Crowdstrike aftermath: How to protect your company

Crowdstrike (CRWD) is a Texas-based cybersecurity company that specializes in end-point security, threat intelligence, and cyberattack response services. It achieves this through its Falcon platform, which uses artificial intelligence to offer protection against cyber attacks.

Why Crowdstrike (CRWD) Is Still The Leading Cybersecurity Company

Crowdstrike, AWS launch second annual Cybersecurity Startup Accelerator with Nvidia

The following year, they hired Shawn Henry, a former Federal Bureau of Investigation (FBI) official, to lead the subsidiary CrowdStrike Services, Inc., which offered security and response services. The company launched CrowdStrike Falcon, an antivirus package, as its first product in June 2013.

CrowdStrike - Wikipedia

The company’s engineers took action to address the problem, according to an advisory viewed by CNN, which told customers to reboot their computers and perform other actions if they were still having technical issues. The issue is specific to Falcon, one of CrowdStrike’s main software products, ...

What is Crowdstrike and how is it linked to the global outage? | CNN Business

German finance giant Allianz said it was &quot;experiencing a major outage that is impacting employees ability to log into their computers. It impacts multiple companies besides Allianz, specifically affecting the Windows login and is caused by an incident at our provider CrowdStrike.&quot;

CrowdStrike issue causes major outage affecting businesses around the world

The outages Friday were connected to &quot;a defect found in a single content update for Windows hosts,&quot; CrowdStrike CEO George Kurtz said in a statement​​.

What is CrowdStrike, the cybersecurity company behind the global Microsoft outages? - CBS News

So highly valued was CrowdStrike and its prospects that it was trading at a stupendous rating. Investors traditionally value companies on a multiple of their earnings (the price/earnings ratio) and, the higher the multiple, the more highly it is rated.

From Wall Street darling to firm behind the world's worst IT outage - who are CrowdStrike? | Business News | Sky News

Crowdstrike, the U.S. cybersecurity company, has admitted to being responsible for the error and are working to correct it.

Crowdstrike outage: What is the cyber security company linked to the global outage? - ABC7 New York

Crowdstrike

crowdstrike

So, let’s dive into the drama: Microsoft is laying the blame squarely on Delta for its epic struggle to bounce back from that global cyber outage that had the airline canceling over 6,000 flights. Yep, you read that right—6,000! The conflicting accounts from Delta Air Lines, cybersecurity firm CrowdStrike, and Microsoft have erupted into a blame game filled with legal threats. This situation highlights one of the consequences of a world increasingly reliant on a few key technology providers. Here’s the lowdown: Last month, CrowdStrike, a global cybersecurity firm, rolled out a software update that caused some serious chaos for Microsoft’s clientele, including a bunch of airlines. While other major US carriers managed to get their act together the next day, Delta was still floundering. Microsoft’s initial findings suggest that Delta, unlike its peers, hadn’t exactly kept up with the times regarding IT infrastructure. In other words, their tech setup might be a bit of a dinosaur compared to others. Delta, not taking this lying down, has roped in the big guns—David Boies of Boies Schiller Flexner—to seek damages from both CrowdStrike and Microsoft. They’re not just asking for a little something; they’re gunning for serious compensation. Delta’s CEO, Ed Bastian, took to CNBC last week to air some grievances, saying that both Microsoft and CrowdStrike had dropped the ball on providing “exceptional service.” He even went as far as to label Microsoft’s platform as the “most fragile.” Bastian declared that the airline, which leads the U.S. in revenue, has “no choice” but to take legal action against the two tech firms. With an estimated $500 million in damages from lost revenue and refunds due to flight delays and cancellations, Bastian emphasized that pursuing legal recourse is the only viable option. Microsoft’s lawyer has accused Delta of presenting a “false picture” of its actions following the July CrowdStrike outage. Mark Cheffo, a Microsoft lawyer, wasn’t having any of it. He fired back, calling Delta’s accusations “incomplete, false, misleading, and damaging to Microsoft and its reputation.” According to Cheffo, Microsoft’s software wasn’t the culprit behind the CrowdStrike mess, but they did offer help—free of charge!—which Delta apparently ignored. Cheffo also claimed Microsoft’s CEO, Satya Nadella, reached out to Bastian directly via email and got nothing but crickets in return. CrowdStrike, which was responsible for initiating the outage on Microsoft Windows systems with a problematic update, pushed back on Sunday. In a letter reviewed by Axios, the company “strongly rejects” any claims of gross negligence or willful misconduct related to the outage.


The letter also warns that if Delta proceeds with its “public threat of litigation,” the airline will need to justify to the public, its shareholders, and possibly a jury why CrowdStrike accepted responsibility for its actions while Delta did not.


Meanwhile, CrowdStrike is already contending with a proposed class action lawsuit from affected air travelers. Microsoft says it repeatedly tried to lend a hand after the outage, but Delta turned them down. Apparently, Delta was using other tech providers for crew-tracking and scheduling, which Microsoft thinks might be why Delta refused their help. Cheffo made it clear that if Delta decides to sue, Microsoft will be ready to “vigorously” defend itself. And CrowdStrike is also pushing back, stating that their CEO personally offered on-site assistance to Delta’s CEO, which, you guessed it, went unanswered. Here's the latest: On Tuesday, Microsoft sent a letter to Delta outlining what it claims are communications demonstrating Delta's refusal of Microsoft's assistance. According to Microsoft, this refusal was likely due to Delta relying on IBM or other tech companies for support with its downed crew-tracking and scheduling systems. So, let’s dive into the drama: Microsoft is laying the blame squarely on Delta for its epic struggle to bounce back from that global cyber outage that had the airline canceling over 6,000 flights. Yep, you read that right—6,000! Delta The conflicting accounts from Delta Air Lines, cybersecurity firm CrowdStrike, and Microsoft have erupted into a blame game filled with legal threats. This situation highlights one of the consequences of a world increasingly reliant on a few key technology providers. Here’s the lowdown: Last month, CrowdStrike , a global cybersecurity firm, rolled out a software update that caused some serious chaos for Microsoft’s clientele, including a bunch of airlines. While other major US carriers managed to get their act together the next day, Delta was still floundering. CrowdStrike other major US Microsoft’s initial findings suggest that Delta, unlike its peers, hadn’t exactly kept up with the times regarding IT infrastructure. In other words, their tech setup might be a bit of a dinosaur compared to others. Delta, not taking this lying down, has roped in the big guns—David Boies of Boies Schiller Flexner—to seek damages from both CrowdStrike and Microsoft. They’re not just asking for a little something; they’re gunning for serious compensation. Delta’s CEO, Ed Bastian, took to CNBC last week to air some grievances, saying that both Microsoft and CrowdStrike had dropped the ball on providing “exceptional service.” He even went as far as to label Microsoft’s platform as the “most fragile.” Bastian declared that the airline, which leads the U.S. in revenue, has “no choice” but to take legal action against the two tech firms. With an estimated $500 million in damages from lost revenue and refunds due to flight delays and cancellations, Bastian emphasized that pursuing legal recourse is the only viable option. legal action Microsoft’s lawyer has accused Delta of presenting a “false picture” of its actions following the July CrowdStrike outage. Mark Cheffo, a Microsoft lawyer, wasn’t having any of it. He fired back, calling Delta’s accusations “incomplete, false, misleading, and damaging to Microsoft and its reputation.” According to Cheffo, Microsoft’s software wasn’t the culprit behind the CrowdStrike mess, but they did offer help—free of charge!—which Delta apparently ignored. Cheffo also claimed Microsoft’s CEO, Satya Nadella, reached out to Bastian directly via email and got nothing but crickets in return. CrowdStrike, which was responsible for initiating the outage on Microsoft Windows systems with a problematic update, pushed back on Sunday. In a letter reviewed by Axios, the company “strongly rejects” any claims of gross negligence or willful misconduct related to the outage. The letter also warns that if Delta proceeds with its “public threat of litigation,” the airline will need to justify to the public, its shareholders, and possibly a jury why CrowdStrike accepted responsibility for its actions while Delta did not. Meanwhile, CrowdStrike is already contending with a proposed class action lawsuit from affected air travelers. CrowdStrike, which was responsible for initiating the outage on Microsoft Windows systems with a problematic update, pushed back on Sunday. In a letter reviewed by Axios, the company “strongly rejects” any claims of gross negligence or willful misconduct related to the outage. CrowdStrike, which was responsible for initiating the outage on Microsoft Windows systems with a problematic update, pushed back on Sunday. In a letter reviewed by Axios, the company “strongly rejects” any claims of gross negligence or willful misconduct related to the outage. The letter also warns that if Delta proceeds with its “public threat of litigation,” the airline will need to justify to the public, its shareholders, and possibly a jury why CrowdStrike accepted responsibility for its actions while Delta did not. The letter also warns that if Delta proceeds with its “public threat of litigation,” the airline will need to justify to the public, its shareholders, and possibly a jury why CrowdStrike accepted responsibility for its actions while Delta did not. Meanwhile, CrowdStrike is already contending with a proposed class action lawsuit from affected air travelers. Meanwhile, CrowdStrike is already contending with a proposed class action lawsuit from affected air travelers. Microsoft says it repeatedly tried to lend a hand after the outage, but Delta turned them down. Apparently, Delta was using other tech providers for crew-tracking and scheduling, which Microsoft thinks might be why Delta refused their help. Cheffo made it clear that if Delta decides to sue, Microsoft will be ready to “vigorously” defend itself. And CrowdStrike is also pushing back, stating that their CEO personally offered on-site assistance to Delta’s CEO, which, you guessed it, went unanswered. Here's the latest: On Tuesday, Microsoft sent a letter to Delta outlining what it claims are communications demonstrating Delta's refusal of Microsoft's assistance. According to Microsoft, this refusal was likely due to Delta relying on IBM or other tech companies for support with its downed crew-tracking and scheduling systems.

