Cybersecurity expert breaks down massive Microsoft outage

CBS Investigator Megan Hickey talks to a cybersecurity expert about Friday's massive Microsoft outage.
Kyle Hanslovan, CEO and founder of Huntress Security Platform, explains how this happened, who could be affected, and what else we need to be on the lookout for.
-----------------------------------------------------------------------------
CBS 2 News Chicago brings you breaking news, weather, compelling exclusive content and award-winning investigative reports from the CBS 2 Investigators.
Subscribe to CBS 2 News Chicago on KZbin : / cbschicago
CBS 2 NEWS 24/7 LIVESTREAM: www.cbsnews.co...
CBS 2 NEWS ON PLUTO TV: pluto.tv/en/li...
CBS 2 NEWS WEBSITE: www.cbsnews.co...
FACEBOOK: / cbschicago
X (TWITTER): / cbschicago
GET THE CBS 2 NEWS APP: apps.cbslocal....

[@CrabbyOldLady]

It's funny how every news outlet is calling in a Cybersecurity expert. Nobody is calling in a Change Management expert. It wasn't a cybersecurity problem, it was the most fundamental failure of Change Management.

[@Bianchioltr1885]

As a cybersecurity analyst, I disagree. This isn't a change management problem; it's a fundamental policy issue. Since when is it typical for large companies to update without proper testing? This is the root cause from my perspective. If they had tested the update before applying it or using auto-update, this issue would never have occurred in the first place. Any organization that experienced an outage likely has either inadequate testing or poor security policies. If there's no option to disable auto-updates, then there's a policy problem as well. In my opinion, CrowdStrike failed significantly in their testing. Additionally, every company affected by this either has poor testing procedures or deficient policies.

[@CrabbyOldLady]

@@Bianchioltr1885 In other words, you don't have any knowledge of the specific situation. Let me explain it to you. This isn't the kind of periodic functional update that people are used to thinking of, where updates might come out a few times a month. The Crowdstrike Falcon software is an endpoint protection suite. It uses software sensors to monitor activity and traffic on the host computer. These sensors are governed by configuration files, which Crowdstrike calls Channel Files. These Channel Files are updated in response to novel activity, processes, and procedures discovered by Crowdstrike through its constant monitoring. How often are the Channel Files updated? Several times per day, each and every day, 24/7/365. The entire point of spending the money to implement the Falcon software on your system is to get that bleeding edge level of protection through those constant updates. It's utter nonsense to say that you should turn off automatic updates on the Falcon software, because the whole point of the software is to get the automatic updates every few hours. If you don't want to do that because of the risk, you simply don't buy the Falcon software. You use a different cybersecurity suite. The Change Management issue occurs at Crowdstrike. They have obviously decided that these are routine updates that do not require the same level of testing before being pushed out. There needs to be a major change in their governance structure to ensure that any and all changes must be more rigorous testing AND review and approval, even if it means a delay in the rollout.

[@robertmetzger6467]

@@Bianchioltr1885 You Tell Em !!

[@dougthomson5544]

This just proves how insanely vulnerable we are to computer technology.

[@happymouse8426]

Well said! I've always advocated to keep paper, pencil, calendar, calculator, dictionary, etc. in the house, and lock your credit with credit companys.

[@BSnicks]

@@dougthomson5544 Only when the secret agencies are allowed to add backdoors to our system.

[@travisgoesthere]

You , not we. I have no use of microsoft or apple products

[@happymouse8426]

@@travisgoesthere You have a great point for individuals. Do you use Linux and how is that? I think I may look into that. However, remember our retail, banks, airports, government does use Microsoft products. That's why I keep a close eye on the tech I do use. I can speak to what happened to me. The state of Colorado lost my info in 2022 and a grocery store pharmacy lost my info also in 2022. I had to lock all my info down but I should have done that sooner. I was lucky. Some people I know were not.

[@dougthomson5544]

@@travisgoesthere I don’t know where you are going, Travisgoesthere, but this has nothing to do with what OS “you” are using, pal. You are being a tiny bit smug here. Using Linux (or any of the 10 or 12 readily available OS options) doesn’t matter one hoot in hell. You are absolutely as vulnerable as any other entity on the internet because you use the internet (obviously). In short, it matters what airline uses, or the bank, or the whatever service you want to access. Of course, neither are you personally secure because Linux (or whatever) has its own library of vulnerabilities.

