Microsoft says a faulty update from CrowdStrike caused 8.5 million Windows devices to crash.

A faulty update from CrowdStrike caused a global tech disaster on Friday, affecting 8.5 million Windows devices. According to MicrosoftMicrosoft says this represents “less than one percent of all Windows machines,” but it was enough to cause problems for retailers, banks, airlines and many other industries, as well as everyone who depends on them.

CrowdStrike’s analysis explains the configuration file that was the root cause of the issue:

The configuration files mentioned above areChannel Files” And these are part of the behavioral security mechanisms used by Falcon sensors. Updates to channel files are a normal part of the sensor’s operation and occur several times a day in response to new tactics, techniques, and procedures discovered by CrowdStrike. This is not a new process; the architecture has existed since the very beginning of Falcon.

CrowdStrike explained that this file is not a kernel driver, but is responsible for “how Falcon evaluates named pipe1 execution on Windows systems.” Patrick Wardle, security researcher and founder of Objective-C The explanation says that This is consistent with earlier analysis by him and others regarding the cause of the crash, as the problem file “C-00000291-” triggered a logic error resulting in an OS crash “(via CSAgent.sys).”

Other excerpts from CrowdStrike’s blog explain more about what went wrong:

On July 19, 2024, at 04:09 UTC, as part of an ongoing operation, CrowdStrike released a sensor configuration update for Windows systems. Sensor configuration updates are an ongoing part of the Falcon platform’s security mechanisms. This configuration update triggered a logic error that resulted in a system crash and blue screen (BSOD) on affected systems.

And which systems were affected and when:

Systems running Falcon sensors for Windows 7.11 and above that downloaded the updated configuration from 04:09 UTC to 05:27 UTC were susceptible to system crashes.

CrowdStrike’s channel file updates were shipped to computers without any settings to prevent such automatic updates, Wardle mentioned,