# Breaking news - huge outage/interruption created by Crowdstrike problem (July 2024) **URL:** \ **Category:** Miscellaneous and Personal Stuff I Must Share\ **Created:** [July 19, 2024, 9:02am UTC](https://boards.straightdope.com/t/breaking-news-huge-outage-interruption-created-by-crowdstrike-problem-july-2024/1004454 "2024-07-19T09:02:18Z")\ **Posts on this page:** 20\ **Page:** 5
**Author:** ![Dewey\_Finn](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/dewey_finn/32/4222_2.png) [@Dewey\_Finn](https://boards.straightdope.com/u/Dewey_Finn)\ **Post date:** [July 20, 2024, 2:08pm UTC](https://boards.straightdope.com/t/breaking-news-huge-outage-interruption-created-by-crowdstrike-problem-july-2024/1004454/81 "2024-07-20T14:08:55Z")
> [@xtenkfarpl](#): > > Doesn’t seem to have been pushed much in the home market, unlike say, McAfee or Malwarebytes? It’s not; the company sells mostly or entirely to enterprise clients. ---
**Author:** ![kenobi\_65](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/kenobi_65/32/13178_2.png) [@kenobi\_65](https://boards.straightdope.com/u/kenobi_65)\ **Post date:** [July 20, 2024, 2:09pm UTC](https://boards.straightdope.com/t/breaking-news-huge-outage-interruption-created-by-crowdstrike-problem-july-2024/1004454/82 "2024-07-20T14:09:08Z")
> [@xtenkfarpl](#): > > Doesn’t seem to have been pushed much in the home market, unlike say, McAfee or Malwarebytes? My understanding is that this is exactly the case. Based on discussion upthread, it looks like, while they do apparently offer a consumer product, the vast majority of their business is done with companies, not individual/home consumers. ---
**Author:** ![xtenkfarpl](https://avatars.discourse-cdn.com/v4/letter/x/c2a13f/32.png) [@xtenkfarpl](https://boards.straightdope.com/u/xtenkfarpl)\ **Post date:** [July 20, 2024, 2:31pm UTC](https://boards.straightdope.com/t/breaking-news-huge-outage-interruption-created-by-crowdstrike-problem-july-2024/1004454/83 "2024-07-20T14:31:58Z")
> [@Dewey\_Finn](#): > > It’s not; the company sells mostly or entirely to enterprise clients. So I see. I’ve been out of the software game for a few years now, but when I was in it, I was a kernel hacker more concerned with performance issues than security stuff. I always did think though that security programs using a ‘scan for known badness’ approach were fighting an ultimately unwinnable battle, and the only reasonable method is a whitelist. But users _will_ download attractive stuff… 🙂 Anyway, getting a bit off topic for Breaking News… if anyone is interested in discussing security theory we should probably spin off a new thread. ---
**Author:** ![Zyada](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/zyada/32/3028_2.png) [@Zyada](https://boards.straightdope.com/u/Zyada)\ **Post date:** [July 20, 2024, 5:48pm UTC](https://boards.straightdope.com/t/breaking-news-huge-outage-interruption-created-by-crowdstrike-problem-july-2024/1004454/84 "2024-07-20T17:48:32Z")
> [@Dewey\_Finn](#): > > > [@Chronos](#): > > > > > [@Dewey\_Finn](#): > > > > > > Don’t just _listen_ to your IT people. Bow down to them; _worship_ them. Because without them, nothing would happen at your company. And encourage management to give them big fat raises, well above what the CEO gets. Trust me; they’re worth it. > > > > Well, some of them are worth it. While others push out root-access updates to the whole planet without testing them first. > > The fault is with management. The peons in IT deserve more money. Can be a little bit of both. The last place I worked was a small shop, and the problem with small shops is that there is always a prima donna. In this case, our prima donna was the golden child of the manager. He put a change out without going through any testing, which all the other developers would have sent to our very good test group. Of course it broke everything. In the post-mortem, manager kept asking why the problem wasn’t caught in testing. After the second or third time, I said point blank that the tester couldn’t test a change he didn’t know was going in. I don’t think the manager liked that. As a programmer, I think the testers are the real heroes. ---