Microsoft Rips Into Delta Airlines For Sluggish Recovery After Global CrowdStrike Outage

CrowdStruck: How the CrowdStrike Outage Taught Me the Value of Listening

The Microsoft and CrowdStrike Catastrophe: A Run-Down

Introduction: Imagine waking up to find that every PC around the world, especially those in businesses, is suddenly unusable. Business meetings are falling apart, news networks are in disarray, and flights are grounded. The chaos is beyond anything imaginable. What happened? Let’s break down the CrowdStrike blue screen chaos. The Issue: The issue began with a bad update from CrowdStrike Falcon. This update, intended to enhance security, accidentally turned a critical driver file into a series of zeros. As a result, computers running Falcon couldn’t boot up, leading to blue screens across the globe. You might wonder why only Windows was affected. It’s because Windows, despite being popular, has more security vulnerabilities compared to other operating systems like macOS or Linux. Falcon’s deep integration with Windows, designed to bolster security, ironically made it a single point of failure when things went wrong. The Fix: Fixing this issue isn’t simple. Users need to boot in safe mode, use command prompts, and manually delete the corrupted driver file. For systems with BitLocker encryption, the process is even more complicated, requiring additional steps to decrypt the hard drive. The various information received detail the fix below 👇 𝗣𝗵𝘆𝘀𝗶𝗰𝗮𝗹 𝗖𝗼𝗺𝗽𝘂𝘁𝗲𝗿𝘀: Boot Windows into Safe Mode or the Windows Recovery Environment


Navigate to the 𝗖:\𝗪𝗶𝗻𝗱𝗼𝘄𝘀\𝗦𝘆𝘀𝘁𝗲𝗺𝟯𝟮\𝗱𝗿𝗶𝘃𝗲𝗿𝘀\𝗖𝗿𝗼𝘄𝗱𝗦𝘁𝗿𝗶𝗸𝗲 𝗱𝗶𝗿𝗲𝗰𝘁𝗼𝗿𝘆


Locate the file matching “𝗖-𝟬𝟬𝟬𝟬𝟬𝟮𝟵𝟭*.𝘀𝘆𝘀” 𝗮𝗻𝗱 𝗱𝗲𝗹𝗲𝘁𝗲 𝗶𝘁 (I would rename it to be safe).


Boot the host 𝗙𝗼𝗿 𝗔𝗪𝗦 (𝗔𝗺𝗮𝘇𝗼𝗻 𝗪𝗲𝗯 𝗦𝗲𝗿𝘃𝗶𝗰𝗲𝘀), 𝗳𝗼𝗹𝗹𝗼𝘄 𝘁𝗵𝗲𝘀𝗲 𝘀𝘁𝗲𝗽𝘀: Detach the EBS volume from the impacted EC2 instance.


Attach the EBS volume to a new EC2 instance.


Fix the CrowdStrike driver folder.


Detach the EBS volume from the new EC2 instance.


