike provides periodic software and security updates to commercial PCs, enterprise PCs, and cloud instances, with a high degree of automation. The latest update reportedly breaks the Windows bootloader, causing bluescreens of death (BSODs), and if configured, invokes Windows Recovery. Enterprises tend to bulletproof the bootloaders of their client machines, and disable generic Windows Recovery tools from Microsoft, which means businesses around the world are left with large numbers of machines that will each take manual fixing. The so-called "Windows CrowdStrike BSOD deluge" has hit critical businesses such as banks, airlines, supermarket chains, and TV broadcasters. Meanwhile, sysadmins on Reddit are wishing each other a happy weekend.
Source:
The Verge
234 Comments on Faulty Windows Update from CrowdStrike Hits Banks and Airlines Around the World
www.sap.com/products/scm/execution-mes/what-is-mes.html
I dont think we would call it a windows update if the update isnt for the OS which would be MS's responsibility
If you really want to blame someone, try your management that under funded the IT dept so much that didnt have the budget to roll this out to testing before it hit mass.
For the rest, please keep wack conspiracy theories away from the thread.
heads gonna roll
This could have happened to anyone, and while it is big it also unfairly paints crowdstrikes position.
With Kaspersky getting banned everyone must shift to another provider...thats millions of end points.
There are a ton of other super big players.
Carbon black
Emsisoft
MS Defender EPS
ESET
Cylance
Sophos
All are massive massive players with EDR used in a biz setting.
The most catastrophic case i had was with one Win10 machine. 22H2 update to it screwed up partition tables so bad that none of the fixes worked and attaching this disk to any other Windows compatible PC caused either BSOD or not even making past POST like it was on the original machine. Even doing a byte per byte clone to another empty disk produced the same issue when that cloned disk was attached. I've never seen anything like that before because initially i thought it was just a bad disk (SSD). Imagine trying to fix a machine that hangs in the POST. It was a nightmare. I ended up putting Win11 on it and manually migrating the data off the faulty disk. Indeed. Im not usually in favor of locking down more but in some cases i have to begrudgingly admit it does have it's benefits. Are talking about the same company here? Microsoft - the company who cant even re-add some of the most requested features to Taskbar code that existed in prior Windows versions. The same company who took ages to add tabs to File Explorer. At this point i think it's better if they leave the kernel as is because looking at their track record i would trust them near that code with a ten feet pole. So because most Linux machines are servers they dont have to deal with security issues? I find that hard to believe.
Most Windows related security issues are caused by users, not the OS itself.
Also something having a small market share does not mean it's more secure - for example running Windows XP on an internet connected machine.
Anyway, this is my last post on the issue since I feel the thread was derailed by my participation on this topic a bit. My apologies to @Solaris17 and @the54thvoid.
THESE COMPANIES NEED MORE QA!!!!
A warranty is only as good as the company making it. IT is only as strong as its weakest link.
If you are in IT and don't have a master machine/password/configuration spreadsheet/flowchart that is saved to a removable drive in a safe or printed out you are setting the company up for failure, if you know it all and die or something happens the next person gets screwed.
Also yet another reason to run LTSC. Or have a mirror of your environment capable of running on Linux. No amount of QA will prevent the risk of stacking so many interdependent infra and services on top of each other. Fact of life: if you depend on many others, you are vulnerable. Mitigate the risk sure. Prevention? Forget it.
Im also the consultant telling them they need redundancy and tight risk mgmt. ;)
And since 2022 especially in the EU with Russia in the east I just cant fathom why we havent taken more measures to mitigate risk to online services. Asleep at the wheel. Its completely irresponsible; you just have to have an offline method of running the biz on hand.
Also, I heard some Linux systems are getting hit because they also have a Linux version of whatever CrowdStrike software there's on Windows that's getting hit with the bug.
Semi-related everything seems to be working fine in my country. Probably because not many or no one uses CrowdStrike (too expensive and probably no reps in the country)