Tag Archives: Cybersecurity

Gadget Man, Matt Porter, Microsoft, The Gadget Man

Global Windows Crash Crisis: The Crowdstrike Falcon Update Fiasco

Leave a comment

Earlier today, a significant issue has come to light affecting Windows users globally. CrowdStrike’s Falcon sensor update for Windows hosts has led to widespread system crashes, commonly known as the “blue screen of death” (BSOD). This disruption has impacted critical sectors across the globe, including transport, banking, and media.

What Happened?

The latest content update from CrowdStrike for its Falcon sensor, designed to enhance security measures, inadvertently introduced a defect. This defect has caused systems to crash, triggering BSOD errors. Users began experiencing these problems shortly after the update was deployed, leading to a flurry of reports and concerns from various industries dependent on uninterrupted system operations.

Affected Areas

The fallout from this update has been extensive. Industries such as transport have seen operational disruptions, banking systems have faced downtime affecting transactions, and media outlets have struggled with system reliability. This has not only caused inconvenience but has also raised concerns about the stability and reliability of critical cybersecurity tools.

Cloudstrike Statement
Cloudstrike Statement

CrowdStrike’s Response

In response to the crisis, CrowdStrike has issued a statement acknowledging the problem and detailing their steps to mitigate the issue. They have provided guidelines for affected users to stabilise their systems and are working on a resolution to prevent further incidents. CrowdStrike’s team is actively investigating the root cause and is committed to restoring normal operations as swiftly as possible.

What to Do If You’re Affected

Users experiencing issues are advised to follow CrowdStrike’s interim measures to disable the problematic update and revert to a stable version of the Falcon sensor. Detailed instructions are available on CrowdStrike’s official blog, ensuring that users can manage their systems and mitigate the immediate impact while a permanent fix is developed.

For ongoing updates and support, affected users are encouraged to stay in touch with CrowdStrike’s customer service and monitor their communication channels.

Conclusion

This incident underscores the critical importance of robust update testing and rapid response mechanisms in cybersecurity. While CrowdStrike’s proactive measures are a step in the right direction, the incident highlights the need for vigilance and preparedness in handling unforeseen software issues.

For more detailed information, you can visit the official statement from CrowdStrike here.

Crowdstrike, Gadget Man, Matt Porter, Microsoft, Podcast, Technology, The Gadget Man, Worldwide Outage

Global Windows Crash Crisis: Crowdstrike Falcon Sensor Update “Defect” Disrupts Key Sectors Worldwide

Leave a comment

Podcast: Play in new window | Download

Subscribe: Apple Podcasts | Email | TuneIn | RSS | More

Today, I’m addressing a significant issue affecting numerous Windows users worldwide. Reports have emerged of widespread crashes, commonly referred to as the “blue screen of death,” impacting various critical sectors, from transportation to banking and media.

I spoke with Sarah Julian at BBC Radio WM about the worldwide problems that continue to persist

Understanding the Issue:

The root cause of these crashes has been traced back to an overnight software update for CrowdStrike’s Falcon Sensor. For those unfamiliar, Falcon Sensor is a security tool designed to act as a sentinel for your computer, monitoring and protecting against malicious activities. A single corrupted system file from this update is causing Windows systems to crash upon booting.

Why This Matters:

Windows holds a substantial market share, with 72% of global computers running this operating system. The automatic update to Falcon Sensor has inadvertently introduced a fault, leading to these severe crashes. The update, once applied, seems to corrupt system functionality, causing the dreaded blue screen on countless machines.

Impact Across Sectors:

The ripple effect of this issue is profound. The update has disrupted services across various sectors:

  • Transportation: Both train and plane operations have been hampered.
  • Banking: Financial institutions are facing operational challenges, with payment systems affected.
  • Media: Broadcast systems have been affected, causing interruptions, including Sky News and CBBC.
  • Healthcare: NHS GP surgery systems are impacted, with reports of doctors having to handwrite prescriptions.
  • Emergency Services: Even essential services like emergency call centres have not been spared.
  • Airports: Airports, including Birmingham Airport, have reported issues with check-in services, and operations at the Port of Dover are also impacted.