[@protekjv82]

they release an update without testing

[@diaryofatrophywife]

and wrote the update with chatgpt... ahahaha

[@frankm7707]

Yeah they did. In the last 48 hours and continuing.

[@ottomanstamper7609]

They are taking a leaf out of the microsoft playbook ie don't bother with testing because your customewrs are your unpaid testers!

[@dirkdiggler2379]

Also, you never update on a Friday.. you update on a Tuesday!

[@thewolf2280]

not only release but also force an update

[@mattmalyj7964]

New name of company should be called damn I.T😅😂

[@saecula2391]

they send the update to ALL CrowdStrike-Clients in the world ... instead of testing it on 3 clients, then 30 and so on ... CrowdStrike is dead now

[@Bonjour-World]

The message seen just before the 'Blue Screen of Death': "Please do not turn off your computer. Your system is being updated".

[@ChrisLuton]

Why do people keep calling this a Microsoft outage? 🙄

[@gibbogle]

Because only computers running MS Windows are affected.

[@iddybiddyegg1]

This is because the vast majority of businesses and corporations use Windows for their business computers. Mainly client devices. Since it was businesses that were affected, it is reported as an issue affecting MS Windows.

[@cstoomey]

They don't know what powers their computers

[@projectcontractors]

Microsoft's legendary 'blue screen' of death strikes again.

[@d3po607]

yep except now the whole world knows about it not just gamers lol.

[@nicktrump]

@@d3po607 bill gates will fix it 😅 😂

[@_JohnHammond]

Way to go Kyle!!

[@lynnjr457]

I am not a fan of Microsoft at all, but how about we start off by fixing the headline. Should be "Cybersecurity expert breaks down massive CrowdStrike update failure that is Blue Screening Microsoft Operating Systems".

[@RaymondHng]

That exceeds the 100-character limit for KZbin titles.

[@joesterling4299]

You can get things wrong? To this degree only if you didn't do any meaningful testing *at all* beforehand. The update instantly bricked many systems. That would have become immediately obvious in a representative testing environment.

[@Dee-iq5zz]

@@joesterling4299 purposely done

[@CrabbyOldLady]

That's the mind boggling thing. It should have failed instantly in any proper testing environment. I wonder if they simply tested it on one and only one platform. Did they say "it works fine on Apple (or this or that Linux distro) so we're good to go"?

[@Pedro-ev3if]

100000% none of this adds up

[@amjads8971]

Honestly fedup of incompetent CISOs in Orgs failing and how security companies are monopolizing the IT market

[@robw7676]

"I want to reassure the board that our information is still secure, so secure in fact that we can't currently get to it"

[@dougthomson5544]

We have made our world so vulnerable that it is truly frightening … one small glitch and this results … and the malicious hackers are watching and salivating. Oh joy.

[@travisgoesthere]

lol Its your own fault for being connected to Microsoft products.

[@dougthomson5544]

@@travisgoesthere Hey, Travis, you are connected to Microsoft products right now. Methinks you really don’t know what you are talking about, young man.

[@luweybeatz]

The discussion should be around how did this happen. How did they not test properly.

[@jonm7547]

It is amazing how every ‘expert’ tries to downplay this catastrophe ! Who is going to pay all these millions of people who suffered?

[@CrabbyOldLady]

Dude, you don't have to say "Me too, I'm affected." The whole world already knows who's affected, because ..... drum roll ..... they're affected, and their systems have crashed. That's as public as it gets.

[@Melissa-kv1je]

Spot on regarding long term. I see it as an unintentional insider threat.

[@soeminn08]

Good job on explaining regarding threat actors

[@alldog222]

It was a Windows 95 update.

[@SuperHongkongphooey]

have you tried switching it off n on again

[@gibbogle]

You go into a "blue screen" loop, until you start in Safe Mode and delete the offending files.

[@7415_Gamer]

Good explanation.

