CrowdStrike

 

CrowdStrike is an American cybersecurity company founded in 2011 and based in Austin, Texas. The company provides digital response tools to computer attacks, secures the cloud and its customers' data.

CrowdStrike is a security technology company that provides a range of cybersecurity solutions to help organizations detect, prevent, and respond to cyber attacks. From a technical perspective, CrowdStrike's platform is built around a few key components:

1. **Hunt Engine**: This is the core engine that powers CrowdStrike's threat detection capabilities. It uses machine learning and artificial intelligence to analyze vast amounts of data from various sources, including network traffic, endpoint data, and threat intelligence feeds, to identify potential security threats.

2. **CrowdStrike Falcon**: This is the cloud-based platform that integrates with the Hunt Engine to provide real-time threat detection and incident response capabilities. It includes features such as:

* **Threat Hunting**: The ability to hunt for unknown threats in real-time using machine learning algorithms and human analysis.

* **Anomaly Detection**: The ability to detect unusual behavior or patterns in network traffic and system activity that may indicate a threat.

* **Behavioral Analysis**: The ability to analyze the behavior of systems and processes on an endpoint to identify potential threats.

* **Signature-based Detection**: The ability to detect known malware and other threats using signature-based detection techniques.

3. **Endpoint Protection**: CrowdStrike's endpoint protection solution provides real-time protection against known and unknown threats on endpoints such as laptops, desktops, and servers. It includes features such as:

* **Agent-based Protection**: A lightweight agent installed on each endpoint that monitors system activity and reports back to the Falcon platform.

* **Memory-based Protection**: The ability to detect and prevent malware from running in memory, even if it has evaded traditional signature-based detection.

4. **Cloud-Based Storage**: CrowdStrike's cloud-based storage infrastructure is designed to handle large amounts of data generated by its customers' endpoints and network traffic. It provides scalable storage capacity and enables rapid search and analysis of large datasets.

Some of the technical challenges that CrowdStrike's customers may face include:

1. **Data Volume**: Managing large amounts of data generated by endpoints, network traffic, and other sources.

2. **Threat Complexity**: Identifying and analyzing complex threats that use multiple vectors of attack.

3. **False Positives**: Minimizing false positive alerts that can lead to unnecessary remediation efforts.

4. **Incident Response**: Responding quickly and effectively to detected threats, while minimizing the impact on business operations.

5. **Integration**: Integrating CrowdStrike's platform with existing security tools and infrastructure.

To address these challenges, CrowdStrike uses a variety of technical approaches, including:

1. **Artificial Intelligence (AI)**: Machine learning algorithms that can analyze vast amounts of data to identify patterns and anomalies.

2. **Behavioral Analysis**: Analyzing system behavior and network traffic to identify potential threats.

3. **Cloud-Based Architecture**: Scalable cloud-based infrastructure that can handle large amounts of data.

4. **API Integration**: Integration with other security tools and infrastructure through APIs.

5. **Endpoint Isolation**: Isolating compromised endpoints to prevent lateral movement of threats.

Overall, CrowdStrike's technology is designed to provide advanced threat detection, incident response, and endpoint protection capabilities to help organizations stay ahead of sophisticated cyber attacks.

The problem is 

CrowdStrike has launched an investigation after reports of widespread Windows hosts experiencing a Blue Screen of Death (BSOD) due to a recent update to its Falcon sensor. The company has confirmed that a defect in the update is causing the issue and is working on reverting the changes.

The BSOD has caused impacted devices to enter loops, making them inoperable. A temporary workaround involves booting systems in Safe Mode and deleting a CrowdStrike component. CrowdStrike's CEO, George Kurtz, stated that Mac and Linux hosts are not affected by the issue, which is not a security incident or cyberattack.

The problem has caused significant disruptions worldwide, with major airports, banks, media outlets, and hospitals reporting outages. However, some incidents appear to be unrelated to CrowdStrike, including a recent Microsoft cloud service outage. Some news outlets have mistakenly linked the two incidents.

Despite this, CrowdStrike's update has caused problems for many organizations, including major airports around the world. American Airlines reported that flights were grounded due to a "technical issue with CrowdStrike." Google Cloud also reported an incident affecting its Compute Engine, citing Windows VMs using CrowdStrike's csagent.sys as the cause.

Reputable cybersecurity expert Kevin Beaumont confirmed that CrowdStrike is the root cause of the global IT outage, not Microsoft. "Crowdstrike is the top-tier EDR product, and is on everything from point of sale to ATMs - this will be the biggest 'cyber' incident worldwide ever in terms of impact, most likely," Beaumont said.

As a result of the outage, shares of publicly traded CrowdStrike plummeted by around 20%. This incident could potentially become one of the worst cyber failures in history.

Microsoft has confirmed that a CrowdStrike update was responsible for bringing down several IT systems globally and is actively supporting customers to assist in their recovery. The tech giant does not believe this is related to a previous Azure outage.

The Associated Press is tracking disruptions across the US and other parts of the world, with thousands of flights canceled or delayed globally. Disruptions have also been reported in various industries, including finance, transportation, and healthcare."

Some users have reported that restarting their computers multiple times (up to 15) can resolve the issue. Once connected to the network, they can receive the corrective update published by CrowdStrike. CrowdStrike's CEO, George Kurtz, has also addressed the issue on social media, reassuring users that "CrowdStrike is actively working with customers affected by a defect found in a single content update for Windows hosts... This is not a security incident or cyberattack."

However, the damage has already been done, and it may take several hours for airports, banks, administrations, and other affected entities to return to normal operations.

Notably, Kurtz emphasized that users running Mac and Linux operating systems are not impacted by this issue.