**Author:** ![Voyager](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/voyager/32/133_2.png) [@Voyager](https://boards.straightdope.com/u/Voyager)\ **Post date:** [July 20, 2024, 6:10pm UTC](https://boards.straightdope.com/t/breaking-news-huge-outage-interruption-created-by-crowdstrike-problem-july-2024/1004454/85 "2024-07-20T18:10:22Z")
> [@N9IWP](#): > > Southwest airlines fake (I think) Facebook post (I couldn’t find it) Not quiet a C64 but almost. They didn’t get affected because they still run Windows 3.1. [Cite](https://www.yahoo.com/tech/windows-version-1992-saving-southwest-171922788.html) ---
**Author:** ![Greg\_Charles](https://avatars.discourse-cdn.com/v4/letter/g/839c29/32.png) [@Greg\_Charles](https://boards.straightdope.com/u/Greg_Charles)\ **Post date:** [July 21, 2024, 2:44am UTC](https://boards.straightdope.com/t/breaking-news-huge-outage-interruption-created-by-crowdstrike-problem-july-2024/1004454/86 "2024-07-21T02:44:40Z")
My brain is getting old. I just can’t process that a company named Crowdstrike is focused on _protecting_ you from security threats, not creating them. Its name should have some mutation of “protect”, “secure”, “guard”, or at least “umbrella” in it. Are we even sure this wasn’t intentional? I don’t want to go through convincing my brain that Crowdstrike isn’t a bunch nihilist eastern European hackers, only to find out in a week or two that it actually is. ---
**Author:** ![kenobi\_65](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/kenobi_65/32/13178_2.png) [@kenobi\_65](https://boards.straightdope.com/u/kenobi_65)\ **Post date:** [July 21, 2024, 3:04am UTC](https://boards.straightdope.com/t/breaking-news-huge-outage-interruption-created-by-crowdstrike-problem-july-2024/1004454/87 "2024-07-21T03:04:34Z")
> [@Greg\_Charles](#): > > Are we even sure this wasn’t intentional? I don’t want to go through convincing my brain that Crowdstrike isn’t a bunch nihilist eastern European hackers, only to find out in a week or two that it actually is. If so, they’ve done an exceptionally good job of covering their tracks, given that, in the 13 years since they were founded, they’ve repeatedly uncovered and addressed cyberattacks by Russian, Chinese, and North Korean hackers against Western targets. ---
**Author:** ![Magiver](https://avatars.discourse-cdn.com/v4/letter/m/4491bb/32.png) [@Magiver](https://boards.straightdope.com/u/Magiver)\ **Post date:** [July 21, 2024, 4:29am UTC](https://boards.straightdope.com/t/breaking-news-huge-outage-interruption-created-by-crowdstrike-problem-july-2024/1004454/88 "2024-07-21T04:29:37Z")
> [@kenobi\_65](#): > > If so, they’ve done an exceptionally good job of covering their tracks, given that, in the 13 years since they were founded, they’ve repeatedly uncovered and addressed cyberattacks by Russian, Chinese, and North Korean hackers against Western targets. Well it’s not as crazy as it sounds. The purpose of Crowdstrike is to stop hackers from causing harm. China is certainly working on ways to collapse our infrastructure through hacking methods. Give someone $1M to change a line of code that magically doesn’t get tested… ---
**Author:** ![kenobi\_65](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/kenobi_65/32/13178_2.png) [@kenobi\_65](https://boards.straightdope.com/u/kenobi_65)\ **Post date:** [July 21, 2024, 4:31am UTC](https://boards.straightdope.com/t/breaking-news-huge-outage-interruption-created-by-crowdstrike-problem-july-2024/1004454/89 "2024-07-21T04:31:25Z")
> [@Magiver](#): > > Give someone $1M to change a line of code that magically doesn’t get tested… Not that I disagree, but there’s a large difference between one compromised programmer at Crowdstrike, and this idea: > [@Greg\_Charles](#): > > I don’t want to go through convincing my brain that Crowdstrike isn’t a bunch nihilist eastern European hackers, only to find out in a week or two that it actually is. ---
**Author:** ![Magiver](https://avatars.discourse-cdn.com/v4/letter/m/4491bb/32.png) [@Magiver](https://boards.straightdope.com/u/Magiver)\ **Post date:** [July 21, 2024, 4:43am UTC](https://boards.straightdope.com/t/breaking-news-huge-outage-interruption-created-by-crowdstrike-problem-july-2024/1004454/90 "2024-07-21T04:43:44Z")
I agree. But I was born at a time when physical tickets got you on a plane and worldwide scheduled flights didn’t collapse over a software bug. ---
