\n<\/p>\n
CrowdStrike\u2019s faulty update caused a worldwide tech disaster that affected 8.5 million Windows devices on Friday, according to Microsoft<\/a>. Microsoft\u00a0says that\u2019s \u201cless than one percent of all Windows machines,\u201d but it was enough to create problems for retailers, banks, airlines, and many other industries, as well as everyone who relies on them.<\/p>\n<\/div>\n CrowdStrike\u2019s breakdown explains the configuration file that was at the heart of the issue:<\/p>\n<\/div>\n The configuration files mentioned above are referred to as \u201cChannel Files<\/a>\u201d and are part of the behavioral protection mechanisms used by the Falcon sensor. Updates to Channel Files are a normal part of the sensor\u2019s operation and occur several times a day in response to novel tactics, techniques, and procedures discovered by CrowdStrike. This is not a new process; the architecture has been in place since Falcon\u2019s inception.<\/p>\n<\/blockquote>\n<\/div>\n CrowdStrike explained that the file is not a kernel driver but is responsible for \u201chow Falcon evaluates named pipe1\u00a0execution on Windows systems.\u201d Security researcher and Objective See founder Patrick Wardle says that the explanation<\/a> aligns with the earlier analysis he and others provided about the cause of the crash, as the problem file \u201cC-00000291- \u201ctriggered a logic error that resulted in an OS crash\u201d (via CSAgent.sys).\u201d <\/p>\n<\/div>\n Other excerpts from CrowdStrike\u2019s blog explain more about what went wrong:<\/p>\n<\/div>\n On July 19, 2024 at 04:09 UTC, as part of ongoing operations, CrowdStrike released a sensor configuration update to Windows systems. Sensor configuration updates are an ongoing part of the protection mechanisms of the Falcon platform. This configuration update triggered a logic error resulting in a system crash and blue screen (BSOD) on impacted systems.<\/p>\n<\/blockquote>\n<\/div>\n And which systems were affected and when:<\/p>\n<\/div>\n Systems running Falcon sensor for Windows 7.11 and above that downloaded the updated configuration from 04:09 UTC to 05:27 UTC \u2013 were susceptible to a system crash.<\/p>\n<\/blockquote>\n<\/div>\n CrowdStrike\u2019s channel file updates were pushed to computers regardless of any settings meant to prevent such automatic updates, Wardle noted<\/a>.<\/p>\n<\/div>\n\n
\n
\n