Attach the EBS volume back to the impacted EC2 instance. 𝗙𝗼𝗿 𝗔𝘇𝘂𝗿𝗲, 𝗳𝗼𝗹𝗹𝗼𝘄 𝘁𝗵𝗲𝘀𝗲 𝘀𝘁𝗲𝗽𝘀: Log in to the Azure console.
Go to Virtual Machines and select the affected VM.
In the upper left of the console, click “Connect”.
Click “More ways to Connect” and then select “Serial Console”.
Once SAC has loaded, type in ‘cmd’ and press Enter.
Type ‘ch -si 1’ and press the space bar.
Enter Administrator credentials.
Type the following commands:
‘bcdedit /set {current} safeboot minimal’
‘bcdedit /set {current} safeboot network’
Restart the VM.
To confirm the boot state, run the command: ‘wmic COMPUTERSYSTEM GET BootupState’. Checkout this video for a more detailed explanation 👇 https://youtu.be/GgP0EyuN8GA?si=F7WBzG8rvOld4qdh&embedable=true Conclusion: This incident underscores the importance of robust cybersecurity practices and the potential risks of deep system integrations. Thanks for reading; please give a like as a sort of encouragement and also share this post on socials to show your extended support. Follow for more ⏬ Twitter / Instagram / Github / Youtube / Newsletter / Discord Introduction: Introduction: Imagine waking up to find that every PC around the world, especially those in businesses, is suddenly unusable. Business meetings are falling apart, news networks are in disarray, and flights are grounded. The chaos is beyond anything imaginable. What happened? Let’s break down the CrowdStrike blue screen chaos. Let’s The Issue: The Issue: The issue began with a bad update from CrowdStrike Falcon. This update, intended to enhance security, accidentally turned a critical driver file into a series of zeros. As a result, computers running Falcon couldn’t boot up, leading to blue screens across the globe. You might wonder why only Windows was affected. It’s because Windows, despite being popular, has more security vulnerabilities compared to other operating systems like macOS or Linux. Falcon’s deep integration with Windows, designed to bolster security, ironically made it a single point of failure when things went wrong. The Fix: Fixing this issue isn’t simple. Users need to boot in safe mode, use command prompts, and manually delete the corrupted driver file. For systems with BitLocker encryption, the process is even more complicated, requiring additional steps to decrypt the hard drive. The various information received detail the fix below 👇 𝗣𝗵𝘆𝘀𝗶𝗰𝗮𝗹 𝗖𝗼𝗺𝗽𝘂𝘁𝗲𝗿𝘀: Boot Windows into Safe Mode or the Windows Recovery Environment Navigate to the 𝗖:\𝗪𝗶𝗻𝗱𝗼𝘄𝘀\𝗦𝘆𝘀𝘁𝗲𝗺𝟯𝟮\𝗱𝗿𝗶𝘃𝗲𝗿𝘀\𝗖𝗿𝗼𝘄𝗱𝗦𝘁𝗿𝗶𝗸𝗲 𝗱𝗶𝗿𝗲𝗰𝘁𝗼𝗿𝘆 Locate the file matching “𝗖-𝟬𝟬𝟬𝟬𝟬𝟮𝟵𝟭*.𝘀𝘆𝘀” 𝗮𝗻𝗱 𝗱𝗲𝗹𝗲𝘁𝗲 𝗶𝘁 (I would rename it to be safe). Boot the host Boot Windows into Safe Mode or the Windows Recovery Environment Boot Windows into Safe Mode or the Windows Recovery Environment Navigate to the 𝗖:\𝗪𝗶𝗻𝗱𝗼𝘄𝘀\𝗦𝘆𝘀𝘁𝗲𝗺𝟯𝟮\𝗱𝗿𝗶𝘃𝗲𝗿𝘀\𝗖𝗿𝗼𝘄𝗱𝗦𝘁𝗿𝗶𝗸𝗲 𝗱𝗶𝗿𝗲𝗰𝘁𝗼𝗿𝘆 Navigate to the 𝗖:\𝗪𝗶𝗻𝗱𝗼𝘄𝘀\𝗦𝘆𝘀𝘁𝗲𝗺𝟯𝟮\𝗱𝗿𝗶𝘃𝗲𝗿𝘀\𝗖𝗿𝗼𝘄𝗱𝗦𝘁𝗿𝗶𝗸𝗲 𝗱𝗶𝗿𝗲𝗰𝘁𝗼𝗿𝘆 Locate the file matching “𝗖-𝟬𝟬𝟬𝟬𝟬𝟮𝟵𝟭*.𝘀𝘆𝘀” 𝗮𝗻𝗱 𝗱𝗲𝗹𝗲𝘁𝗲 𝗶𝘁 (I would rename it to be safe). Locate the file matching “𝗖-𝟬𝟬𝟬𝟬𝟬𝟮𝟵𝟭*.𝘀𝘆𝘀” 𝗮𝗻𝗱 𝗱𝗲𝗹𝗲𝘁𝗲 𝗶𝘁 (I would rename it to be safe). Boot the host Boot the host 𝗙𝗼𝗿 𝗔𝗪𝗦 (𝗔𝗺𝗮𝘇𝗼𝗻 𝗪𝗲𝗯 𝗦𝗲𝗿𝘃𝗶𝗰𝗲𝘀), 𝗳𝗼𝗹𝗹𝗼𝘄 𝘁𝗵𝗲𝘀𝗲 𝘀𝘁𝗲𝗽𝘀: Detach the EBS volume from the impacted EC2 instance. Attach the EBS volume to a new EC2 instance. Fix the CrowdStrike driver folder. Detach the EBS volume from the new EC2 instance. Attach the EBS volume back to the impacted EC2 instance. Detach the EBS volume from the impacted EC2 instance. Detach the EBS volume from the impacted EC2 instance. Attach the EBS volume to a new EC2 instance. Attach the EBS volume to a new EC2 instance. Fix the CrowdStrike driver folder. Fix the CrowdStrike driver folder. Detach the EBS volume from the new EC2 instance. Detach the EBS volume from the new EC2 instance. Attach the EBS volume back to the impacted EC2 instance. Attach the EBS volume back to the impacted EC2 instance. 𝗙𝗼𝗿 𝗔𝘇𝘂𝗿𝗲, 𝗳𝗼𝗹𝗹𝗼𝘄 𝘁𝗵𝗲𝘀𝗲 𝘀𝘁𝗲𝗽𝘀: Log in to the Azure console. Go to Virtual Machines and select the affected VM. In the upper left of the console, click “Connect”. Click “More ways to Connect” and then select “Serial Console”. Once SAC has loaded, type in ‘cmd’ and press Enter. Type ‘ch -si 1’ and press the space bar. Enter Administrator credentials. Type the following commands: ‘bcdedit /set {current} safeboot minimal’ ‘bcdedit /set {current} safeboot network’ Restart the VM. To confirm the boot state, run the command: ‘wmic COMPUTERSYSTEM GET BootupState’. Log in to the Azure console. Go to Virtual Machines and select the affected VM. In the upper left of the console, click “Connect”. Click “More ways to Connect” and then select “Serial Console”. Once SAC has loaded, type in ‘cmd’ and press Enter. Type ‘ch -si 1’ and press the space bar. Enter Administrator credentials. Type the following commands: ‘bcdedit /set {current} safeboot minimal’ ‘bcdedit /set {current} safeboot network’ Restart the VM. To confirm the boot state, run the command: ‘wmic COMPUTERSYSTEM GET BootupState’. Checkout this video for a more detailed explanation 👇 https://youtu.be/GgP0EyuN8GA?si=F7WBzG8rvOld4qdh&embedable=true https://youtu.be/GgP0EyuN8GA?si=F7WBzG8rvOld4qdh&embedable=true Conclusion: Conclusion: This incident underscores the importance of robust cybersecurity practices and the potential risks of deep system integrations. Thanks for reading; please give a like as a sort of encouragement and also share this post on socials to show your extended support. Thanks for reading; please give a like as a sort of encouragement and also share this post on socials to show your extended support. Follow for more ⏬ Follow for more ⏬ Twitter / Instagram / Github / Youtube / Newsletter / Discord Twitter Twitter Instagram Instagram Github Github Youtube Youtube Newsletter Newsletter Discord Discord

Billions of Computers Not Working | Unraveling the Issue Behind the Global CrowdStrike Chaos 