Al Lakhani, CEO of IDEE, said:

“Many people might be thanking Microsoft for their accidental day off, but countless businesses are suffering due to Microsoft’s and their partners’ failure to maintain their services. This incident underscores the importance of businesses thoroughly researching and vetting their cybersecurity solutions before implementation. Microsoft clearly fell short in this regard, and we are witnessing a cascade of operational failures around the world as a result.”

“CrowdStrike’s platform approach, which relies on a single agent focused on detection, might seem good at first glance, but as we can see, it can create significant issues. For instance, agents require installation and maintenance of software on multiple different OSes, adding layers of complexity and potential points of failure. Moreover, agents can become a single point of failure, as a bad update can compromise the entire network, as seen with the SolarWinds attack.

“The lesson here is blindingly obvious: investing in cybersecurity is not just about acquiring the latest or most popular tools but ensuring those tools are reliable and resilient. This is why businesses must prioritise agentless solutions like MFA 2.0, which reduce the risk of widespread failures and ensure more resilient defences.”

Cloudstrike Falcon Sensor Blue Screen of Death BSOD Global Outage
Cloudstrike Falcon Sensor Blue Screen of Death BSOD Global Outage

Current Status and Actions:

Microsoft has acknowledged the problem and stated that a fix is in place. However, this does not immediately rectify the situation for all affected devices. Many computers remain non-functional, and a manual fix may be required. One proposed solution involves removing the corrupted update link to restore system operations.

Security Concerns:

This incident raises critical questions about our reliance on third-party providers and the level of access they have to our systems. The Falcon Sensor update had kernel-level access, the deepest level of system access, which allowed it to cause such widespread disruption.

Tech Alert Windows Crashes Related to Falcon Server
Tech Alert Windows Crashes Related to Falcon Server

Moving Forward:

As we navigate this challenging situation, it’s essential to stay informed and take proactive steps to secure our systems. Further updates will be provided as new information becomes available and solutions are implemented.

For now, if you’re experiencing issues, consult with your IT department or follow the suggested manual fix to remove the problematic update. Manual intervention is likely to be needed to address the corrupted system file causing the crashes. Stay vigilant and prioritise your system’s security.

Uncategorized

I Automated Malicious IP Blocking with the Help of AI

Leave a comment

Introduction: Navigating the complexities of cybersecurity requires a blend of alertness and innovation. In my latest project, I embraced this ethos by deploying AI, particularly ChatGPT-4, to craft a Python script that automates the blocking of malicious IP addresses. (Moreover, the ‘tags‘ you see in this post are the product of a WordPress plugin, also primarily developed with insights from ChatGPT-4 too!)

The Challenge: With brute force attacks becoming increasingly common, developing a swift and automated response mechanism was crucial. My aim was to create a system capable of promptly identifying and neutralizing threats from malicious IP addresses.

AI as a Collaborative Partner: ChatGPT-4’s advanced language understanding capabilities played a pivotal role in this project, assisting both in scripting and in WordPress plugin development.

  1. Script Development: ChatGPT-4 provided step-by-step guidance in crafting a Python script to parse alert emails and extract IP addresses. Its ability to generate code snippets and troubleshoot issues was invaluable.
  2. Integrating Security Tools: The script was integrated seamlessly with cPHulk and CSF, using Python’s subprocess module. This integration, suggested by ChatGPT-4, was critical for the effective blocking of suspicious IPs.
  3. Handling Sensitive Data Securely: In dealing with login credentials, ChatGPT-4 recommended secure practices, such as using environment variables, which were crucial for maintaining the script’s integrity.
  4. Error Handling and Efficient Logging: Robust error handling and comprehensive logging, as advised by ChatGPT-4, ensured the system’s reliability and maintainability.
  5. Automating with Cron Jobs: The script’s automation was achieved through a cron job setup, a process in which ChatGPT-4 played an advisory role.
  6. WordPress Plugin for Tag Generation: Beyond the script, ChatGPT-4’s assistance extended to developing a WordPress plugin for generating tags for my blog posts. This plugin analyzes the content and contextually generates relevant tags, showcasing the AI’s versatility.

