CrowdStrike/Microsoft worldwide crash - what happened??? (for dummies)

On Friday, July 19 2024, a leading cybersecurity firm, CrowdStrike, mistakenly released a damaged security update that crashed MILLIONS of Windows PC's around the world - how did something like this happen, from a company entrusted to be a world leader in security? In this video, I explain exactly what happened, in language you can understand :)
💻 For remote support requests:
Hours of Operation: Every Day 8 AM - 9 PM MST
[phone]
❓ If you need personalized help, here's how you can find me: Please remember that I am just ONE person. It takes a TON of time and money to keep quality content coming to you free of charge. Viewers like YOU supporting the growth of the channel through tips and donations is how I'm able to do that!
I get TONS of questions daily, so here's the best way to get direct answers to your questions, in the order of "easiest to reach" to "may never see your message".
❤️ A Superchat donation on any of my videos is always appreciated and ALWAYS gets my attention
❤️ Purchase anything on my Amazon wish list:
www.amazon.com...
☕ Buy Me a Coffee: www.buymeacoff...
💻 Standard KZbin comment on a relevant video
💻 E-mail to [e-mail]
💻Twitter DM: / askmecomputers
💻 Facebook message: / askyourcomputerguy
💻 LinkedIn message: / ask-your-computer-guy-...
💻 Instagram message: / askyourcomputerguy
💻 Discord server: / discord
😎 Hope you guys enjoy this video! If you did, please like and share it!
🔔 Don't forget to subscribe to this channel for more updates! cutt.ly/mOW7myv
🔍 Here are some other related videos you might enjoy:
⏰ Timecodes ⏰
00:00 -
⚡️ Here are tools that I highly recommend and use personally every day...
Hardware ---
◼ 142-piece magnetic electronics precision screwdriver set with 120 bits
👉 amzn.to/3exdNeb\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\
◼ Sabrent USB-C docking station for SATA and m.2 with offline cloning
👉 amzn.to/47iK2aI
◼ StarTech 4-bay USB 3.0 hard drive docking station 6Gbps
👉 amzn.to/3z6zNpG
◼ StarTech 2-bay USB 3.0 hard drive docking station SATA 6Gbps
👉 amzn.to/3sAGZt0
◼ Netgear A6100 wifi adapter
👉 amzn.to/3DWUp5p
◼ Godshark NVME to USB adapter M.2 SSD to Type-A USB 10Gbps
👉 amzn.to/3FGw3O8
◼ Cordless, rechargeable air duster 6000mAh 10w fast-charging
👉 amzn.to/3pzJWIa
💢 Here is some helpful/useful and FREE everyday software that you might enjoy!
◼ Ninite (used to automatically download and install your favorite software):
👉 www.ninite.com
◼ Defraggler (used to defragment and organize your files on hard drives, not for SSD):
👉 www.defraggler.com
◼ Open Office (Microsoft Office FREE replacement)
👉 www.openoffice.org
💢 Hey, do you want even MORE in-depth techie stuff? Check out my friend Nico's page, Nico Knows Tech. Tell him I sent you and watch the obscenities fly LOL
✔ / nicoknowstech
⚠️ Affiliate link notice ⚠️
Some links included in this video are affiliate links. The creator may make a small percentage from any products that you purchase through one of these links. This purchase comes at ZERO extra cost to you, and greatly helps to support the growth of this channel.
Thanks so much for stopping in and watching!

[@samhavholm]

Your info was VERY painless! straight forward, to the point, no runaround or fear mongering! Thank you... ( now if you could just be a news anchor and report the news every night that would be great....LOL)

[@AskYourComputerGuy]

LOL they can't afford me..nor would I want the job haha. Thanks for the kind comment 👍

[@DJaquithFL]

I think the interesting issue was from this headline .. _"CrowdStrike Insiders Sold Stock Before the Outage. How That Happened"_

[@AskYourComputerGuy]

Interesting.........

[@DominicMazoch]

Sounds like an incident in the 1960's in Dallas. Or last weekend with a candidate for POTUS!

[@AskYourComputerGuy]

@DominicMazoch 🤷‍♂️

[@OPiguy35]

Insider sells are set up in advance, so an allegation that this is connected would require the said insider to be planning malicious intent some time out

[@samhavholm]

see your local congress rep for insider info!