By now you're probably aware that a certain segment of the population last week experienced what some of us in the know refer to as the Blue Screen of Death™ — causing widespread panic and chaos, albeit briefly. Millions of Windows-based devices that power banks, airports, hospitals, and even broadcast stations went offline and started displaying that dreaded pop-up that usually signifies the unceremonious death of your PC. Imagine not being able to travel, pay, get treatment, or even tune in to your TV to learn what's going on because.. computer problems. 🙄 So, what happened? The way it began was that cybersecurity firm Crowdstrike deployed what should have been a regular, run-of-the mill update for its Falcon software to protect customers' computers against new cyber threats. That update ended up bringing the world to a standstill instead. The exact reason for why the roll out caused problems on Windows was not entirely clear, but experts speculate that a rogue file in the update apparently did not agree with Microsoft's operating system, causing systems to crash. Some speculate that faulty code or lack of quality checks prior to deployment could have been the problem. Whatever the case, all hell broke loose. "This is not a security incident or cyberattack," Crowdstrike Chief Executive George Kurtz tweeted as soon as customers' complaints began piling up. Naturally, questions have arisen around both Crowdstrike and Microsoft, both of whom hold a sizable market of the cybersecurity and OS space, respectively. One twitter user even posted a comparison of how Crowdstrike compared to its competitors (it's the second most valuable cybersecurity firm in the world). Judgment against Crowdstrike has been swift though, with the company's stock price plummeting Friday following the fiasco — wiping billions off of its valuation. Microsoft also saw its stock price fall following the event, dragging the broader stock indices down with it on Friday as the event caused a sell off in tech stocks. Things don't seem to have gotten better, with Dan Ives, a technical analyst on Wall Street, tweeting that IT outage issues still persisted. "This is not good news for George Kurtz & Co. in an already bad situation as it appears a number of businesses are still finding outage issues," Ives wrote. CNN reports that the cost from the global outage could top $1 billion, but there's no telling yet who will exactly foot the bill. There's a very high likelihood that customers will demand compensation from Crowdstrike, dragging it into legal distractions. Worse yet, Crowdstrike's brand reputation is also going to take a massive hit and its competitors may already be trying to eat away at the company's market share. In fact, Ives went on to say that Crowdstrike, which was not a widely known brand prior to this event, had become "a household name, but not in a good way." CrowdStrike CEO Kurtz also has an interesting history in that this isn't the first time he's been at the center of a global tech failure. In 2010, a buggy antivirus update from McAfee caused hundreds of thousands of computers to go kaput! Kurtz was the chief technology officer of McAfee at the time, and it doesn't look like there was a lot of blow back against him at the time. McAfee was reportedly bought by Intel a few months after the event and Kurtz ultimately ended up leaving the company to create CrowdStrike. For now, he's in hot water as US lawmakers have called on Kurtz to testify on the global IT outage caused by his company's update. Meanwhile, Microsoft said the event was a "reminder of how important it is for all of us across the tech ecosystem to prioritize operating with safe deployment and disaster recovery using the mechanisms that exist." The Windows maker estimated that CrowdStrike's update affected 8.5 million devices running its operating system, which was less than 1% of all Windows machines. "While the percentage was small, the broad economic and societal impacts reflect the use of CrowdStrike by enterprises that run many critical services," the company said in a blog post. I suppose that's Microsoft's way of reminding everyone of the 80-20 rule :-) Microsoft ranked #2 on HackerNoon's tech company rankings this week. In Other News.. 📰 Ethereum ETFs Approved by SEC, Bringing Popular Funds to Second-Largest Cryptocurrency — via CoinDesk
Cohere raises $500M to beat back generative AI rivals — via TechCrunch
Hackers are already taking advantage of the CrowdStrike outage chaos — via CNN
Google scraps plan to remove cookies from Chrome — via Reuters
The AI-generated disinformation dystopia that wasn't — via Axios
Autonomous AI workers that talk to each other will arrive in 2025, Capgemini predicts — via CNBC And that's a wrap! Don't forget to share this newsletter with your family and friends! See y'all next week. PEACE! ☮️ — Sheharyar Khan, Editor, Business Tech @ HackerNoon *All rankings are current as of Monday. To see how the rankings have changed, please visit HackerNoon's Tech Company Rankings page.*Tech, What the Heck!? is a once-weekly newsletter written by HackerNoon editors that combine HackerNoon's proprietary data with news-worthy tech stories from around the internet. Humorous and insightful, the newsletter recaps trending events that are shaping the world of tech. Subscribe here.* By now you're probably aware that a certain segment of the population last week experienced what some of us in the know refer to as the Blue Screen of Death™ — causing widespread panic and chaos, albeit briefly. Millions of Windows-based devices that power banks, airports, hospitals, and even broadcast stations went offline and started displaying that dreaded pop-up that usually signifies the unceremonious death of your PC. Millions of Windows-based devices Millions of Windows-based devices Imagine not being able to travel , pay, get treatment, or even tune in to your TV to learn what's going on because.. computer problems. 🙄 travel travel So, what happened? The way it began was that cybersecurity firm Crowdstrike deployed what should have been a regular, run-of-the mill update for its Falcon software to protect customers' computers against new cyber threats. Crowdstrike Crowdstrike That update ended up bringing the world to a standstill instead. The exact reason for why the roll out caused problems on Windows was not entirely clear, but experts speculate that a rogue file in the update apparently did not agree with Microsoft's operating system, causing systems to crash. why rogue file rogue file Some speculate that faulty code or lack of quality checks prior to deployment could have been the problem. Whatever the case, all hell broke loose. speculate speculate "This is not a security incident or cyberattack," Crowdstrike Chief Executive George Kurtz tweeted as soon as customers' complaints began piling up. Naturally, questions have arisen around both Crowdstrike and Microsoft, both of whom hold a sizable market of the cybersecurity and OS space, respectively. One twitter user even posted a comparison of how Crowdstrike compared to its competitors (it's the second most valuable cybersecurity firm in the world). posted posted Judgment against Crowdstrike has been swift though, with the company's stock price plummeting Friday following the fiasco — wiping billions off of its valuation. Microsoft also saw its stock price fall following the event, dragging the broader stock indices down with it on Friday as the event caused a sell off in tech stocks. Things don't seem to have gotten better, with Dan Ives, a technical analyst on Wall Street, tweeting that IT outage issues still persisted. "This is not good news for George Kurtz & Co. in an already bad situation as it appears a number of businesses are still finding outage issues," Ives wrote. tweeting tweeting CNN reports that the cost from the global outage could top $1 billion, but there's no telling yet who will exactly foot the bill. There's a very high likelihood that customers will demand compensation from Crowdstrike, dragging it into legal distractions. Worse yet, Crowdstrike's brand reputation is also going to take a massive hit and its competitors may already be trying to eat away at the company's market share. demand compensation demand compensation In fact, Ives went on to say that Crowdstrike, which was not a widely known brand prior to this event, had become "a household name, but not in a good way." CrowdStrike CEO Kurtz also has an interesting history in that this isn't the first time he's been at the center of a global tech failure. In 2010, a buggy antivirus update from McAfee caused hundreds of thousands of computers to go kaput! isn't the first time isn't the first time Kurtz was the chief technology officer of McAfee at the time, and it doesn't look like there was a lot of blow back against him at the time. McAfee was reportedly bought by Intel a few months after the event and Kurtz ultimately ended up leaving the company to create CrowdStrike. For now, he's in hot water as US lawmakers have called on Kurtz to testify on the global IT outage caused by his company's update. called called Meanwhile, Microsoft said the event was a "reminder of how important it is for all of us across the tech ecosystem to prioritize operating with safe deployment and disaster recovery using the mechanisms that exist." said said The Windows maker estimated that CrowdStrike's update affected 8.5 million devices running its operating system, which was less than 1% of all Windows machines. "While the percentage was small, the broad economic and societal impacts reflect the use of CrowdStrike by enterprises that run many critical services," the company said in a blog post. I suppose that's Microsoft's way of reminding everyone of the 80-20 rule :-) 80-20 rule 80-20 rule Microsoft ranked #2 on HackerNoon's tech company rankings this week. tech company rankings tech company rankings In Other News.. 📰 In Other News.. 📰 Ethereum ETFs Approved by SEC, Bringing Popular Funds to Second-Largest Cryptocurrency — via CoinDesk Cohere raises $500M to beat back generative AI rivals — via TechCrunch Hackers are already taking advantage of the CrowdStrike outage chaos — via CNN Google scraps plan to remove cookies from Chrome — via Reuters The AI-generated disinformation dystopia that wasn't — via Axios Autonomous AI workers that talk to each other will arrive in 2025, Capgemini predicts — via CNBC Ethereum ETFs Approved by SEC, Bringing Popular Funds to Second-Largest Cryptocurrency — via CoinDesk CoinDesk CoinDesk Cohere raises $500M to beat back generative AI rivals — via TechCrunch TechCrunch TechCrunch Hackers are already taking advantage of the CrowdStrike outage chaos — via CNN CNN CNN Google scraps plan to remove cookies from Chrome — via Reuters Reuters Reuters The AI-generated disinformation dystopia that wasn't — via Axios Axios Axios Autonomous AI workers that talk to each other will arrive in 2025, Capgemini predicts — via CNBC CNBC CNBC And that's a wrap! Don't forget to share this newsletter with your family and friends! See y'all next week. PEACE! ☮️ — Sheharyar Khan , Editor, Business Tech @ HackerNoon Sheharyar Khan Sheharyar Khan *All rankings are current as of Monday. To see how the rankings have changed, please visit HackerNoon's Tech Company Rankings page.*Tech, What the Heck!? is a once-weekly newsletter written by HackerNoon editors that combine HackerNoon's proprietary data with news-worthy tech stories from around the internet. Humorous and insightful, the newsletter recaps trending events that are shaping the world of tech. Subscribe here. * *All rankings are current as of Monday. To see how the rankings have changed, please visit HackerNoon's Tech Company Rankings page. *Tech, What the Heck!? is a once-weekly newsletter written by HackerNoon editors that combine HackerNoon's proprietary data with news-worthy tech stories from around the internet. Humorous and insightful, the newsletter recaps trending events that are shaping the world of tech. Subscribe here . *All rankings are current as of Monday. To see how the rankings have changed, please visit HackerNoon's Tech Company Rankings page. Tech Company Rankings Tech Company Rankings here here

How Could an Update Go So Wrong?