**Author:** ![Chronos](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/chronos/32/134_2.png) [@Chronos](https://boards.straightdope.com/u/Chronos)\ **Post date:** [July 21, 2024, 12:32pm UTC](https://boards.straightdope.com/t/breaking-news-huge-outage-interruption-created-by-crowdstrike-problem-july-2024/1004454/91 "2024-07-21T12:32:26Z")
> [@Greg\_Charles](#): > > My brain is getting old. I just can’t process that a company named Crowdstrike is focused on _protecting_ you from security threats, not creating them. Its name should have some mutation of “protect”, “secure”, “guard”, or at least “umbrella” in it. Yeah, it sounds like it should be a tool for conducting distributed denial of service attacks (where a whole bunch of different users, probably a botnet of home computers taken over by some other security hole, all try to access the same site at once to overwhelm its capacity). ---
**Author:** ![Voyager](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/voyager/32/133_2.png) [@Voyager](https://boards.straightdope.com/u/Voyager)\ **Post date:** [July 21, 2024, 7:17pm UTC](https://boards.straightdope.com/t/breaking-news-huge-outage-interruption-created-by-crowdstrike-problem-july-2024/1004454/92 "2024-07-21T19:17:44Z")
I wonder how much testing for small changes they do as standard procedure. Reducing work force size to increase profits can lead to this kind of thing. In this case, even the simplest test would have caught it. Not unprecedented, though. When I was at Bell Labs one guy screwing up a C switch statement and not testing the revised module because the change was so small took down a good chunk of the long distance system. ---
**Author:** ![Skywatcher](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/skywatcher/32/254_2.png) [@Skywatcher](https://boards.straightdope.com/u/Skywatcher)\ **Post date:** [July 22, 2024, 12:25pm UTC](https://boards.straightdope.com/t/breaking-news-huge-outage-interruption-created-by-crowdstrike-problem-july-2024/1004454/93 "2024-07-22T12:25:04Z")
> [@Skywatcher](#): > > I have no idea what our IT plans to do about those who aren’t local (i.e.: within a 50 mile radius of HQ) but they’re encouraging those who are to visit one of the two depots around HQ on Monday. Great. Now they want us to make an appointment for onsite IT support but their appointment scheduler appears to be overloaded! First, there were no appointments available until tomorrow and trying to book one of them continually returned “please try again”; now there are no appointments available at any time! And IT’s phone is still going straight to voicemail. ---
**Author:** ![Cervaise](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/cervaise/32/16693_2.png) [@Cervaise](https://boards.straightdope.com/u/Cervaise)\ **Post date:** [July 22, 2024, 12:29pm UTC](https://boards.straightdope.com/t/breaking-news-huge-outage-interruption-created-by-crowdstrike-problem-july-2024/1004454/94 "2024-07-22T12:29:28Z")
I found this buried in the comment section of Ars Technica — a Crowdstrike blog entry from 2021 where they urge their customers to accept and implement urgent updates without testing them. > **[How to Detect and Prevent Kernel Attacks with CrowdStrike](https://www.crowdstrike.com/blog/how-to-detect-and-prevent-kernel-attacks-with-crowdstrike/)** > > Given how devastating kernel attacks can be, we urge our customers to help protect against such attacks by upgrading their Falcon sensor to 5.41+ today. On the one hand, it could be argued that their evident confidence in their product was warranted at the time, because it took three and a half years after this article was published before a malformed update blew up the world. But _now,_ obviously, this is not a great look. ---
**Author:** ![echoreply](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/echoreply/32/3641_2.png) [@echoreply](https://boards.straightdope.com/u/echoreply)\ **Post date:** [July 22, 2024, 7:42pm UTC](https://boards.straightdope.com/t/breaking-news-huge-outage-interruption-created-by-crowdstrike-problem-july-2024/1004454/95 "2024-07-22T19:42:42Z")
Microsoft says 8.5 million Windows computers were affected. Starting at $9/month/seat for a Crowdstrike license, that’s some pretty good revenue. Before this incident I couldn’t remember if the company was Cloudstrike or Crowdstrike, so maybe any publicity is good publicity? Microsoft has also released a bootable USB recovery tool. > **[Helping our customers through the CrowdStrike outage - The Official Microsoft...](https://blogs.microsoft.com/blog/2024/07/20/helping-our-customers-through-the-crowdstrike-outage/)** > > On July 18, CrowdStrike, an independent cybersecurity company, released a software update that began impacting IT systems globally. Although this was not a Microsoft incident, given it impacts our ecosystem, we want to provide an update on the steps... > **[New Recovery Tool to help with CrowdStrike issue impacting Windows endpoints](https://techcommunity.microsoft.com/t5/intune-customer-success/new-recovery-tool-to-help-with-crowdstrike-issue-impacting/ba-p/4196959)** > > Steps for how to access and use the new recovery tool Microsoft created - updated on July 21 to provide two recovery options to expedite the repair process.. ---