[@MichaelGolpe]

Great explanation! Thanks!

[@AskYourComputerGuy]

I appreciate that 👍

[@brucestarr4438]

Talking about Y2K in the 90s I bought a simple custom DOS billing program for my small owner/operator trucking company. By 1999 the programmer had abandoned it and did not write an update for Y2K. It was a pain as the program did exactly what I needed without a bunch of extra fluff. Once the date hit 2000 it just stopped working. My wife, an accountant, made up a combo Word/Excel template to replace it, but it never was quite as easy to use.

[@AskYourComputerGuy]

That's sucks!

[@brucestarr4438]

@@AskYourComputerGuy it was such a simple little DOS program that it fit on a 1.44 floppy. But for dump truck owners like me, it did everything I needed for billing and nothing more. Oh well, I got 7 years out of it before Y2K.

[@AskYourComputerGuy]

@brucestarr4438 so there's that LOL

[@johnsantos2360]

GREATLY APPRECIATE THIS THANK YOU FOR YOUR EFFORT

[@AskYourComputerGuy]

You're very welcome!

[@buddy5088]

Fixed over 2000 pcs yesterday across my org. Booted into a command prompt and deleted the .sys file in \windows\system32\drivers\crowdstrike\C-0000029*.sys. Over and over and over again!

[@AskYourComputerGuy]

Daaaaang! Your fingers are gonna need a vacation!

[@MovesMcgee1]

I did the same. Around 1600. 😢

[@D.von.N]

LOL did you align them into one row? How long was the Q (ueue is silent).

[@mrbrock72]

Did you have to enter the BitLocker key and local admin password? That would be a pain especially since the admin pass should be complex and different on each machine!

[@AskYourComputerGuy]

@mrbrock72 the BitLocker key and the Windows password are two different animals. Once is for drive encryption, the other is for Windows "encryption". Once past BitLocker, you shouldn't have to enter a password to use the tools unless it's a Microsoft account vs a local account

[@fumble_brewski5410]

Running LMDE 6 on all my PC’s. “Life on earth is good…stability and contentment have been achieved.” (Beldar Conehead)

[@AskYourComputerGuy]

Thanks for the laugh - I needed that 👍

[@davinp]

A Washington DC TV station had several of their computers not working Friday morning, preventing them from doing their 4 AM newscast

[@AskYourComputerGuy]

Yep, lots of news stations had that issue 🥲

[@roland7584]

They weren't missed because other than this story, there really wasn't any local news to report, proving we don't really need those local stations daily. They should almost be on only during local emergencies or when real local news actually occurs rather than trying to find stories to report.

[@AskYourComputerGuy]

I agree! Make way for better television, 100%

[@nsbhagwat]

​@@AskYourComputerGuy why wasn't there a disaster recovery action in place for all these affected companies? BCM was optional IT excercise I guess.

[@scottjewell8694]

I've never heard what exactly happened. Was this a bug in the code or a botched deployment? It seems since it seemed to affect every machine, it must have been a botched deployment, otherwise it would have been caught in testing (i.e. not some sort of edge case). If it was a bug in the code, that would seem to indicate that it never was tested and therefore would indicate a major failure on CrowdStrike's part. You mentioned that the file was "corrupt". does this mean a bad deployment? I also noticed in your video describing how to fix the problem, the file size as displayed in file manager, showed a size of 0k, which also would indicate a botched deployment.

[@AskYourComputerGuy]

File was not verified in sandbox before release, causing Windows to throw up. Was going to use my wife's laptop (which was affected) but couldn't get past BitLocker (she's IT-managed), so I demonstrated on my personal PC with a dummy file named the same. Best I could do, and I think I explained it well enough. Good catch though!

[@kevinmcfarlane2752]

On the CrowdSite blog they said it was a logic error, but did not go into detail beyond that. But they did said they would post further updates.

[@dplj4428]

Would any of that corrupt file show up on sites like Amazon? Are servers use windows? and if so, can using a browser expose consumers to this problem?

[@AskYourComputerGuy]

Nope

[@Kallurisaiprakash]

Good explanation, It mean personal laptop don't effect.

