Global IT disruption caused by a defective CrowdStrike Falcon Sensor update

[coffeeprogrammer]

I don’t think the registry key fixes it.

From what I gather, it’s a kernel-level module (driver) that causes the bugcheck.

If disabling the service works to start Windows, great! But don’t forget to roll back the update and re-enable the service.

@EdwinG that registry path is where Windows specifics its drivers, really drivers are just a services, I am not up on the details, but I bet in most cases just disabling the Driver would fix things. These are the things loading when you see the Windows circles on boot up. I do not have much experience writing Windows Drivers yet, but my guess is it is not that hard. The funny thing is that typically drivers are test and signed by MS before they will load in to a default modern Windows.

A quick google and I think is tells about that registry path

Registry Trees for Devices and Drivers - Windows drivers

Registry Trees for Devices and Drivers

learn.microsoft.com

 

[MichaelRSorg]

From my understanding (see https://www.crowdstrike.com/blog/technical-details-on-todays-outage/), this was what we used to call "definitions updates" for antivirus software.
This is the kind of base update that one would expect the AV software to receive multiple times per day.

Granted. But my point does not depend on whether the update was to code or data or a ruleset or whatever. The update had the potential to screw things up big time and yet it was blindly trusted. No excuse for that. Reasons, yes. Excuses, no. And, the release did not seem very staggered.

 

[Fuzzball]

A co-worker of mine took Fri/Mon off and was headed out of town. They drove 3 hours to LAX late Thursday and got to spend much of the night in the airport, & then slept in the car before driving back home. He's here at work today so as not to burn that other vacation day. Oh well.... he's got a story to tell out of it.

 

[f1assistance]

Crowdstrike and complicit Microsoft show the digital world very clearly and purposefully how MITM's work. Is it a relief that Mac and Liinux didn't get their update pushed out?

 

[jay thompson]

Our county IT admin was kind enough to give 3 guys the day off on Friday because everything was going smoothly on Thursday.
He went in about 2am Friday after the alerts went off and finished the servers about 5, then his other guys not on a day off came in and took care of PCs in the court, govt center, jail and fairground. 600 PCs were finally done about 3pm.

 

[Fuzzball]

...600 PCs were finally done about 3pm.

Wow, those guys were on a ROLL! I'd like to see their "how to" notes from the experience.