[@Xanduur]

Mac OS and Linux in our home. Still terrible.

[@travisgoesthere]

Linux here , no Issues

[@b_f8852]

No problem everyone, it's just an "issue".

[@hotmic5051]

How do we know these reports of a buggy update isn't just a way to save face ?

[@thatguyiguess2694]

because tell me what bricking computers would gain you?

[@hotmic5051]

@@thatguyiguess2694 - telegraph the resolution fix to make a better killer next round. -show backdoors while system is down and or focus is elsewhere - give access and hold it until next system down - sell info of how it was done to other companies or agencies that absolutely will use this in reverse on other countries or places or isolated situations - create future isolated situations when infrastructure is needed

[@rahulroy-yt3wh]

Dear Kyle Hanslovan, you are no cyber security expert! You have not been able to explain how this happened

[@djpatho]

Why’s the hosts audio worse than the guys being interviewed 😅😅😅😅 Amateur hour on all fronts. Welcome to the world of grown children just winging it and working it out 😂😂😂😂 We’re doomed

[@guyb6665]

Crowd strike bricked the usual mic 🎤

[@Abaddon231]

I code games and other sofware just as a hobby , ive made rpg games for my family and other software.. But i have NEVER given them software or updates that i havent tested thoroughly on my own machines .. Id much rather get it right , then get a call from my family asking me to fix thier computers ..

[@Pimpjit85]

"Blue Microsoft screens" makes me feel old 😂 ... it's blue screen of death , lady!

[@j13nkz]

This didn't happen to me?

[@darkenlight22]

That's exactly right when you're trying to write an exploit you're not trying to write it to get by all security you generally targeting the most likely security someone has to increase your odds of getting more bang for your buck. That's why sometimes using a lesser known security measure is actually better.

[@tidy]

This is just another reason NOT to apply patches immediately. More testing needs to be done before its released.

[@Anonymous1038HI]

How are DMV services ?

[@musicman0423]

This is insane to me. I’m getting annoyed with all these tech people sugar coating their answers and talking like their voice actors for a Disney movie. This seems more like an attack than a bad update. Give me a break. Why give one company so much power? Good god

[@nickfry7839]

computer crash not an error. crimes needed deleted. airplane maker, stock company. chaos is cover.

[@huudang3419]

this is a good example when people try to use the AI Software to replace human!

[@travisgoesthere]

Thats not what happened , Gomer and i guarantee that you really have no clue about code of any sort . No need to be talking as if you have a clue

[@dlittle6student]

I enjoyed this interview. Informative, well-rounded, and entertaining

[@brianebarb6114]

Who let the intern push code straight to production?? Lol

[@zigzoog123]

should microsoft compensate for the losses

[@TheWelshyTerrior-jb5hc]

Reasons Mac is just better 😂

[@cbd8846]

That made me love Apple even more.

[@cstoomey]

Great interview and good speaker

[@RB-wu4us]

Mr. Expert, You are incorrect

[@whendarknessfalls6969]

There are no experts, only amateur learning they know nothing

[@AAhmed79]

largest organization and how much fragile they are!!!! really alarming for users.

[@GruneD]

Crowdstrike, Strikeout 😅🎉

[@silverwolf6866]

Protip: You test an update before pushing it out to the public. one security specialist DEI hire licking the nuts of another. Anyone using this company should not be surprised when they take down your systems too.

[@lifeisbeautiful7452]

Stop being racist.

[@AyeSeeVeeTV]

G Take it EAZY

[@HabibsPing]

Crowdstrike has a checkered past, remember.

[@handpowers]

Is he AI? Coz he has stiches on his face.😂

[@Manuel-kp1kp]

Globally ? 🤔

[@NeelsLotter]

How do we know it was not a hack, so naive believing everything

[@thatguyiguess2694]

because a hack to brick systems is not a very useful hack considering the computer and thus everything on is not able to be accessed

[@nickfry7839]

computer crash not an error. crimes needed deleted. airplane maker, stock company. chaos is cover.

