- : A Case Study
محتوى المقال
الملخص
In today’s world, reliance on technology is rapidly growing across critical sectors such as business, banking, healthcare, and education. While technology enhances convenience and efficiency in daily activities, its failure can lead to significant disruptions. A notable global incident caused by a fault in CrowdStrike software disrupted the availability aspect of the Confidentiality, Integrity, and Availability (CIA) triad in cybersecurity, impacting Microsoft Windows users. The issue stemmed from the Falcon sensor, a faulty update that triggered the Blue Screen of Death (BSOD) due to a mismatch in parameters within the sensor code and the Inter-Process Communication (IPC) Template Type. To resolve the problem, CrowdStrike implemented runtime array bounds checks in the Content Interpreter function and validated input parameters to ensure system stability. These corrective measures aimed to prevent similar incidents and restore normal functionality for affected users. This paper introduces a case study that provides an overview of CrowdStrike, examines the incident in detail, identifies the root cause, outlines the remediation techniques employed, and highlights key lessons learned. It emphasizes the importance of effective incident response strategies and the use of canary testing to mitigate the impact of future technological failures.
الكلمات المفتاحية
Blue screen of death (BSOD)، CrowdStrike، cyber security، Falcon sensor، incident response plan (IRP)
التنزيلات
المراجع
D. Weston, “Helping our customers through the CrowdStrike outage - The Official Microsoft Blog.” Accessed: Sep. 17, 2024. [Online]. Available: https://blogs.microsoft.com/blog/2024/07/20/helping-our-customers-through-the-crowdstrike-outage/
T. Singla, D. Anandayuvaraj, K. G. Kalu, T. R. Schorlemmer, and J. C. Davis, “An Empirical Study on Using Large Language Models to Analyze Software Supply Chain Security Failures,” vol. 1, Aug. 2023, doi: 10.1145/3560835.3564556.
“Technical Details: Falcon Update for Windows Hosts | CrowdStrike.” CrowdStrike Blog. Accessed: Sep. 12, 2024. [Online]. Available: https://www.crowdstrike.com/en-us/blog/falcon-update-for-windows-hosts-technical-details/
“User Mode and Kernel Mode - Windows drivers | Microsoft Learn.” Accessed: Sep. 14, 2024. [Online]. Available: https://learn.microsoft.com/en-us/windows-hardware/drivers/gettingstarted/user-mode-and-kernel-mode
N. Premakanthan, “Analysis of the CrowdStrike Software Update Failure.” Accessed: Apr. 03, 2025. [Online]. Available: https://www.researchgate.net/publication/383084159_Analysis_of_the_CrowdStrike_Software_Update_Failure
“File System Redirector - Win32 apps | Microsoft Learn.” Accessed: Sep. 14, 2024. [Online]. Available: https://learn.microsoft.com/en-us/windows/win32/winprog64/file-system-redirector
“Glossary of Terms.” CrowdStrike. Accessed: Sep. 26, 2024. [Online]. Available: https://www.crowdstrike.com/wp-content/uploads/2024/07/GlossaryOFTerms.pdf
P. McCormack, “The 2024 CrowdStrike Incident - Simply Explained.” Accessed: Sep. 29, 2024. [Online]. Available: https://www.linkedin.com/pulse/2024-crowdstrike-incident-simply-explained-patrick-mccormack-jdxqc
“External Technical Root Cause Analysis — Channel File 291,” Aug. 2024. Accessed: Oct. 03, 2024. [Online]. Available: https://www.crowdstrike.com/wp-content/uploads/2024/08/Channel-File-291-Incident-Root-Cause-Analysis-08.06.2024.pdf
“CrowdStrike Global Outage.” Marco Blog. Accessed: Apr. 02, 2025. [Online]. Available: https://www.marconet.com/blog/crowdstrike-global-outage
M. de Rosa, “CAN Bus Security Analysis: a Fuzzing Approach,” 2024, [Online]. Available: https://webthesis.biblio.polito.it/30899/
V. Vidyasagar, “Blue-Green and Canary Deployments in DevOps: A Comparative Study,” vol. 15, no. 01, pp. 1047–1063, 2024, doi: 10.5281/ZENODO.15483641.
