AS MILLIONS of Windows computers were left crippled for hours, disrupting the services of airlines, banks, hospitals and stock exchanges worldwide, cyber-security platform CrowdStrike on Saturday tried to explain what actually went wrong at their end. According to the company which provides third-party security updates to the Satya Nadella-run tech giant, on July 19, at 9.30 am (India time), it released a sensor configuration update to Windows systems. Sensor configuration updates are an ongoing part of the protection mechanisms of the Falcon platform. “This configuration update triggered a logic error resulting in a system crash and blue screen (BSOD) on impacted systems,” said CrowdStrike. In a technical blog, the company said the sensor configuration update that caused the system crash was remediated at around 10.57 a.m.

 

“This issue is not the result of or related to a cyberattack,” it said. Millions of customers running Falcon sensor for Windows version 7.11 and above that were online were impacted. “Systems running Falcon sensor for Windows 7.11 and above that downloaded the updated configuration from 9.30 am to 10.57 a.m. -- were susceptible to a system crash,” the company said. According to it, this is not a new process and the architecture has been in place since Falcon’s inception. The update that occurred at 9.30 am was designed to target newly-observed, malicious named pipes being used by common C2 frameworks in cyberattacks. The configuration update triggered a logic error that resulted in an operating system crash. “CrowdStrike has corrected the logic error by updating the content in Channel File 291. No additional changes to Channel File 291 beyond the updated logic will be deployed.

 

Falcon is still evaluating and protecting against the abuse of named pipes,” the company explained. Systems that are not currently impacted will continue to operate as expected, continue to provide protection, and have no risk of experiencing this event in the future. Airline systems across airports working normally: Minister: AIRLINE systems across airports, which were impacted due to a global IT outage on Friday, have started working normally, and all issues are likely to be resolved by noon on Saturday, Civil Aviation Minister K Rammohan Naidu said. The Ministry is constantly monitoring the operations at airports and airlines to ensure travel readjustments and refunds are taken care of, he added.