Global outage disrupts major businesses and services
Written by Rebecca Uffindell Fri 19 Jul 2024
A major technical issue attributed to a cybersecurity software company has caused a global outage affecting Microsoft users, impacting banks, airlines, telecom companies, broadcasters, supermarkets, and the NHS, among others.
The global outage is linked to cybersecurity company CrowdStrike, appearing to be caused by a content deployment problem to one of its platforms, Falcon Sensor, which is installed on computers to gather security data. As of 31 January 2023, the company had a total of 23,019 subscription users.
Early Friday afternoon Australian Eastern Standard Time, Australian users reported being locked out of their workstations, with Windows PCs beginning to show what is known as a ‘blue screen of death’, an error message on the system that left them unusable. This resulted in problems at many of the world’s largest companies.
Impact on Global Organisations
The tracking website Down Detector registered outages and problems at numerous companies, including Visa, Mastercard, Lloyds Bank, Santander, Amazon, RyanAir, Sky News, Ladbrokes, BT, and Microsoft Teams. However, It is unclear if all these issues are linked to the problem with PCs.
The Paris Olympics organising committee also experienced issues, stating the global tech outage was slowing operations. However, the incident’s impact was limited and ticket sales were unaffected ahead of the Olympic Games next week.
Reuters reported American Airlines, Delta Airlines, United Airlines, and Allegiant Air have grounded flights. The BBC added German airline Lufthansa and Scandinavian SAS Airline are also experiencing disruptions.
Prague Airport’s check-in system outage is causing delays, while Eurowings’ online check-in is down. Belfast International Airport in Northern Ireland is affected, though flights remain operational, and Zurich’s largest airport in Switzerland has halted landings.
UK Reacts to IT Incident
UK Prime Minister, Keir Starmer, has called for an emergency COBRA on the Global outage which also affected multiple UK organisation’s IT infrastructure.
“Many people are being affected by today’s IT outages impacting services across the country and globally. Ministers are working with their sectors and respective industries on the issue. I am in close contact with teams coordinating our response through the COBR response system,” said Labour MP, Pat McFadden, in a post on X.
The UK’s busiest train operator, Govia Thameslink Railway, said it was experiencing ‘widespread IT issues’ across its entire network. The operator runs the Southern, Thameslink, Gatwick Express and Great Northern services around London.
“We are unable to access driver diagrams at certain locations, leading to potential short-notice cancellations, particularly on the Thameslink and Great Northern networks,” said Thamelink in a post on X.
Broadcasters were also caught up in the chaos, with Sky News experiencing a disruption to the service between 6am and 9am.
NHS Faces Outage
The BBC reported an NHS England spokesperson said the NHS is aware of the global IT outage and with EMIS, an appointment and patient record system, which is causing disruption in the majority of GP practices.
“Patients should attend appointments unless told otherwise. Only contact your GP if it’s urgent, and otherwise please use 111 online or call 111,” said the spokesperson, adding there was no impact on 999 or the emergency services.
The National Pharmacy Association said they were aware that some pharmacies are experiencing global IT outage, affecting prescription access from GPs and medicine deliveries.
“We kindly ask for your patience when visiting your pharmacy. We are urgently addressing this issue with NHS England,” said the National Pharmacy Association in a post on X.
Simon Newman, Co-Founder of Cyber London and International Cyber Expo Advisory Council Member, said the worldwide outage shows how complex and interconnected our supply chains are, demonstrating the need for every organisation to have a robust Incident Response Plan in place that is regularly reviewed and tested to minimise the impact.
“It is important that lessons are learned from today’s incident to reduce the likelihood of it happening again and I would encourage all organisations to review their supply chain resilience regularly,” said Newman.
Microsoft and CrowdStrike Respond
CrowdStrike said they have identified the issue and have rolled back the update early in the morning. However, some remaining computers remain unfixed.
CEO of CrowdStrike, George Kurtz, stressed the incident was not a security incident or cyberattack and the company is actively working with users impacted by a defect found in a ‘single content update for Windows hosts’.
“The issue has been identified, isolated and a fix has been deployed. We refer users to the support portal for the latest updates and will continue to provide complete and continuous updates on our website,” said Kurtz in a post on X.
Ajay Unni, CEO of cybersecurity services provider, StickmanCyber, stated versions 7.15 and 7.16 are affected by the outage, while version 7.17 appears to be unaffected.
“We are waiting on official advisory from CrowdStrike on these findings but doing our best to help affected users. It is a lesson to always update your software, but obviously this is an extreme example,” added Unni.
Microsoft said it is taking ‘mitigation actions’ after the incident caused service issues and believes a resolution is forthcoming.
“The flawed update necessitates manual intervention to resolve, specifically rebooting systems in ‘safe mode’ and deleting the faulty driver file. This process is cumbersome and leaves systems vulnerable in the interim, potentially inviting opportunistic attacks,” said Kevin Reed, Chief Information Security Officer at anti-malware company Acronis.
What is the CrowdStrike Falcon Sensor?
The CrowdStrike Falcon Sensor is a software agent used for endpoint protection. It is part of the CrowdStrike Falcon platform, a cloud-based solution designed to provide comprehensive security through endpoint detection and response (EDR), threat intelligence, and threat hunting.
Elliott Wilkes, CTO of Advanced Cyber Defence Systems (ACDS), said the Falcon product has software that runs on end user devices, called an ‘agent’, and runs in a similar way to antivirus software running on a desktop computer.
“Because agent-based detection systems often require enhanced or even administrator-level privileges to conduct monitoring of computer activity in order to detect malicious code, these systems can introduce risks,” said Wilkes.
Wilkes added for tools like Falcon in the category of endpoint detection response, these typically have the ability to take action to immediately resolve or suspend services and if malicious activity is detected.
“This is a hugely important feature and needed component in order to rapidly defend against attacks, prevent infiltrators from moving laterally across an organisation,” said Wilkes.
However, these enhanced permissions come with risks, because they are integrated into critical components of the operating system of the end user devices.
“What we are seeing here is end user devices getting stuck in a reboot loop, on a screen that is known as the ‘blue screen of death’, the infamous Windows error screen. Ultimately the likelihood of these events is small, but the impact as we can see today is tremendous,” added Wilkes.
Al Lakhani, CEO of multi-factor authentication company, IDEE, said investing in cybersecurity is not just about acquiring the latest or most popular tools but ensuring those tools are reliable and resilient.
“CrowdStrike’s platform approach … can create significant issues. For instance, agents require installation and maintenance of software on multiple different OSes, adding layers of complexity and potential points of failure,” said Lakhani.
Written by Rebecca Uffindell Fri 19 Jul 2024