**Author:** ![Skywatcher](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/skywatcher/32/254_2.png) [@Skywatcher](https://boards.straightdope.com/u/Skywatcher)\ **Post date:** [July 22, 2024, 10:59pm UTC](https://boards.straightdope.com/t/breaking-news-huge-outage-interruption-created-by-crowdstrike-problem-july-2024/1004454/96 "2024-07-22T22:59:06Z")
> [@echoreply](#): > > Microsoft says 8.5 million Windows computers were affected. > [@Velocity](#): > > So what percentage of Windows users are actually affected by this? Is it like 1%, 10%? Microsoft estimates there are 500 million (based on their educated guess regarding where numbers were heading late last year) devices running Windows 11 and another 200 million which haven’t been upgraded from 10 so that’s approximately 1%. ---
**Author:** ![Magiver](https://avatars.discourse-cdn.com/v4/letter/m/4491bb/32.png) [@Magiver](https://boards.straightdope.com/u/Magiver)\ **Post date:** [July 23, 2024, 3:57am UTC](https://boards.straightdope.com/t/breaking-news-huge-outage-interruption-created-by-crowdstrike-problem-july-2024/1004454/97 "2024-07-23T03:57:07Z")
2 things: 1. Delta is still having problems digging out from under this 3 days out because their crew scheduling computers took a hit. 2. I vaguely remember a computer crash many years ago that gave me a boot choice of the last previous update or something along those lines. Vague is the key word. Am i misremembering this entirely? ---
**Author:** ![Heracles](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/heracles/32/487_2.png) [@Heracles](https://boards.straightdope.com/u/Heracles)\ **Post date:** [July 23, 2024, 4:30am UTC](https://boards.straightdope.com/t/breaking-news-huge-outage-interruption-created-by-crowdstrike-problem-july-2024/1004454/98 "2024-07-23T04:30:15Z")
> [@carnut](#): > > My iPad shut down on me last night and I haven’t been able to get it working again, but that shouldn’t be related. The iPad is about 16 years old… I don’t know if this was in jest, but the first iPad appeared on the market in early 2010, 14½ years ago. ---
**Author:** ![gnoitall](https://avatars.discourse-cdn.com/v4/letter/g/bb73d2/32.png) [@gnoitall](https://boards.straightdope.com/u/gnoitall)\ **Post date:** [July 23, 2024, 2:15pm UTC](https://boards.straightdope.com/t/breaking-news-huge-outage-interruption-created-by-crowdstrike-problem-july-2024/1004454/99 "2024-07-23T14:15:01Z")
> [@Magiver](#): > > vaguely remember a computer crash many years ago that gave me a boot choice of the last previous update Windows has a “system restore point” capability that can checkpoint the state of the system files, allowing a fallback if an update doesn’t work. But those are optional, they require time to execute and allocated file system space to store, and I don’t think most endpoint security products do them (perhaps because malware might be able to silently use a restore to roll back anti-malware software). ---
**Author:** ![Skywatcher](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/skywatcher/32/254_2.png) [@Skywatcher](https://boards.straightdope.com/u/Skywatcher)\ **Post date:** [July 23, 2024, 6:29pm UTC](https://boards.straightdope.com/t/breaking-news-huge-outage-interruption-created-by-crowdstrike-problem-july-2024/1004454/100 "2024-07-23T18:29:00Z")
Was able to secure at IT appointment for this morning and am using it now; putting in a half day. For timekeeping purposes, the use of Non-Classified Time has been granted for however long computers were down, within reason. “Within reason” determined by one’s immediate supervisor(s). [Previous page](https://boards.straightdope.com/t/breaking-news-huge-outage-interruption-created-by-crowdstrike-problem-july-2024/1004454.md?page=4) [Next page](https://boards.straightdope.com/t/breaking-news-huge-outage-interruption-created-by-crowdstrike-problem-july-2024/1004454.md?page=6)