[@gibbogle]

@@thatguyiguess2694 Sure, but that assumes that an attack is made to steal data, rather than create chaos. It is well known that certain Russian actors are interested in creating chaos in some countries. But I think incompetence is the explanation in this case, not malice. There is always the possibility of an employee with a grudge, but it seems very unlikely.

[@thatguyiguess2694]

@@nickfry7839 but you can’t even access the computer, there’s nothing to delete because you can’t do anything on the system

[@bobtarmac1828]

This will get worse. Can we cease Ai?

[@Lacerated1DJ3]

the USA banned the best Security suite in the world, Kaspersky, and now the security company they let take over, CrowdStrike, has dropped the ball and sent out a BAD update. #Karma

[@gibbogle]

Yeah, let the Russians take care of system security.

[@Lacerated1DJ3]

@@gibbogle and how many years in IT do you have? Do you even know who Kaspersky is or the History? Wait no you just prefer the dumpster fire we have now.

[@gibbogle]

@@Lacerated1DJ3 I have been working with computers for about 50 years.

[@Lacerated1DJ3]

@@gibbogle Did you then forget in your old age that Kaspersky relocated from Russia to Switzerland! And it is still the best in the business

[@frankyhonnolus5528]

Poor CEO. Because of incompetent employee or yees, he’s running around with hair on fire trying to explain things.😂

[@D3Sshooter]

Don't lock yourself in Micro Soft..... Its amazig that such an update can bring down so many users and systems.. Especially a third party application that brings down MS... `its not the first time and it will not be last time' . Just stay out of the public cloud for mission critical systems, get it back on prem...and close the system from the outside.

[@ZBirDEveryday]

Luca Doncic the computer wizard

[@RB-wu4us]

Give me access I'll prove it!!!

[@derek04151]

Return of the BSOD.

[@NoManClatuer-pd8ck]

If you believe MS word for word you should update your ID10T security protocols.

[@adriancamano777]

Fortunately we have intelligent people working on the problem

[@Jrad117]

Well at least it’s not the Red Ring of Death 💀

[@Creativzznation]

Outage or hacked ?

[@lucian5304]

Damn I miss the 80s and 90s didn't have these kinda issues

[@gibbogle]

The good old days of DOS. Computers were so simple then :)

[@HenryLahorra-s1w]

Everything has been made to make you suffer!!!

[@CallousCoder]

Unforgivable inept blunder, that should've and could've been prevented! But also unforgivable is the fact that all their users, obviously don't have any manual back up processes in place for when tech goes down! Something that in the 90s we always were aware of and planned for and tested for! "What if something goes down!" In one company I had worked for, I had complained that their datacenter was on the ground floor in a corner of the building that could be broken into because there was a dead curve out of sight of the world (also a rather sharp curve that led to something I hadn't even though of). We had a manual process day, the month before I had to do a critical migration, just in case stuff didn't go ontime or well. All went well a few tiny hiccups like a printer here or there that didn't work but the staff were skilled to choose other printers. A year later I resigned and a few months later I heard that a truck had drove into the data center (the weak point I had identified) and literally pulled the two 19" racks straight our of the floor causing unrecoverable damage. So they had to work 2 weeks manually. They called me to help out, we knew the critical systems so we focused getting those up. We procured new stuff set it up, all the while the business with it's 600 shops kept running. Not as efficient as usual but kept running. Even banks don't do that anymore! It's scary!

[@gibbogle]

How do you have a backup process when all your computers are disabled?

[@CallousCoder]