[@AskYourComputerGuy]

Thank you

[@l.clevelandmajor9931]

On the day that that occurred, my computer was not even turned on. Because of my responsibilities at certain sites, CrowdStrike is in possible sitewide use, and might have affect my computer on that day, but that day I was doing other things that needed my attention. Thus I was not affected. Others associated with that site were affected.

[@RealmsOfThePossible]

Really smart idea to have such potential chaos hinged on such a small thing. You'd think being a security company they'd have contingency plans in place. Wonder what other global catastrophe is hanging by a screw?

[@AskYourComputerGuy]

Agreed!

[@pettyeddie2000]

I have been getting the “blue screen of death” off and on for a month now. I’m taking from what you’re saying is I’m screwed because my issue has nothing to do with CloudStrike ?

[@AskYourComputerGuy]

Not screwed, just need to figure out why it's doing that. Could be just a driver, easy fix. This should help: BSOD | troubleshoot & fix *ANY* Windows Blue Screen of Death kzbin.info/www/bejne/maGYopWogNd3g6c

[@A.S.K.1]

I started getting BSOD, at seemingly random times, quite often and very annoyingly - AFTER 'Nor Ton 360' did a *_forced_* "Upgrade - to make it easier to use". They wouldn't/couldn't even acknowledge a ticket, I 'tried' to raise about it, as their so-called "help" page is broken, as well. So: Even though I was paid up till the end of this year I dumped them and went with BitDefender. That was almost a month ago, and - touch wood - not one BSOD since... Proof? Maybe not - but it works for me.

[@LovinthatlifeL]

Mr Computer Guy! I have a question, I’ve tried different methods but all give me different answers. How can I check my laptop’s maximum ram capacity?

[@AskYourComputerGuy]

www.crucial.com/store/systemscanner Trusted by many for years 👍

[@LovinthatlifeL]

I’ve been told to use the command prompt but idk if it’s correct. It says it can be expanded to 16gb ram but I did a different method and I was told 8gb ram.

[@LovinthatlifeL]

@@AskYourComputerGuy thanks! I’ll look at it!

[@AskYourComputerGuy]

@LPW21 I've always trusted the Crucial scan. Or you can Google "motherboard make and model maximum memory" and probably get the same answers

[@AskYourComputerGuy]

@LPW21 ok!

[@LoneRanger-g1m]

I didnt have an issue on my hp comp but could this effect my tablet?

[@AskYourComputerGuy]

Doubtful. Unless your tablet is controlled by your company 👍

[@lifeisagift.cherisheverymoment]

Y2K... when a K (kilobyte) equals 1,024 bytes (some sources erroneously report a kilobyte as 1,000 bytes), we have not yet experienced the fullness of Y2K, 2,048. Concentrating too much influence, too much power, too many resources, too much wealth, too much of anything, under the control of a single entity is a recipe for disaster. Can you say... "The worst is yet to come"?

[@AskYourComputerGuy]

You're more right than you know

[@lifeisagift.cherisheverymoment]

This is what troubles me deeply, there are too many creating false narratives and too many listening to those false narratives without asking any questions and thinking for themselves. Thank you for your Channel and providing facts that are relevant and honest.

[@AskYourComputerGuy]

@lifeisagift.cherisheverymoment I sincerely appreciate that so much 👍

[@lifeisagift.cherisheverymoment]

👍

[@RonHelton]

This is why I hate automatic updates. I would rather wait to make sure they didn't corrupt some files.

[@AskYourComputerGuy]

This wasn't an automatic update. This was a core OS update. Most people never even see this happen behind the scenes. But Windows updates sucks also

[@DivergentDroid]

Tell me more about this over the air business - I use AME Wizard to strip windows updates functionally completely out of the system so I don't have to deal with such problems but you say these get delivered OTA? How can I make sure my PC does not have OTA update functionality enabled.. that obviously has to go. Of course I was not effected by this "update" but I want to future proof my system further from such things.

[@AskYourComputerGuy]

Built into the code, probably because of the arrangement Microsoft has with 3rd party vendors. You can probably strip it out using O&O Shutup, if you can identify it. It might be hard coded, so maybe not. I just don't know

[@DivergentDroid]

@@AskYourComputerGuy Thanks. If it wasn't for the PC games I play I'd have dropped Windows for Linux long ago.

