{"id":545273,"date":"2024-07-20T08:59:43","date_gmt":"2024-07-20T06:59:43","guid":{"rendered":"https:\/\/mybroadband.co.za\/news\/?p=545273"},"modified":"2024-07-20T09:02:17","modified_gmt":"2024-07-20T07:02:17","slug":"the-software-that-brought-capitec-to-its-knees","status":"publish","type":"post","link":"https:\/\/mybroadband.co.za\/news\/software\/545273-the-software-that-brought-capitec-to-its-knees.html","title":{"rendered":"The software that brought Capitec to its knees"},"content":{"rendered":"
\n

Mission-critical computer systems worldwide were brought to their knees on Friday due to a faulty update to CrowdStrike Falcon.<\/p>\n

In South Africa, Capitec customers\u00a0could not<\/a><\/span> access accounts<\/a>, transact using their bank cards, or withdraw cash.<\/p>\n

Elsewhere in the world, critical infrastructure like airlines, airports, emergency services, and healthcare were knocked offline. Television and radio stations were also hit, with Sky News\u2019 broadcast disrupted as a result of the issue.<\/p>\n

Various financial institutions were also impacted, as well as the London Stock Exchange.<\/p>\n

CrowdStrike is a cybersecurity vendor selling software and services to help organisations protect themselves against cyberattacks, including emergent new threats like ransomware.<\/p>\n

Below, associate professor of cybersecurity at the University of Melbourne, Toby Murray, explains what CrowdStrike Falcon is and what went wrong on Friday.<\/p>\n

\n

A massive IT outage<\/a> is currently affecting computer systems worldwide.\u00a0In Australia and Aotearoa New Zealand, reports indicate<\/a> computers at banks, media organisations, hospitals, transport services, shop checkouts, airports and more have all been impacted.<\/p>\n

The outage is unprecedented in its scale and severity. The technical term for what has happened to the affected computers is that they have been \u201cbricked<\/a>\u201d. This word refers to those computers being rendered so useless by this outage that \u2014 at least for now \u2014 they may as well be bricks.<\/p>\n

The widespread outage has been linked to a piece of software called CrowdStrike Falcon. What is it, and why has it caused such widespread disruption?<\/p>\n

CrowdStrike<\/a> is a US cyber security company with a major global share in the tech market. Falcon is one of its software products that organisations install on their computers to keep them safe from cyber attacks and malware.<\/p>\n

Falcon is what is known as \u201cendpoint detection and response\u201d (EDR) software.<\/p>\n

Its job is to monitor what is happening on the computers on which it is installed, looking for signs of nefarious activity (such as malware). When it detects something fishy, it helps to lock down the threat.<\/p>\n

This means Falcon is what we call privileged software<\/em>. To detect signs of attack, Falcon has to monitor computers in a lot of detail, so it has access to a lot of the internal systems.<\/p>\n

This includes what communications computers are sending over the internet as well as what programs are running, what files are being opened, and much more.<\/p>\n

In this sense, Falcon is a bit like traditional antivirus software, but on steroids.<\/p>\n

More than that, however, it also needs to be able to lock down threats. For example, if it detects that a computer it is monitoring is communicating with a potential hacker, Falcon needs to be able to shut down that communication.<\/p>\n

This means Falcon is tightly integrated with the core software of the computers it runs on \u2014 Microsoft Windows.<\/p>\n

\"\"<\/a>

An update alert from the CrowdStrike website informing customers about the Windows crashes related to Falcon. The Conversation\/Crowdstrike<\/p><\/div>\n

Why did Falcon cause this problem?<\/h2>\n

This privilege and tight integration makes Falcon powerful. But it also means that when Falcon malfunctions, it can cause serious problems. Today\u2019s outage is a worst-case scenario.<\/p>\n

What we currently know is that an update to Falcon caused it to malfunction in a way that caused Windows 10 computers to crash and then fail to reboot, leading to the dreaded \u201cblue screen of death\u201d (BSOD).<\/p>\n

This is the affectionate term used to refer to the screen that is displayed when Windows computers crash and need to be rebooted \u2014 only, in this case, the Falcon problem means the computers cannot reboot without encountering the BSOD again.<\/p>\n

Why is Falcon so widely used?<\/h2>\n

CrowdStrike is the market leader in EDR solutions. This means its products \u2014 such as Falcon \u2014 are common and likely the pick of the bunch for organisations conscious of their cyber security.<\/p>\n

As today\u2019s outage has shown, this includes hospitals, media companies, universities, major supermarkets and many more. The full scale of the impact is yet to be determined, but it\u2019s certainly global<\/a>.<\/p>\n

Why aren\u2019t home PCs affected?<\/h2>\n

While CrowdStrike\u2019s products are widely deployed in major organisations that need to protect themselves from cyber attacks, they are much less commonly used on home PCs.<\/p>\n

This is because CrowdStrike\u2019s products are tailored for large organisations in which CrowdStrike\u2019s tools help them monitor their networks for signs of attack, and provide them with the information they need to respond to intrusions in a timely way.<\/p>\n

For home users, built-in antivirus sofware or security products offered by companies such as Norton and McAfee are much more popular.<\/p>\n

\"\"<\/a>

An example of the Blue Screen of Death caused by Crowdstrike. Troy Hunt\/X<\/a><\/p><\/div>\n

How long will this take to fix?<\/h2>\n

At this stage, CrowdStrike has provided manual instructions for how people can fix the problem on individual affected computers.<\/p>\n

However, at the time of writing there does not yet appear to be an automatic fix for the problem. IT teams at some organisations may be able to fix this problem quickly by simply wiping the affected computers and restoring them from backups or similar.<\/p>\n

Some IT teams may also be able to \u201croll back\u201d (revert to an earlier version) the affected Falcon version on their organisation\u2019s computers. It\u2019s also possible some IT teams will have to manually fix the problem on their organisation\u2019s computers, one at a time.<\/p>\n

We should expect that in many organisations it may take a while before the problem can be resolved entirely.<\/p>\n

What is ironic about this incident is that security professionals have been encouraging organisations to deploy advanced security technology such as EDR for years. Yet that same technology has now resulted in a major outage the likes of which we haven\u2019t seen in years.<\/p>\n

For companies like CrowdStrike that sell highly privileged security software, this is a timely reminder to be incredibly careful when deploying automatic updates to their products.<\/p>\n

\n

Toby Murray<\/em><\/a>, Associate Professor of Cybersecurity, School of Computing and Information Systems, The University of Melbourne<\/a><\/em><\/p>\n

This article is republished from The Conversation<\/a> under a Creative Commons license. Read the original article<\/a>.<\/em><\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"

What is CrowdStrike Falcon and what does it do?<\/p>\n","protected":false},"author":340972,"featured_media":543303,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_sma_x_autopost_status":"idle","_sma_x_autopost_error":"","_sma_x_post_id":"","_sma_facebook_post_id":"","_sma_instagram_post_id":"","_sma_x_attempts":0,"footnotes":""},"categories":[27,16],"tags":[5334,9149,35,123,12505],"class_list":["post-545273","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-security","category-software","tag-capitec","tag-crowdstrike","tag-headline","tag-microsoft","tag-microsoft-windows"],"_links":{"self":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts\/545273"}],"collection":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/users\/340972"}],"replies":[{"embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/comments?post=545273"}],"version-history":[{"count":0,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts\/545273\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/media\/543303"}],"wp:attachment":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/media?parent=545273"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/categories?post=545273"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/tags?post=545273"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}