Microsoft Crowdstrike

Learn about the Microsoft Crowdstrike Case!

when

July 19th 2024

who

CrowdStrike, security company that builds endpoint detection and response software

what happened

~8.5m windows systems failing and showing blue screen

how much (estimated)

US Fortune 500 companies $5.4bn

what 1

channel file 291 was an update to improve how Falcon evaluates named pipe execution on Windows

note

only channel file 291 version with timestamp 2024-07-19 0409 UTC was flawed

what 2

there was a mismatch between number of input fields in the inter-process communication (IPC) template type and actual inputs provided - IPC defined 21 but sensor code only provided 20

why not Mac or Linux

channel file 291 deals with named pipe execution that only occurs on Microsoft OS

Falcon

a security product that is essentially anti-malware for the server

issue 1

instead of creating a new driver each time they had an update, Crowdstrike were sneaky and wrote channel files so they didn’t have to get a new certification and waste time

channel file

processed by the driver but not actually included

issue 2

creating new channel files means you have unsigned and uncertified code in kernel mode and all it takes is a tiny issue to mess everything up

why was CrowdStrike Falcon code in the kernel and what did that mean?

code was in the kernel so it could see application behavior - so it was a device driver, specifically BOOT START so it must be installed to start the windows OS so their security is always there

outcome 1

airports, healthcare, financial services all disrupted

outcome 2

shareholder class action lawsuit - CrowdStrike made false and misleading statements about the adequacy of its software testing procedure

outcome 3

delta airlines filed lawsuit on Oct 25th 2024 accusing them of negligence. CS sued them back saying they were not responsible for mass flight cancellations and any damages they suffered were due to their own negligence

outcome 4

increase in cyberattacks - phishing emails as tech support, fake phone calls, selling scripts claiming to be recovery