In the wake of the global IT outage, today’s events have suddenly brought into sharp focus the latent vulnerabilities within our interdependent digital infrastructure. Chaos has gripped airlines, healthcare, and financial institutions—critical services. Right at the centre of this crisis lies a flawed software update by security firm CrowdStrike that aimed to protect Microsoft Windows devices. These consequences thus serve as a shocking reminder of the risks involved with the forcing updates strategy Microsoft uses and its high dependency on a few key players within the technology world. The Extent of the Chaos The CrowdStrike update disruption was highly significant. Carriers like United, Delta, and American Airlines grounded flights worldwide, causing long queues and delays at airports. At Sydney, Tokyo-Narita, and Delhi airports, it was reported that the departure screens had gone blank at some of these locations, while in Europe, there was a huge delay noted at London's Stansted and Gatwick and Amsterdam's Schiphol. Ryanair issued a warning regarding possible disruptions resulting from a third-party outage. It also had an impact on the health sector: In the UK, GPs were having issues making appointments with patients. Financial and retail sectors were equally hit—supermarkets like Morrisons and Waitrose didn't handle contactless payments, forcing many to go back to cash-only transactions. The same happened in Australia's National Australia Bank and retail chains like Woolworths. The Root Cause: Forced Updates The outage had been triggered by a "defect" in a content CrowdStrike had provided for a Microsoft Windows update. As stated by CrowdStrike's CEO, George Kurtz, this was not a security incident or cyber-attack but rather a flawed update. By the time it was identified that there was indeed a problem and that Crowdstrike had isolated the issue, the damage was done. The fix needed to be applied individually at each affected device by manually entering safe mode—a huge logistical challenge for IT departments everywhere. This incident highlights the dangers of forced updates Microsoft applies that have been inherent in it. As much as updates are meant to enhance security and functionality, automatically pushing them without proper testing may lead to catastrophe. Forced updates take away the power from users and IT administrators regarding when and under what conditions changes in software occur, hence raising the possibility of issues on a bigger scale. The Vulnerability of Centralized Systems CrowdStrike's involvement in this outage is revealing of something deeper: the fragility of centralized systems. CrowdStrike is a relatively young company that forms one of the hinges on which cybersecurity for many large organizations turns. That type of fast growth and wide adoption is both a tribute to its capabilities and a possible single point of failure. The recent outage shows how an issue in one part of the huge network can turn into a global crisis. Microsoft's role in the situation is equally critical. As a monopoly in operating system markets, any malfunctioning of their products creates sweeping effects. The dependency of innumerable organizations on Microsoft Windows makes even the tiniest disruption in its ecosystem potentially capable of paralyzing operational activities in numerous sectors. The Need for Better Practices As such, the incident gives many lessons regarding best practices in software updating and cybersecurity. More efficient procedures are needed for testing updates before their dissemination, which especially involves CrowdStrike and Microsoft. It could use staggered deployments where the update would first be given to some small set of users and then deployed in totality. This allows any problems originally detected to be resolved within a controlled environment. Microsoft needs to revise its forced update policy, which all too often disrupts users and businesses by forcing potentially flawed updates with little notice or control. Microsoft should instead enable rollbacks to a previous release and phased rollouts that allow updates to be tested on a smaller subset of users before a wider release. This would, in turn, open up the opportunity to identify problems earlier than usual and fix them prior to their causing wide disruptions—to improve overall stability and reliability in software. It would be a nice enhancement to user experience and improved faith in the Microsoft ecosystem if this empowered users and IT administrators to feel better toward updates. The flawed CrowdStrike update and the subsequent universal IT outage remind us how fragile our digital infrastructure really is. It underlines the risks that come with forced updates and the vulnerabilities in centralized systems. As we grow ever more dependent on digital technologies, ensuring that solid, reliable, and transparent cybersecurity practices have never been more opposing. The CrowdStrike and Microsoft companies will indeed have to learn from the saga and put in place proactive measures to prevent such events in the future. In the wake of the global IT outage, today’s events have suddenly brought into sharp focus the latent vulnerabilities within our interdependent digital infrastructure. Chaos has gripped airlines, healthcare, and financial institutions—critical services. Right at the centre of this crisis lies a flawed software update by security firm CrowdStrike that aimed to protect Microsoft Windows devices. These consequences thus serve as a shocking reminder of the risks involved with the forcing updates strategy Microsoft uses and its high dependency on a few key players within the technology world. security The Extent of the Chaos The CrowdStrike update disruption was highly significant. Carriers like United, Delta, and American Airlines grounded flights worldwide, causing long queues and delays at airports. At Sydney, Tokyo-Narita, and Delhi airports, it was reported that the departure screens had gone blank at some of these locations, while in Europe, there was a huge delay noted at London's Stansted and Gatwick and Amsterdam's Schiphol. Ryanair issued a warning regarding possible disruptions resulting from a third-party outage. It also had an impact on the health sector: In the UK, GPs were having issues making appointments with patients. Financial and retail sectors were equally hit—supermarkets like Morrisons and Waitrose didn't handle contactless payments, forcing many to go back to cash-only transactions. The same happened in Australia's National Australia Bank and retail chains like Woolworths. The Root Cause: Forced Updates The outage had been triggered by a "defect" in a content CrowdStrike had provided for a Microsoft Windows update. As stated by CrowdStrike's CEO, George Kurtz, this was not a security incident or cyber-attack but rather a flawed update. By the time it was identified that there was indeed a problem and that Crowdstrike had isolated the issue, the damage was done. The fix needed to be applied individually at each affected device by manually entering safe mode—a huge logistical challenge for IT departments everywhere. This incident highlights the dangers of forced updates Microsoft applies that have been inherent in it. As much as updates are meant to enhance security and functionality, automatically pushing them without proper testing may lead to catastrophe. Forced updates take away the power from users and IT administrators regarding when and under what conditions changes in software occur, hence raising the possibility of issues on a bigger scale. The Vulnerability of Centralized Systems CrowdStrike's involvement in this outage is revealing of something deeper: the fragility of centralized systems. CrowdStrike is a relatively young company that forms one of the hinges on which cybersecurity for many large organizations turns. That type of fast growth and wide adoption is both a tribute to its capabilities and a possible single point of failure. The recent outage shows how an issue in one part of the huge network can turn into a global crisis. Microsoft's role in the situation is equally critical. As a monopoly in operating system markets, any malfunctioning of their products creates sweeping effects. The dependency of innumerable organizations on Microsoft Windows makes even the tiniest disruption in its ecosystem potentially capable of paralyzing operational activities in numerous sectors. The Need for Better Practices As such, the incident gives many lessons regarding best practices in software updating and cybersecurity. More efficient procedures are needed for testing updates before their dissemination, which especially involves CrowdStrike and Microsoft. It could use staggered deployments where the update would first be given to some small set of users and then deployed in totality. This allows any problems originally detected to be resolved within a controlled environment. Microsoft needs to revise its forced update policy, which all too often disrupts users and businesses by forcing potentially flawed updates with little notice or control. Microsoft should instead enable rollbacks to a previous release and phased rollouts that allow updates to be tested on a smaller subset of users before a wider release. This would, in turn, open up the opportunity to identify problems earlier than usual and fix them prior to their causing wide disruptions—to improve overall stability and reliability in software. It would be a nice enhancement to user experience and improved faith in the Microsoft ecosystem if this empowered users and IT administrators to feel better toward updates. The flawed CrowdStrike update and the subsequent universal IT outage remind us how fragile our digital infrastructure really is. It underlines the risks that come with forced updates and the vulnerabilities in centralized systems. As we grow ever more dependent on digital technologies, ensuring that solid, reliable, and transparent cybersecurity practices have never been more opposing. The CrowdStrike and Microsoft companies will indeed have to learn from the saga and put in place proactive measures to prevent such events in the future.

Microsoft's Forced Updates: A Critique of the Global IT Outage

মাইক্রোসফটের জোরপূর্বক আপডেট: গ্লোবাল আইটি বিভ্রাটের একটি সমালোচনা

Microsofts erzwungene Updates: Eine Kritik am weltweiten IT-Ausfall

Actualizaciones forzadas de Microsoft: una crítica a la interrupción global de TI

Mises à jour forcées de Microsoft : une critique de la panne informatique mondiale

माइक्रोसॉफ्ट के जबरन अपडेट: वैश्विक आईटी आउटेज की आलोचना

マイクロソフトの強制アップデート：世界的な IT 障害に対する批判

Microsoft의 강제 업데이트: 글로벌 IT 중단에 대한 비판

Atualizações forçadas da Microsoft: uma crítica à interrupção global da TI

Принудительные обновления Microsoft: критика глобального сбоя в сфере ИТ

Microsoft'un Zorunlu Güncellemeleri: Küresel BT Kesintisinin Bir Eleştirisi

Cập nhật bắt buộc của Microsoft: Lời phê bình về tình trạng ngừng hoạt động CNTT toàn cầu