[@NotMolly-jf2rh]

I think it was either a test-run or a study the enemy was supposed to notice.

[@AskYourComputerGuy]

👍

[@jonb3311]

Far too many companies using the exact same software means this will happen again. It's rumoured the Linux update from Crowdstrike updated seamlessly.

[@AskYourComputerGuy]

Heard the same

[@fr33s7yl0r]

Linux kernel by itself would not crash like this. Why are we still using windows for anything other than games?

[@AskYourComputerGuy]

@fr33s7yl0r because companies don't believe they can run an entire mega-conglomerate on Linux. Which is ironic when most of the world's servers run on a Linux backbone. I'm sure there's money involved. There's always money involved

[@kevinmcfarlane2752]

No problems with Linux and CrowdStrike this time, but there have been past problems on some systems, just not with a mass public profile. Saw this on Reddit and it’s also been mentioned in a few threads on YT.

[@DominicMazoch]

This whole thing sounds like STAR TREK: PICARD Season 3. The NCC 1701D could operate because it could not link to Star Fleet linked system!😊

[@AskYourComputerGuy]

"We've lost communication with StarFleet!". Yup LOL

[@Magnum-b2h]

hey uhm, my laptop has an empty slot for 2.5-inch sata 3 hdd (5400rpm), what would happen if i attach a 2.5-inch sata ssd to it (not hdd), does it work?

[@AskYourComputerGuy]

Absolutely

[@D.von.N]

Not familiar with Clownstrike, only what I briefly read online, but if they check the pre-booting process and hence need those privileges, isn't my HP surestart doing the same in that sense? It is the manufacturer's own process, checking the pre-booting process and immediately fixing it from its own encrypted copy if something went awry. Just HP and Windows on that machine. Why do others need a third party stuff on top, with those risky privileges? I also have non pro superantispyware, as a second opinion for health of the system (only ever finds adware cookies) but I don't think it has those privileges to break the entire system. I run it when I fancy.

[@AskYourComputerGuy]

Crowdstrike runs at boot level (similar to an AV boot scan). It's integrated into the Windows code to pull updates from Crowdstrike at initial boot. Most people have no idea it even existed....until now.

[@D.von.N]

@@AskYourComputerGuy so my HP Surestart runs even before the Clownstrike (if I had it)?

[@AskYourComputerGuy]

@D.von.N I believe if you hwve it, Crowdstrike runs first but I could be wrong

[@xprcloud]

Boot time driver loading unsigned files (cause signing was not a requirement ). what could possibly go wrong, CS is architecturally incorrectly designed.

[@AskYourComputerGuy]

Agreed

[@you166mhz]

two answers --- this is why I have only one win machine online -- Win7 ... second -- another access to the internet are my three raspberry pi 4 --(4 gig ea) ... only uses 5 watts ....

[@EXTREMOZAU]

Thenk you for making us the common peasant a bit more nolageble

[@AskYourComputerGuy]

You're welcome 👍

[@Magnum-b2h]

Ohh, I thought my computer gonna get a blue screen anytime soon so i just bought a pendrive and copied all my data to it.

[@AskYourComputerGuy]

Excellent!

[@TechnoEveryday]

BSD can't stuck in boot loop!

[@AskYourComputerGuy]

?

[@TechnoEveryday]

3:23 you said its blue screen of death and the pc continues to boot in a loop

[@AskYourComputerGuy]

Yes. It blue screens and then restarts to another blue screen. It's a boot loop.

[@AV8R654]

u need to close the windows for that not to happen, we cannot close the windows its too hot!

