Update from CrowdStrike Putting Windows Machines in a BSOD Loop

Globally, a recent update to the CrowdStrike Falcon sensor is seriously affecting Windows users. This update is rendering systems unusable and causing blue screen of death (BSOD) loops.

Starting on July 19, 2024, Windows 10 and 11 systems running CrowdStrike’s endpoint security software are impacted by the problem. Users report repeatedly seeing “DRIVER_OVERRAN_STACK_BUFFER” error messages on their BSODs, which prevent the system from booting up and operating normally.

Asserting that their engineering teams are “aware of reports of crashes on Windows hosts related to the Falcon Sensor,” CrowdStrike has acknowledged the issue and said they are working to fix it.

Affected users are advised by the company not to open individual support tickets at this time. Enterprise customers have been particularly hard hit by this update; according to some organizations, thousands of devices, including crucial production servers and SQL nodes, have been impacted.

In an effort to minimize the harm, some IT departments are removing CrowdStrike-related files from impacted systems in order to get those systems back up and running.

This incident brings to light the possible risks that come with security software updates that happen automatically, particularly in enterprise settings. In order to avoid such occurrences in the future, a large number of impacted users are now requesting the adoption of phased rollout policies and stricter testing protocols.

“Blue screens of death” are taking over more organizations and businesses globally as a result of global disruption.

Global IT outage affects multiple PH companies

A Microsoft service outage has caused service disruptions for airlines, airports, banks, telecommunications companies, and other organizations globally, including those in the Philippines.

In response to the service disruptions, Microsoft stated that it is taking “mitigation actions”.

Germany’s digital security authority said the global IT outage had been caused by a “faulty update” from cybersecurity company CrowdStrike, which affected Windows-based computers.

Crowdstrike meanwhile said it has already deployed a fix for the bug that caused the global IT outage affecting airports, banks and media across the world, the CEO of CrowdStrike antivirus firm said Friday.

“CrowdStrike is actively working with customers impacted by a defect found in a single content update for Windows hosts… The issue has been identified, isolated and a fix has been deployed,” CEO George Kurtz said in a message on social media platform X.

PH BANKS AFFECTED

Bank of the Philippine Islands (BPI) said the issue has impacted certain operations in the bank which may cause longer wait times in its branches and contact center.

“You may also experience delays in crediting of financial transactions including bills payment and interbank fund transfers as other institutions are likewise affected. Our technical team is already coordinating closely with the provider on the resolution of this issue,” the bank said in an advisory.

BPI however also assured its customers that its branches, ATMs, CAMs, online and mobile banking services remain available.

BDO also said it is experiencing technical difficulties due to the Microsoft outage.

“This may result in extended wait times at our Branches and Contact Center, and delays in or unavailability of some functions in our digital channels.

The bank said its team is working with Microsoft to resolve the issue.

Metrobank also said customers may experience a slowdown or temporary unavailability of some bank products and services through its online channels because of the global outage.

“Clients may continue to access their funds through the bank’s ATMs or deposit funds through Cash Accept Machines. Our branch personnel are ready to assist or you may reach us through our hotline: 88-700-700,” the bank said.

UnionBank said that due to the outage, its Customer Service Hotline and some branch services and online credit card transactions are temporarily unavailable.

“In the meantime, please use the UnionBank Online App or website, or any of our ATMs nationwide, for continued access to your accounts and essential banking services,” UnionBank said.

RCBC said it is currently experiencing technical difficulties affecting RCBC Pulz, RCBC Online Banking and Diskartech resulting in a slowdown in some online banking transactions.

The bank said the following services are temporarily unavailable until further notice:

RCBC Pulz and Online Banking

– Fund transfers to other banks via Instapay, PesoNet, Swift and PDDTS
– Bills payment
– Cardless withdrawal
– Credit card services
– Online check deposit
– PayDay NOW and Salary Loan NOW

Diskartech: 

– Fund transfers to RCBC and to other banks via Instapay
– Cardless withdrawal

Customers however may continue to do their banking transactions at any RCBC Branch or RCBC ATMs nationwide.

The Bangko Sentral ng Pilipinas said its Peso Real Time Gross Settlement System or PhilPassPlus was unaffected and all settlements, including PESONet, Instapay, ATM and checks, were successfully completed today.

The central bank said it is “closely monitoring” the situation but added that “the financial system remains resilient, with alternative channels and digital platforms available for individuals and businesses.”

The Department of Information and Communications Technology meanwhile said the outage was not the result of hacking.

“This is not hacking, this is [a] faulty update that affects systems and hindi naman to yung general hack na tina-target yung bank institutions or mga private entities,” said ICT Assistant Secretary Renato Paraiso.

Below is a detailed table listing the affected countries and services as of July 19, 2024.

Source:
https://cybersecuritynews.com/
https://news.abs-cbn.com/