微软强制更新：对全球 IT 中断的批评

With a flawed CrowdStrike update causing the recent global IT outage in Microsoft Windows devices, organizations worldwide are working hard to get things back to normal. In such an environment of uncertainty, cybercriminals are making the most of the situation by attempting to exploit this chaos. We expect the hackers to be all involved in the confusion and vulnerabilities the outage has revealed. It is essential to understand these threats and have strong countermeasures and knowledge to protect our organizations during this challenging moment. What are social engineering attacks? Basically, social engineering is an activity that exploits human mistakes to extract private information, gain access, or obtain valuables. In psy­chological manipulation, cybercriminals trick targets into revealing confidential information or performing some activities that might compromise security. This includes attacks like Pretexting, Baiting, and Tailgating, all tailored to exploit trust put in people and, particularly, the desire to help somebody in trouble. What is Pretexting? One of the most common social engineering techniques is pretexting, in which some scenario or context is fabricated by the attackers to elicit information that will enable them to steal. For instance, the hacker may call and pretend to be IT support immediately after an outage occurs, stating that access to secure systems is required to resolve ongoing issues. Such a situation exploits the sense of urgency and confusion that gives those featured a higher likelihood of compliance. What is Baiting? Baiting refers to the process whereby victims are lured through something that appears very attractive. A good example can be telling them to download a critical patch in a given software. The attackers may have to take advantage of this and send messages with the pretext of critical updates to fix the problems caused by the CrowdStrike outage. This might result in unwary users downloading such malicious files and making their systems vulnerable. What is Tailgating? Tailgating is another social engineering form that exploits physical security. Many organizations are thrown out of gear, and hackers could get physical access to restricted areas simply by tailgating on the heels of the Voltaren personnel through secure doors in the chaos of the outage. This intrusion is cloaked under perfect cover as employees and security people are less vigilant. If these threats sound too far a possibility for your company, then I would like to remind you of the Sony Pictures hack in 2014. The sophisticated combination of phishing and social engineering utilities used to break into the system led to highly sensitive data leakage and caused a number of serious financial and reputational damages to the company at large. The hackers were imitating real contacts, fooling people into giving out passwords and other forms of vital information. This went to underline just how devastating the potential that social engineering attacks hold. An easy way of preventing such things is to instruct employees to verify any unusual or urgent requests by calling the presumed sender back through official channels and not in reply to the received email or by following the links provided in it. To preserve system integrity, we need to focus on keeping all software and systems updated with the latest security updates while also making sure that the updates are received from a legitimate source. It’s also very important that everybody, especially those with less technical experience, realize that it has become very important to ask for help without shame or fear. Cybercriminals cash in on moments of confusion and uncertainty; hence, the need to consult the IT department or knowledgeable colleagues whenever unfamiliar or suspicious activities occur is more important than ever. Asking for help is a step towards keeping personal and organizational security at par. By creating a culture where questions are encouraged and resources are available, we move further in building defenses against social engineering attacks or cyber threats. The recent global IT outage caused by a flawed CrowdStrike update is a harsh reminder of the vulnerabilities in our digital infrastructure. While threats of social engineering attacks are looming over us, this recovery effort has put our organizations at risk. We should all be aware of such threats and have robust countermeasures in place, and we should all work in environments where help is pursued easily so that together, we can strengthen our defences. These proactive steps taken now will not only prevent huge damage but also put our systems and data in a position so that they cannot be exploited in the future when a similar scenario strikes us again. With a flawed CrowdStrike update causing the recent global IT outage in Microsoft Windows devices, organizations worldwide are working hard to get things back to normal. In such an environment of uncertainty, cybercriminals are making the most of the situation by attempting to exploit this chaos. We expect the hackers to be all involved in the confusion and vulnerabilities the outage has revealed. It is essential to understand these threats and have strong countermeasures and knowledge to protect our organizations during this challenging moment. What are social engineering attacks? What are social engineering attacks? Basically, social engineering is an activity that exploits human mistakes to extract private information, gain access, or obtain valuables. In psy­chological manipulation, cybercriminals trick targets into revealing confidential information or performing some activities that might compromise security. This includes attacks like Pretexting, Baiting, and Tailgating, all tailored to exploit trust put in people and, particularly, the desire to help somebody in trouble. What is Pretexting? What is Pretexting? One of the most common social engineering techniques is pretexting, in which some scenario or context is fabricated by the attackers to elicit information that will enable them to steal. For instance, the hacker may call and pretend to be IT support immediately after an outage occurs, stating that access to secure systems is required to resolve ongoing issues. Such a situation exploits the sense of urgency and confusion that gives those featured a higher likelihood of compliance. What is Baiting? What is Baiting? Baiting refers to the process whereby victims are lured through something that appears very attractive. A good example can be telling them to download a critical patch in a given software. The attackers may have to take advantage of this and send messages with the pretext of critical updates to fix the problems caused by the CrowdStrike outage. This might result in unwary users downloading such malicious files and making their systems vulnerable. What is Tailgating? What is Tailgating? Tailgating is another social engineering form that exploits physical security. Many organizations are thrown out of gear, and hackers could get physical access to restricted areas simply by tailgating on the heels of the Voltaren personnel through secure doors in the chaos of the outage. This intrusion is cloaked under perfect cover as employees and security people are less vigilant. If these threats sound too far a possibility for your company, then I would like to remind you of the Sony Pictures hack in 2014. The sophisticated combination of phishing and social engineering utilities used to break into the system led to highly sensitive data leakage and caused a number of serious financial and reputational damages to the company at large. The hackers were imitating real contacts, fooling people into giving out passwords and other forms of vital information. This went to underline just how devastating the potential that social engineering attacks hold. An easy way of preventing such things is to instruct employees to verify any unusual or urgent requests by calling the presumed sender back through official channels and not in reply to the received email or by following the links provided in it. To preserve system integrity, we need to focus on keeping all software and systems updated with the latest security updates while also making sure that the updates are received from a legitimate source. It’s also very important that everybody, especially those with less technical experience, realize that it has become very important to ask for help without shame or fear. Cybercriminals cash in on moments of confusion and uncertainty; hence, the need to consult the IT department or knowledgeable colleagues whenever unfamiliar or suspicious activities occur is more important than ever. Asking for help is a step towards keeping personal and organizational security at par. By creating a culture where questions are encouraged and resources are available, we move further in building defenses against social engineering attacks or cyber threats. The recent global IT outage caused by a flawed CrowdStrike update is a harsh reminder of the vulnerabilities in our digital infrastructure. While threats of social engineering attacks are looming over us, this recovery effort has put our organizations at risk. We should all be aware of such threats and have robust countermeasures in place, and we should all work in environments where help is pursued easily so that together, we can strengthen our defences. These proactive steps taken now will not only prevent huge damage but also put our systems and data in a position so that they cannot be exploited in the future when a similar scenario strikes us again.

Stay Safe: Critical Information Your Employees Should Know Following the Crowdstrike IT Chaos

How to Avoid the Null Trap in Privilege Mode Drivers TL;DR: Using null pointers in critical code can crash your system Problems Memory access violation
Unpredictable behavior
Null Pointer Dereference
Unexpected program termination
System instability
No healing/recovery strategy
Security Risk Solutions Avoid using NULLs
Use address sanitizers
Make controlled releases to mission-critical software
Create better rollback strategies instead of BSOD
Use Smart Pointers: Manage memory automatically and avoid null pointers with smart pointers
Create self-healing software.
Apply defensive programming
Improve your QA tests before deploying to production. Context When you use nulls in a privileged driver, you risk causing serious issues. Privilege mode drivers run with high permissions, and if you use a null pointer, the system might try to access an invalid memory address. For example, trying to read from address 0x9c (156) or using 0x0 as a special value can lead to critical errors. You can't just abort the program in privileged mode, so you must handle these cases carefully. In privileged drivers, null pointer usage poses significant risks. You can mitigate these risks using modern C++ features like std::optional. This problem caused one of the worst software blackouts in 2024. Sample Code Wrong // This case is not exactly what happened with Crowdstrike
// It is here for illustration purposes
void* get_data() {
 if (data_available) {
 return data_ptr; // This could be null!
 } else {
 // Uh oh, what if data_ptr is null here?
 return NULL; 
 // Using Null to indicate no data
 // knowing Null is schizophrenic
 }
}

int process_data(void* data) {
 if (data != NULL) { 
 // Maybe a null check, but not guaranteed!
 // Accessing data... (crash if data is Null)
 return *data;
 }
 // No check? Silent failure or unexpected behavior.
 return -1;
} Right // You should ideally replace the null with a polymorphic call
// You can see the technique in related articles

std::unique_ptr<int> get_data() { 
 if (data_available) {
 return std::make_unique<int>(data_value);
 } else {
 return nullptr; // Explicitly return nullptr
 }
}

