Dmitri Alperovitch is an American think-tank founder, author, philanthropist, podcast host and former computer security industry executive. He is the chairman of Silverado Policy Accelerator, a geopolitics think-tank in Washington, D.C., and a co-founder and former chief technology officer of CrowdStrike
At the heart of a global IT outage affecting companies ranging from banks to airlines is a Texas-based cybersecurity firm, CrowdStrike.
On Friday, CrowdStrike experienced a major disruption following an issue with a software update.
This caused Windows to crash due to a fault in the way CrowdStrike’s software update interacted with Windows.
In this article
CRWD-2.80 (-0.92%)After Hours
George Kurtz, co-founder and CEO of CrowdStrike Inc
A fault with an update issued by cybersecurity company CrowdStrike led to a cascade effect among global IT systems Friday, with industries ranging from banking to airlines facing outages.
Banks and health-care providers saw their services disrupted and TV broadcasters went offline as businesses worldwide grappled with the ongoing outage. Air travel has been hit hard, too, with planes grounded and services delayed.
At the heart of the issue is Texas-based cybersecurity vendor CrowdStrike
. On Friday, the cybersecurity firm experienced a major disruption following an issue with a software update.
So what happened, exactly? CNBC takes a look.
What is CrowdStrike and what does it do?
CrowdStrike is a cybersecurity vendor that develops software to help companies detect and block hacks. It is used by many of the world’s Fortune 500 companies, including major global banks, health-care and energy companies.
Major technical outages worldwide: Here’s what to know
watch now
VIDEO06:11
Major technical outages worldwide: Here’s what to know
CrowdStrike is what’s known as an “endpoint security” firm as it uses cloud technology to apply cyber protections to devices that are connected to the internet.
This differs from alternative approaches used by other cyber firms, which involve applying protection directly to back-end server systems.
“Many companies use [CrowdStrike software] and install it on all of their machines across their organization,” Nick France, chief technology officer at IT security firm Sectigo, told CNBC’s “Squawk Box Europe” on Friday.
“So when an update happens that maybe has problems with it, it causes this problem where the machines reboot, and people can’t get back into their computers.”
What happened on Friday?
On Friday, people around the world began encountering an error screen known as the “blue screen of death.”
This issue — a common problem among PCs, for example if a machine overheats — was the result of an update from CrowdStrike concerning its Falcon product.
Falcon is a platform developed by the company that’s designed to stop cyber breaches using cloud technology — it is at the heart of the firm’s focus on endpoints. CrowdStrike said Friday it is in the process of rolling back the update globally.
CrowdStrike’s software requires deep access to a computer’s operating system to scan for threats. In the case of Friday’s outage, machines running Microsoft’s Windows operating system crashed due to a fault in the way a software update issued by CrowdStrike interacted with Windows.
“We have been made aware of an issue impacting Virtual Machines running Windows Client and Windows Server, running the CrowdStrike Falcon agent, which may encounter a bug check (BSOD [blue screen of death]) and get stuck in a restarting state. We approximate impact started around 19:00 UTC on the 18th of July,” Microsoft
said in an update at 5:40 a.m. ET.
“We can confirm the affected update has been pulled by CrowdStrike. Customers that are continuing to experience issues should reach out to CrowdStrike for additional assistance,” the company added.
Satnam Narang, senior staff researcher at Tenable, told CNBC on Friday that the outage was “very unprecedented.”
“The challenge here is that security software — because it’s doing its job to protect organizations — it has to have more privileged access to these machines,” he said.
So, while people may be seeing their IT issues as a problem with Windows, “it’s not actually a Windows issue, it’s related to a faulty or bad update from those security software,” Narang added.
A fix has been issued
Earlier, Microsoft said its cloud services had been restored after an outage that affected its Azure services and Microsoft 365 suite of apps in the central U.S. region. A company spokesperson said these are two different and nonrelated issues — one issue relates to Azure, the other is linked to CrowdStrike.
Major global cyber outage hits airlines, banks and media outlets, impacting millions
watch now
VIDEO03:47
Major global cyber outage hits airlines, banks and media outlets, impacting millions
They added that they “anticipate a resolution is forthcoming,” in respect to the CrowdStrike problem.
CrowdStrike is “actively working with customers impacted by a defect found in a single content update for Windows hosts,” CEO George Kurtz said Friday in a update on social media platform X. He added that Mac and Linux hosts are not affected.
“This is not a security incident or cyberattack. The issue has been identified, isolated and a fix has been deployed,” Kurtz said.
That fix could be hard to implement, though. Andy Grayland, chief information and security officer at threat intelligence firm Silobreaker, said that in order to implement a fix, engineers would have to go into each individual data center running windows.
They’d then have to log in, navigate to a certain CrowdStrike file, delete it and then reboot the entire system, he said.
“Where machines are encrypted, complex encryption keys also need to be entered manually. Unless Microsoft and CrowdStrike (if they are involved) pull something miraculous out of the bag, this could be painful to recover from.”
Dmitri Alapovitch, one of the founders of cybersecurity company Crowdstrike and currently the head of the Silverado Policy Accelerator, said on Twitter: “It’s truly amazing that Russia is appearing to try to convince everyone that Ukrainians decided to commit ‘genocide’ in the Donbas at the very moment that Russia has built the largest invasion force in Europe in 50+ years on its borders. They waited 8 years to start doing it NOW!”
CrowdStrike’s co-founder steps down to launch nonprofit
Dmitri Alperovitch, CrowdStrike’s chief technology officer and co-founder, has left the company to launch a nonprofit.
The organization will be a nonpartisan “policy accelerator,” Alperovitch said in a tweet Wednesday.
Under Alperovitch’s leadership, CrowdStrike has gained notoriety for attributing the 2016 Democratic National Committee breach to two Russian APT groups, known as Cozy Bear and Fancy Bear. In recent months, the company has dealt with accusations from President Donald Trump that CrowdStrike had participated in a coverup of the breach.
That theory, which has been debunked, came to light last year when a memorandum about a phone call between Trump and Ukrainian president Volodymyr Zelenskiy became public. That call would later become central to the House of Representatives impeachment of Trump in December 2019.
Advertisement
The company, which provides endpoint protection, incident response, and conducts threat intelligence research, went public on the Nasdaq last year. Since then, stock prices have been near flat, although CrowdStrike shares lost fourteen percent of their value in December, according to S&P Global Market Intelligence.
CrowdStrike’s chief executive officer George Kurtz, who co-founded CrowdStrike with Alperovitch in 2011, said the firm wishes Alperovitch future success.
“We are grateful for Dmitri’s commitment over the past eight years to help build CrowdStrike into the industry leader that we are today,” Kurtz said. “We wish him well in his future endeavors.”
Michael Sentonas, the current vice president of technology strategy at CrowdStrike, will be taking over as worldwide CTO. Sentonas previously served as chief technology and strategy officer at Intel Security.
CrowdStrike stock received a brief bump in after-hours trading following the announcement.