The Outcome: The result is a robust, AI-enhanced cybersecurity mechanism, complemented by an AI-driven tagging system for my blog. This project exemplifies the synergy between human expertise and AI in solving complex technical challenges.

Conclusion: This venture into AI-assisted development has not only fortified my server’s security but also revolutionised how I manage content on my blog. It stands as a testament to the power and potential of AI in cybersecurity and beyond.

Future Prospects: This successful collaboration with AI opens new horizons for future projects. I am excited to delve deeper into the integration of AI in various aspects of problem-solving, especially in technology and cybersecurity.

Data

Surprising Things That Put Your Data At Risk

Leave a comment

The start of the pandemic has seen a sudden surge in home-based work and, almost simultaneously, a sharp increase in cybersecurity attacks. For businesses of all sizes, cyber incidents became a top concern around the world. Experts estimate that the worldwide cost of cybercrime will rise to $6 trillion by the end of 2021. It goes with saying: the pandemic has caused major disruption in the workplace and the security around the workplace. 

Additionally, hackers have seized the unique opportunity to create pandemic-related scams, capitalising on pandemic anxiety and fear. Some hackers targeted stolen information from individuals and companies by creating a global map of COVID-19 cases with malware embedded inside it. Others targeted work-from-home individuals with brutal cyberattacks and phishing content, gaining protection to confidential files, work and home networks. Yet, as cybercriminals doubled their efforts, businesses and their teams rapidly learned to identify vulnerabilities and suspicious content. But cyber vulnerabilities can come in different shapes, some of which may be unexpected. Here are the most surprising things that can put remote workers’ data at risk. 

An unsafe backpack

Do remote workers still work from home? Recent surveys reveal that people are looking for new work environments, such as co-working spaces and their local coffee shops. Thankfully, many employees are familiar with the dangers of public connections. Therefore, many have been adding a VPN to their work routine. However, what they have not considered is the role their laptop bag plays. Indeed, a secure backpack makes it difficult for thieves on public transport to gain advantage of the crowd. Theft-proof backwards design means that nobody can access the content of the bag when you’re carrying it. Laptops, smartphones and other personal devices are unlikely to end in the wrong hand. 

 

Not using tech support to its full extend

We get it. Sometimes, you accidentally press the wrong button or pick the wrong option, and things can go out of control. This is especially frequent when downloading important documentation or using new tools without proper understanding. More people don’t realise that IT support professionals can help read between the lines and keep your data protected. Ultimately, the biggest vulnerability for your laptop is not the network or the digital solution; it’s the user. We are prone to make mistakes, so it’s helpful to gain tech guidance when needed. 

Long working hours

Working remotely tends to increase the average working day by up to two hours. The pandemic has boosted the UK’s reputation for being the “unpaid overtime capital of Europe” to new records. Unfortunately, working longer hours is no productivity miracle. It’s the opposite. The long-hours culture affects productivity, concentration and creativity, making overworked employees more likely to make mistakes. Phishing emails and scams can become believable communication when you’re too tired to think clearly. 

An unexpected compliment

Working from home can be tiring and stressful. Many employees agree that they’re having frustrating days when they feel that nobody is noticing their efforts. When you are isolated from your team, you could be more vulnerable to flattery. A scammer who pays a compliment, either on the phone or via email, is more likely to gain someone’s trust. 

Tackling cybersecurity threats further in a post-pandemic environment requires a deep understanding of human psychology. Criminals act when they see an opportunity, which means it’s essential for business and professionals to maintain a strong approach to their work routine.