int process_data(const std::unique_ptr<int>& data) {
 if (data) { // Check for valid pointer
 return *data;
 } else {
 // Handle no data case (e.g., return default value)
 return 0;
 }
} Important Notes About this Code Smell Detection [x]Semi-Automatic You can detect this smell by checking for null pointer usage in critical parts of your code. Look for functions that process pointers and see if they handle null pointers safely. Human code reviews are good for checking this kind of problem. Tags Null Level [x]Advanced /AI Generation AI generators can sometimes produce this smell, especially if they generate code without context about the environment where the code will run. AI generators are fed with code with NULL usage even though his creator told us to avoid it altogether. AI Detection AI tools can detect this smell with specific instructions. AI can be trained to identify code patterns. Teaching it the nuances of privileged driver development and null safety best practices might require more advanced techniques. Use static analysis tools to flag null pointer dereferences. Conclusion Voyager 1's software has been running for more than 50 years. It was designed to be robust, reliable, and redundant which is sadly uncommon in some immature systems in 2024. Avoid using null pointers in privileged mode drivers. I have written a book on clean code and a whole chapter #15 on how to avoid NULL and all the consequences it carries. Hopefully, Crowdstrike engineers will read it! Related Code Smells Code Smell 12 - Null Code Smell 126 - Fake Null Object Code Smell 208 - Null Island Further Reading https://hackernoon.com/null-the-billion-dollar-mistake-8t5z32d6?embedable=true https://github.com/google/sanitizers/wiki/AddressSanitizer?embedable=true https://x.com/perpetualmaniac/status/1814376668095754753?embedable=true Disclaimer: Code Smells are my opinion. I couldn't resist the temptation to put in a null reference, simply because it was so easy to implement. This has led to innumerable errors, vulnerabilities, and system crashes, which have probably caused a billion dollars of pain and damage in the last forty years. Tony Hoare https://hackernoon.com/400-thought-provoking-software-engineering-quotes?embedable=true This article is part of the CodeSmell Series on HackerNoon. https://hackernoon.com/how-to-find-the-stinky-parts-of-your-code-part-i-xqz3evd?embedable=true How to Avoid the Null Trap in Privilege Mode Drivers TL;DR: Using null pointers in critical code can crash your system TL;DR: Using null pointers in critical code can crash your system Problems Memory access violation Unpredictable behavior Null Pointer Dereference Unexpected program termination System instability No healing/recovery strategy Security Risk Memory access violation Unpredictable behavior Null Pointer Dereference Unexpected program termination System instability No healing/recovery strategy Security Risk Solutions Avoid using NULLs Use address sanitizers Make controlled releases to mission-critical software Create better rollback strategies instead of BSOD Use Smart Pointers: Manage memory automatically and avoid null pointers with smart pointers Create self-healing software. Apply defensive programming Improve your QA tests before deploying to production. Avoid using NULLs NULLs Use address sanitizers address sanitizers Make controlled releases to mission-critical software Create better rollback strategies instead of BSOD BSOD Use Smart Pointers: Manage memory automatically and avoid null pointers with smart pointers Create self-healing software. Apply defensive programming Improve your QA tests before deploying to production. Context When you use nulls in a privileged driver, you risk causing serious issues. Privilege mode drivers run with high permissions, and if you use a null pointer, the system might try to access an invalid memory address. For example, trying to read from address 0x9c (156) or using 0x0 as a special value can lead to critical errors. You can't just abort the program in privileged mode, so you must handle these cases carefully. In privileged drivers, null pointer usage poses significant risks. You can mitigate these risks using modern C++ features like std::optional . std::optional This problem caused one of the worst software blackouts in 2024. This problem Sample Code Wrong // This case is not exactly what happened with Crowdstrike
// It is here for illustration purposes
void* get_data() {
 if (data_available) {
 return data_ptr; // This could be null!
 } else {
 // Uh oh, what if data_ptr is null here?
 return NULL; 
 // Using Null to indicate no data
 // knowing Null is schizophrenic
 }
}

int process_data(void* data) {
 if (data != NULL) { 
 // Maybe a null check, but not guaranteed!
 // Accessing data... (crash if data is Null)
 return *data;
 }
 // No check? Silent failure or unexpected behavior.
 return -1;
} // This case is not exactly what happened with Crowdstrike
// It is here for illustration purposes
void* get_data() {
 if (data_available) {
 return data_ptr; // This could be null!
 } else {
 // Uh oh, what if data_ptr is null here?
 return NULL; 
 // Using Null to indicate no data
 // knowing Null is schizophrenic
 }
}

int process_data(void* data) {
 if (data != NULL) { 
 // Maybe a null check, but not guaranteed!
 // Accessing data... (crash if data is Null)
 return *data;
 }
 // No check? Silent failure or unexpected behavior.
 return -1;
} Right // You should ideally replace the null with a polymorphic call
// You can see the technique in related articles

std::unique_ptr<int> get_data() { 
 if (data_available) {
 return std::make_unique<int>(data_value);
 } else {
 return nullptr; // Explicitly return nullptr
 }
}

int process_data(const std::unique_ptr<int>& data) {
 if (data) { // Check for valid pointer
 return *data;
 } else {
 // Handle no data case (e.g., return default value)
 return 0;
 }
} // You should ideally replace the null with a polymorphic call
// You can see the technique in related articles

std::unique_ptr<int> get_data() { 
 if (data_available) {
 return std::make_unique<int>(data_value);
 } else {
 return nullptr; // Explicitly return nullptr
 }
}

int process_data(const std::unique_ptr<int>& data) {
 if (data) { // Check for valid pointer
 return *data;
 } else {
 // Handle no data case (e.g., return default value)
 return 0;
 }
} Important Notes About this Code Smell Detection [x]Semi-Automatic [x] Semi-Automatic [x] You can detect this smell by checking for null pointer usage in critical parts of your code. Look for functions that process pointers and see if they handle null pointers safely. Human code reviews are good for checking this kind of problem. Tags Null Null Level [x]Advanced [x] Advanced [x] /AI Generation AI generators can sometimes produce this smell, especially if they generate code without context about the environment where the code will run. AI generators are fed with code with NULL usage even though his creator told us to avoid it altogether. his creator told us AI Detection AI tools can detect this smell with specific instructions. AI can be trained to identify code patterns. Teaching it the nuances of privileged driver development and null safety best practices might require more advanced techniques. Use static analysis tools to flag null pointer dereferences. Conclusion Voyager 1's software has been running for more than 50 years. It was designed to be robust, reliable, and redundant which is sadly uncommon in some immature systems in 2024. Avoid using null pointers in privileged mode drivers. I have written a book on clean code and a whole chapter #15 on how to avoid NULL and all the consequences it carries. clean code #15 Hopefully, Crowdstrike engineers will read it! Related Code Smells Code Smell 12 - Null Code Smell 12 - Null Code Smell 126 - Fake Null Object Code Smell 126 - Fake Null Object Code Smell 208 - Null Island Code Smell 208 - Null Island Further Reading https://hackernoon.com/null-the-billion-dollar-mistake-8t5z32d6?embedable=true https://hackernoon.com/null-the-billion-dollar-mistake-8t5z32d6?embedable=true https://github.com/google/sanitizers/wiki/AddressSanitizer?embedable=true https://github.com/google/sanitizers/wiki/AddressSanitizer?embedable=true https://x.com/perpetualmaniac/status/1814376668095754753?embedable=true https://x.com/perpetualmaniac/status/1814376668095754753?embedable=true Disclaimer: Code Smells are my opinion. Disclaimer: Code Smells are my opinion. Disclaimer: Code Smells are my opinion . opinion I couldn't resist the temptation to put in a null reference, simply because it was so easy to implement. This has led to innumerable errors, vulnerabilities, and system crashes, which have probably caused a billion dollars of pain and damage in the last forty years. I couldn't resist the temptation to put in a null reference, simply because it was so easy to implement. This has led to innumerable errors, vulnerabilities, and system crashes, which have probably caused a billion dollars of pain and damage in the last forty years. Tony Hoare Tony Hoare https://hackernoon.com/400-thought-provoking-software-engineering-quotes?embedable=true https://hackernoon.com/400-thought-provoking-software-engineering-quotes?embedable=true This article is part of the CodeSmell Series on HackerNoon. This article is part of the CodeSmell Series on HackerNoon. https://hackernoon.com/how-to-find-the-stinky-parts-of-your-code-part-i-xqz3evd?embedable=true https://hackernoon.com/how-to-find-the-stinky-parts-of-your-code-part-i-xqz3evd?embedable=true