“Falcon Sensor Issue Likely Used to Target CrowdStrike Customers,” CrowdStrike Blog. Accessed: Nov. 18, 2024. [Online]. Available: https://www.crowdstrike.com/en-us/blog/falcon-sensor-issue-use-to-target-crowdstrike-customers/
“Masquerading, Technique T1036 - Enterprise | MITRE ATT&CK®.” Accessed: Nov. 18, 2024. [Online]. Available: https://attack.mitre.org/techniques/T1036/
“Threat Actor Uses Fake Recovery Manual to Deliver Unidentified Stealer,” CrowdStrike Blog. Accessed: Apr. 05, 2025. [Online]. Available: https://www.crowdstrike.com/en-us/blog/fake-recovery-manual-used-to-deliver-unidentified-stealer/
L. Mathur, V. Chole, and A. Karnik, “The Scam Strikes Back: Exploiting the CrowdStrike Outage | McAfee Blog.” Accessed: Apr. 05, 2025. [Online]. Available: https://www.mcafee.com/blogs/other-blogs/mcafee-labs/the-scam-strikes-back-exploiting-the-crowdstrike-outage/
“Find Threats Exploiting CrowdStrike Outage with TI Lookup - ANY.RUN’s Cybersecurity Blog.” Accessed: Apr. 05, 2025. [Online]. Available: https://any.run/cybersecurity-blog/crowdstrike-outage-abuse/
O. Ogundipe and T. Aweto, “The shaky foundation of global technology: A case study of the 2024 CrowdStrike outage,” International Journal of Multidisciplinary Research and Growth Evaluation, vol. 5, no. 5, pp. 106–108, 2024, Accessed: Apr 28, 2025. [Online]. Available: www.allmultidisciplinaryjournal.com
Dr. A. S. George, “When Trust Fails: Examining Systemic Risk in the Digital Economy from the 2024 CrowdStrike Outage,” Partners Universal Multidisciplinary Research Journal, vol. 1, no. 2, pp. 134–152, Jul. 2024, doi: 10.5281/ZENODO.12828222.
“CrowdStrike’s Impact on the Fortune 500 An Impact Analysis,” 2024. Accessed: May 06, 2025. [Online]. Available: https://www.parametrixinsurance.com/reports-white-papers/crowdstrikes-impact-on-the-fortune-500
“Press Release from the National Cybersecurity Authority | NCA.” Accessed: May 07, 2025. [Online]. Available: https://nca.gov.sa/ar/news/1370/
“Regulation on Personal Data Transfer outside the Geographical Boundaries of the Kingdom of Saudi Arabia,” Jul. 2023. Accessed: May 07, 2025. [Online]. Available: https://www.crowdstrike.com/wp-content/uploads/2023/09/Saudi-Arabia-Data-Transfer-Regulation-Comments.pdf
“SAMA Confirms Safety of Payment Systems and Banking Systems in Saudi Arabia.” Accessed: May 07, 2025. [Online]. Available: https://www.sama.gov.sa/en-us/news/pages/news-1035.aspx
“How Jeddah Airports interacted with the global technical systems crisis?” Jul. 19, 2024. Accessed: May 07, 2025. [Online]. Available: https://x.com/JedcoKSA/status/1814333783924973671
H. İş, “Evaluating and Mitigating Cybersecurity Threats from System Update Vulnerabilities through the CrowdStrike Case,” European Journal of Technique (EJT), vol. 14, no. 2, pp. 182–188, Dec. 2024, doi: 10.36222/EJT.1564440.
H. Ghanbari, K. Koskinen, and Y. Wei, “From SolarWinds to Kaseya: The rise of supply chain attacks in a digital world,” Journal of Information Technology Teaching Cases, 2024, doi: 10.1177/20438869241299823/SUPPL_FILE/SJ-PDF-1-TTC-10.1177_20438869241299823.PDF.
S. Bhunia, M. Blackert, H. Deal, A. DePero, and A. Patra, “Analyzing the 2021 Kaseya Ransomware Attack: Combined Spearphishing Through SonicWall SSLVPN Vulnerability,” IET Information Security, vol. 2025, no. 1, p. 1655307, Jan. 2025, doi: 10.1049/ISE2/1655307.
A. Akinsola and A. Akinde, “Enhancing Software Supply Chain Resilience: Strategy For Mitigating Software Supply Chain Security Risks And Ensuring Security Continuity In Development Lifecycle,” International Journal on Soft Computing, vol. 15, no. 1/2, pp. 01–18, Jul. 2024, doi: 10.5121/ijsc.2024.15201.
L. Koycheva and A. VandenBroek, “Sandbox innovation: Potentials and impacts,” Practicing Anthropology, vol. 46, no. 1, pp. 36–45, Jan. 2024. doi:10.1080/08884552.2024.2307293
H.-N. Nguyen, T.-T. Nguyen, T.-N. N. Thi, M.-D. Tran, and B.-H. Tran, “Proposed methods T O rollback a failed update of IOT devices,” International Journal of Engineering and Advanced Technology, vol. 11, no. 2, pp. 55–62, Dec. 2021. doi:10.35940/ijeat.b3297.1211221
A. A. Ibrahim, D. Kliazovich, P. Bouvry, and A. Oleksiak, “Virtual Desktop Infrastructures: Architecture, survey and Green Aspects proof of concept,” 2016 Seventh International Green and Sustainable Computing Conference (IGSC), 2016. doi:10.1109/igcc.2016.7892624
تفاصيل المقال
هذا العمل مرخص بموجب Creative Commons Attribution-NonCommercial 4.0 International License.