It seems to be crowdstrike reacting to the new update.
We have got ours up by the very manual process of:
1 Boot into safe mode.
-
Navigate to C:\windows\system32\drivers\crowdstrike
-
Delete C-00000291*.sys
-
Reboot normally
Yeah, CS posted this in a support article. Gonna be fun watching their share price on the Nasdaq overnight.
What’s their ticker? I looked up BSOD but that’s not it…
lol - it should be after this. CRWD…
You looked up Blue Screen of Death’s stock price‽
I mean that’s a fair assumption of what their ticker might’ve been
Maybe a stupid question but why would not reaching an online service (?) blue screen your computer?
It’s the other way around. All those PCs are bluescreening at boot. So that prevents fixing the system remotely and on a large scale. Now poor IT guys have to fix evey single one by hand.
It has a privileged service running locally - csagent.sys - that was crashing causing the BSOD.
I guess if the code acted as if it got a valid response without checking it could get into a very weird state. Or the code just fails hard.
At the driver level it’s very easy to kill things.
Missing data in the boot sequence if that data is stored as a cloud init or a key is needed for auth during boot. So if you’re running thin clients and rely on something like Ansible, but now the thin client can’t get to the service it can’t boot, so critical error.
-
This has been a fun end to the week - still sitting on a call about the widespread outages and impacts from this.
At which point do we acknowledge the cure is as bad as the problem?
At which point do we acknowledge the cure is as bad as the problem?
Didn’t we all do that when we stopped using Norton Anti-virus?
As a developer, man do people not realize how brittle modern computing is. It’s all built in popsicle sticks and Elmer’s glue. One small config or bad file as we see can cripple entire industries.
I do love that windows is still like “something slightly wrong? Might as well crash”
Someone plugged in a usb stick. Many, many, times apparently!
so it got backdoored, or QA is trash or both at the same time. hate it when CI builds come so fast you cant verify the latest shipping rootkit
This is the best summary I could come up with:
There are reports of IT outages affecting major institutions in Australia and internationally.
The ABC is experiencing a major network outage, along with several other media outlets.
Crowd-sourced website Downdetector is listing outages for Foxtel, National Australia Bank and Bendigo Bank.
Follow our live blog as we bring you the latest updates.
The original article contains 52 words, the summary contains 52 words. Saved 0%. I’m a bot and I’m open source!