Code Smell 260 - Crowdstrike NULL

**SILVER SPRING, Maryland, January 30th, 2024/Cyberwire/--**Aembit Becomes the First Workload IAM Platform to Integrate with the Industry-Leading CrowdStrike Falcon Platform to Drive Workload Conditional Access. , the Workload Identity and Access Management (IAM) platform that enables DevOps and security teams to discover, manage, enforce and audit access between workloads, today announced the availability of a new integration with the industry-leading CrowdStrike Falcon platform to give enterprises the ability to dynamically manage and enforce based on the real-time security posture of their applications and services. Aembit conditional access policies This integration signifies a significant leap in Aembit's mission to empower organizations to apply Zero Trust principles to make workload-to-workload access more secure and manageable. Workload IAM transforms enterprise security by securing workload-to-workload access through policy-driven, identity-based, and secretless access controls, moving away from the legacy unmanaged, secrets-based approach. Through this partnership, the Aembit Workload IAM solution checks to see if a CrowdStrike Falcon agent is running on the workload and evaluates its real-time security posture to drive workload access decisions to applications and data. With this approach, now enterprises can protect their workloads from unauthorized access, even against the backdrop of changing conditions and dynamic access requirements. Additional customer benefits from this partnership include: Managed Workload-to-Workload Access: Enforce and manage workload access to other applications, SaaS services, and third-party APIs based on identity and policy set by the security team, driving down risk. Seamless Deployment: Drive consolidation by effortlessly integrating the Aembit Workload IAM Platform with the Falcon platform in a few clicks, providing a unified experience for managing workload identities while understanding workload security posture. Zero Trust Security Model: Embrace a Zero Trust approach, ensuring that every access request, regardless of the source, is verified before granting access rights. Aembit's solution enforces the principle of least privilege based on identity, policy, and workload security posture, minimizing potential security vulnerabilities. Visibility and Monitoring: Gain extensive visibility into workload identities and access permissions, enabling swift detection and response to potential security threats. Monitor and audit access logs based on identity for comprehensive security oversight. This industry-first collaboration builds on the recent , underscoring the global cybersecurity leader’s commitment to fostering innovation within the space. The investment reflects the recognition of the growing demands for securing workload access. CrowdStrike Falcon Fund strategic investment in Aembit Aembit Workload IAM is available in the CrowdStrike Marketplace, a one-stop destination and world-class ecosystem of third party products. See more . here Supporting Quotes: “Today’s attacks are increasingly identity-based, which is why enforcing identity-protection across the enterprise at every layer is critical for modern security. The CrowdStrike Falcon platform is rapidly becoming the center of cybersecurity’s ecosystem. This integration with Aembit enables organizations to secure machine identities as part of a holistic approach to security.” said Daniel Bernard, chief business officer at CrowdStrike. "The launch of the Aembit Workload IAM Platform on the CrowdStrike Marketplace represents a significant advancement in our joint mission to securely manage workload-to-workload access," said David Goldschlag, CEO and co-founder at Aembit. "We are excited to bring the power of Aembit's Workload IAM to the CrowdStrike Marketplace. This collaboration enables us to deliver Zero Trust for workload access in a way that simplifies and automates the evolving security challenges faced by DevOps and DevSecOps teams," said Apurva Dave, CMO at Aembit. Press Contact Apurva Dave Chief Marketing Officer press@aembit.io About Aembit Aembit is the Workload Identity and Access Management (IAM) Platform that lets every business safely build its next generation of applications by inherently trusting how it connects to partners, customers, and cloud services. Aembit provides seamless and secure access from your workloads to the services they depend on, like APIs, databases, and cloud resources, while simplifying application development, delivery, compliance, and audit. . Follow Aembit on LinkedIn Learn: or Website CrowdStrike Marketplace Follow: | LinkedIn Twitter Use: Free-Forever Tier Contact Chief Marketing Officer Apurva Dave Aembit apurva@aembit.io (202) 525-6661 This story was distributed as a release by Cyberwire under HackerNoon’s Business Blogging Program. Learn more about the program here.

Aembit Launches IAM Integration With CrowdStrike, Enterprises To Gain Workload-to-Workload Access

In the realm of cybersecurity, the concept of Kerberos stands as a bastion of network authentication protocols. Developed by MIT, Kerberos is designed to provide strong authentication for client-server applications by using secret-key cryptography. At its core, Kerberos is a ticket-based authentication system. When a user logs in, the Kerberos server validates their credentials and issues a ticket-granting ticket (TGT). This TGT, then, becomes the user's key to accessing various services within the network without repeatedly entering credentials. Where is Kerberos Used? Kerberos is not just a theoretical construct; it's deeply embedded in various popular systems and software. For instance, it's a central feature in Microsoft Windows Active Directory environments, providing the backbone for secure user authentication. Besides Windows, it's also implemented in various Unix and Linux distributions, and even Apple's macOS integrates it. This widespread usage makes Kerberos a critical element in the security infrastructure of countless organizations worldwide. Kerberoasting: A Sneak Peek Venturing into the more sinister aspects of cybersecurity, we come across the concept of 'Kerberoasting.' This technique represents a form of assault on networks secured by Kerberos. Essentially, Kerberoasting leverages the inherent features of Kerberos, enabling attackers to pilfer service tickets. These stolen tickets are then decrypted in an offline environment, exposing the passwords of service accounts. The gravity of these attacks lies in their usual targets: service accounts with high-level access rights, paving the way for deeper network infiltration. A notable characteristic of Kerberoasting is its ability to be executed offline. This aspect provides attackers with a virtually endless window for attempt after attempt at cracking the Kerberos code, all while remaining under the radar of detection mechanisms. The Rise of Kerberoasting: Insights from CrowdStrike's 2023 Report Key Findings 2023 Incident Response report sheds light on a disturbing trend: a increase in Kerberoasting attacks year over year. This surge is not just a number; it's a glaring red flag for organizations relying on Kerberos for their security needs. CrowdStrike's 583% Why the Increase? Several factors contribute to this uptick. First, the broad adoption of Kerberos in enterprise environments makes it a lucrative target for attackers. While enterprise security teams recognize the identity the new battleground of the cyberwar, they are still reliant upon older protocols like Kerberos. Secondly, the complexity of Kerberos implementations can lead to misconfigurations, creating vulnerabilities that savvy attackers are quick to exploit. Additionally, the tools and techniques for carrying out Kerberoasting attacks have become more accessible and sophisticated, lowering the barrier for entry into the world of cybercrime. is The Implications The increase in Kerberoasting attacks underlines a critical need for organizations to reassess their security posture. It's not just about having Kerberos in place; it's about ensuring it's configured and monitored correctly. This includes regular audits, applying principle of least privilege to service accounts, and keeping an eye out for unusual activity that could indicate a Kerberoasting attempt. What can you do to reduce the risk? The goal is not to completely eliminate Kerberos based vulnerabilities (admirable, but not feasible), but instead to make your enterprise so to attack that adversaries choose to move on to simpler/cheaper targets of opportunity. This approach won’t prevent nation state adversaries from achieving their goals, very little will. However we know that nation state-level attacks are quite rare and instead the vast majority of adversaries are driven by profit, as they are a part of the giant online-world of cybercrime. Making your enterprise too expensive to profit off from is a sound approach for defense. expensive Below are some proven effective methods to raise the cost of Kerberos based attacks. : Implementing robust, complex passwords for service accounts is a fundamental defense against Kerberoasting. Since these attacks involve cracking passwords offline, the use of long, complex passwords makes the cracking process significantly more challenging and time-consuming for attackers. This complexity should ideally exceed typical user password requirements, given the sensitivity of service accounts. Strong, Complex Passwords for Service Accounts : Consistent monitoring and auditing of service accounts can help detect unusual activities, such as unexpected ticket requests, which might indicate a Kerberoasting attempt. Keeping track of which service accounts are active and routinely checking their authentication logs can highlight anomalies, enabling timely responses to potential breaches. Regular Monitoring and Auditing of Service Accounts : Employing advanced threat detection tools that specifically look for signs of Kerberoasting can be a proactive measure. These tools analyze patterns in Kerberos ticket requests and usage, flagging suspicious activities such as high rates of ticket requests or access patterns that deviate from the norm. Use of Advanced Threat Detection Tools : Restricting service accounts to the minimum level of access rights necessary for their function can limit the damage if these accounts are compromised. By ensuring that these accounts do not have more privileges than necessary, you reduce the potential impact of a successful Kerberoasting attack. Implementing Least Privilege Principle : Regularly changing the passwords of service accounts can thwart ongoing or future Kerberoasting attempts. Additionally, using Managed Service Accounts (MSAs) or Group Managed Service Accounts (gMSAs) in Windows environments, which automatically handle password management, can significantly reduce the risk of Kerberoasting attacks. These accounts provide automated password management, making them less susceptible to such attacks. Regular Password Rotation and Use of Managed Service Accounts The data from CrowdStrike's 2023 report is a clarion call to action. Kerberoasting is not a new threat, but its escalating prevalence highlights the evolving landscape of cybersecurity threats. Vigilance, continuous learning, and proactive security measures are essential in keeping organizations one step ahead of these evolving threats. Let's not just be reactive; let's be ready.

Stories, News & Mentions about CROWDSTRIKE

Crowdstrike’s Stories on HackerNoon

Crowdstrike's News & Mentions