Internet security software causes global Microsoft system crashes

[New Sancai Compilation and First Release] The world experienced a massive technical failure of Microsoft computer systems on July 19, disrupting operations in multiple industries, grounding flights and upending everything from banks to healthcare systems.

What happened?

CrowdStrike is an American cybersecurity company with a market value of approximately US$83 billion. According to its website, the company is one of the most popular cybersecurity companies in the world, with more than 20,000 enterprise customers worldwide.

According to an alert CrowdStrike sent to its customers at 1 a.m. ET on July 19, its widely used "Falcon Sensor" software caused the Microsoft Windows operating system to crash and display a blue screen, informally known as a "blue screen of death."

CrowdStrike CEO George Kurtz said in a post on X that CrowdStrike has deployed a fix for the issue. "This is not a security incident or cyber attack," he wrote.

However, it's unclear how easily affected systems can be repaired remotely, as "Blue Screen of Death" can still cause system crashes when computers are restarted before the update.

"This means that in this state, the device cannot update automatically and requires manual intervention," said Daniel Card of PwnDefend, a British cybersecurity consultancy.

Ciaran Martin, the former head of the National Cyber Security Center (NCSC), the UK's GCHQ intelligence agency, said the scale of the problem was huge.

"It's not unprecedented, but it's hard for me to imagine a shutdown of this magnitude. It's been happening for years, but this is the biggest one. I think it's probably short-lived because of the simple nature of the problem. "But it's very, very, very, very, big," he added.

Why does this happen?

Over the past two decades, governments and businesses alike have become increasingly reliant on a handful of connected technology companies as a result of the COVID-19 pandemic.

Experts say the outage exposes the risks posed by an increasingly online world.

To protect their computer networks from hackers, many businesses use a type of cybersecurity product called endpoint detection and response (EDR), which operates in the background on corporate machines, or "endpoints."

Companies such as CrowdStrike can use its EDR products as early warning systems for potential digital attacks, scan for viruses and prevent hackers from gaining unauthorized access to corporate networks.

However, in this case, something in CrowdStrike's code conflicts with something in the code that makes Windows run and causes these systems to crash, even after rebooting.

"With the move to the cloud and companies like CrowdStrike having huge market share, their software is running on millions of computers around the world," Card said.

Who is affected?

The global technology disruption has affected operations across different industries internationally, including Spanish airports, US airlines and Australian media and banks.

Australia, New Zealand and many U.S. state governments are facing problems, while American Airlines, Delta Air Lines, United Airlines (UAL.O) and Allegiant Airways (ALGT.O) have grounded flights due to communications problems.

In Britain, Sky News, one of the country's main television news channels, was off the air for several hours on Friday before resuming service.

(Compiled by: Wang Jimin)

(Editor: Jiang Qiming)

(Source of the article: Compiled and published by New Sancai)