[@TechnoEveryday]

@@AskYourComputerGuy ok dear

[@NoEgg4u]

I believe that this was an attack, perhaps by a disgruntled CrowdStrike employee. Why? How could a company that services huge businesses, world-wide, and government agencies that provide life-saving services... how could CrowdStrike send out an update that brings them all down? Surely CrowdStrike's personnel test their updates, internally, before pushing them out to the world? Now it looks like they do no testing in-house. Or, someone did this intentionally. How would it look if, for example, Microsoft pushed out an untested update to the world, and brought down millions of computers? I cannot believe that somehow CrowdStrike's personnel just absentmindedly blasted out an untested update file. They never bothered to test it on a single, in-house, system of their own? It had to be a deliberate act. Note that the update file is not the culprit. There are two culprits. One culprit is CrowdStrike's device driver (it reads in the update file). That device driver runs within the kernel, at ring 0. More on that when we get to the other culprit. So that device driver does not do a sanity check. It just goes with any update file fed to it, and crosses its fingers (in a manner of speaking) that the files fed to it are proper. The update files are in user space (ring 1). Never should a ring 1 process have the ability to blow up a kernel process. And that is what happened. That brings us to culprit number 2, which is Microsoft. Microsoft's kernel team personnel had to sign off on CrowdStrike's device driver, because it is Microsoft's personnel that put CrowdStrike's device driver into Microsoft's kernel. So I imagine that there was some big butt chewing going on at Microsoft for allowing code with such a vulnerability. Someone at CrowdStrike knew about the vulnerability in the device driver. They knew that a bad update file (in this case, full of zeros) would cause the device driver to fail, and cause the kernel to halt the operating system (blue screen). So CrowdStrike created a device driver that was flawed, and Microsoft put that flawed device driver into their kernel. All of the above has revealed that every company, and every government agency, that stayed down for lengthy time periods... well, none of them had disaster recovery plans. None of them had backups. Before CrowdStrike broadcasted instructions on the fix, if those companies (and government agencies) would have restored their systems with yesterday's backup image, they would have been up and running. So either they are not doing backups, or they do not have personnel at the ready to make use of those backups. All of those companies, and all of those government agencies, lucked out. If that outage was a serious attack, such as system32 getting wiped out, or files getting encrypted, etc, then without backups, they would have been royally screwed. The above is why elections should not be at the mercy of computers for tallying up polling stations, and so on. Can you imagine if on election day, a similar incident would happen? Can you imagine the distrust in the election results, if it took another 24 hours, or longer, to fix everything and announce results? Can you imagine if an update was coded to "fix" the winner?

[@AskYourComputerGuy]

Interesting theories 👍🤷‍♂️

[@ThisBytesForYou]

Soooo many issues, but hey, we have jobs hahah, long nights though, we do need those beers though

[@AskYourComputerGuy]

Beers... or something stronger LOL

[@ThisBytesForYou]

@@AskYourComputerGuy let's get together sometime and we can discuss ;)

[@AskYourComputerGuy]

@ThisBytesForYou you bet, brother!

[@Probhia_ffx]

Cariminati entering the chat

[@AskYourComputerGuy]

Who is that?

[@Probhia_ffx]

@@AskYourComputerGuy @cariminati

[@kestutisbagusauskas8323]

I used my Chromebook all day no issues!

[@AskYourComputerGuy]

👍

[@stephenwilliams926]

Putin should have a word with Crowdstrike 😂

[@JohnWayne-xy1gs]

its alwasy a lone wolf but the stock markets does not lie.

[@standingbear998]

a test for what is coming in late october.

[@AskYourComputerGuy]

🤷‍♂️

[@MichaelBleck-t8f]

Halloween?

[@rickoshay6554]

Don't buy those IT guys a beer until they get all this fixed! Beer may be the reason they hit the colon key in the first place.

[@AskYourComputerGuy]

LOL maybe so

[@CrazyWhiteBoomer]

This is the FIX in case Kamala tanks in November.

[@AskYourComputerGuy]

🤷‍♂️

[@jimh472]

It's a shady company so not surprised. Corporate America outsourcing everything doesn't help.

[@AskYourComputerGuy]

I wasn't aware that they were shady. They support half of the Forbes 500 companies and have for a while. What makes you imply that?

[@fr33s7yl0r]

Lesson 1: use Linux for critical infra

[@AskYourComputerGuy]

Except for the 74% of the market that requires Windows. But yes, that would have saved a lot of headache for sure!

[@nsbhagwat]

​@@AskYourComputerGuy if apple releases itunes for linux, I will be 100% windows free. Can't say that for my work computer though.