@@gibbogle backup process as in a manual process! Get the typewriters out, get the carbon paper, do it by hand, in such away the data can be entered easily later on but that at least critical processes keep going, albeit slower. Not backup as in tape storage. I worked in healthcare for each product we as a hardware/software house developed a manual backup process also developed and documented. A backup process, that if the customer used it in that way, that we could even help entering that data again after recovery. OCR on well established empty paper forms (that were part of our documentation). So we had manually treatment cards that you could photocopy and write down the treatments done on a person during that day. We had the ability to schedule hard copy of all meds and treatments that a patient got (just list of treatment IDs and medics and patient ids). You could print your patient detail cards so you would know their name and states. When adaptive medicine pumps would fail we had the old mechanical wind up pumps as backup that worked as well (we still had a factory produce them too and always some in stock), you just had to do a blood test, that another befriended company made special enzymes for to test without digital equipment. And based on the values the nurse or patient could change the drip rate. So not as adaptive and accurate but enough to keep people depending on a constant supply of meds going. With the idea of when there’s a of power outage or worse EMP from a nuke attack. That these people would still get their treatment. Specialized emergency medicine storage is (or perhaps was - seeing how inept governments have become) that have backup treatments ready in case of shortages. So for every electronic critical process should be an analogue back up progress in place. So the critical processes keep going albeit slower. But planes not flying because computers are down, hospitals not treating people because computers are down, is just unacceptable and shows poor management! A mere 40 years ago most processes weren’t even automated and now we can’t do the simplest things without a computer. That’s just not right! Especially since I now how precarious our grid is after having worked 8 years in the energy business. And how that green energy transition madness will cause problems in the grid. At the very least more frequent power dips and Munro hour power outages, but perhaps even brown outs for several days.

[@jonm7547]

How is this better than a malware attack? ‘Hindering productivity’ ??? This guy must be joking!

[@frankm7707]

No regression testing is the most common problem

[@robw7676]

It isn't really a regression test failure if it made the whole OS flop. If I was a betting man, my money would be on this only impacting a certain version of Windows it is supposed to support but wasn't specifically tested on - I.e. they tested on Windows 11, but it crashed Windows 10.

[@siocdenarf1010]

Not Micro$oft fault ...

[@joannegeorgiades1593]

My phone has a horrible virus n is unusable...fairly new 🥺 then i install anti virus apps n they want money i dt have yet

[@joannegeorgiades1593]

Maybe I will call best buy

[@justinbreedlove8835]

The power to my apartment went out last night and is still out of power so I'm confused if it's just a coincidence that the power went out exactly when this happened or does the power company use Microsoft or something? Cuz it's only in certain areas in Orange county California that the power is out in apartments

[@willnadauld]

This is a door wide open situation going forward. Any bad actors coming to fix this can install whatever they want

[@qballoswald9141]

China or Russian?

[@ashleybraim]

Finally the computer program we live in is crashing

[@travisgoesthere]

We dont live in Windows

[@dougthomson5544]

@@travisgoesthere Travis, once again you prove you don’t know what you are talking about. Try reading it again and think about some Science Fiction stories. Now extend those thoughts to the world we live in. Are you getting a hint about what @ashleybraim is alluding?

[@MatthewDwyer2367]

Yahtzee LLSH

[@87697]

Blue Friday

[@Bonjour-World]

"The only way to fix 'Windows Update' is to get rid of Microsoft Windows" !!!

[@gibbogle]

It wasn't a Windows update, it was a Crowdstrike update. You or I can easily switch to Linux, but it would not be an easy switch for most of the organisations affected by this.

[@Driver2724]

What is talking already 12 billion lost

[@MatthewDwyer2367]

#snowday

[@MediaManagementAndPublishing]

So we hacked ourselves

[@nickfry7839]

computer crash not an error. crimes needed deleted. airplane maker, stock company. chaos is cover.

[@MediaManagementAndPublishing]

@@nickfry7839 amazing points

[@comensky]

🎯 Key points for quick navigation: 00:52 *🚨 Impact of a small software update* A small software update from CrowdStrike caused widespread outages across Microsoft systems, affecting laptops, servers, and devices using Windows. 01:46 *🔍 CrowdStrike's role in cybersecurity* CrowdStrike provides advanced endpoint protection beyond traditional antivirus, focusing on detecting hacker behaviors rather than static patterns. 03:22 *🔐 Understanding non-malicious incidents* The Microsoft outage, caused by a software glitch from CrowdStrike, is not a cybersecurity breach but highlights vulnerabilities in IT infrastructure. Made with HARPA AI

[@ducksamok1716]

Stop using windows

[@pgpleroux]

Using a PC (personal computer) in a business is like using star lights in a powder factory. Upgrade to a BC (business computer = Linux)

[@gibbogle]

In some cases an organisation will have 100s of employees using Windows PCs. They would all need to be retrained.

[@pgpleroux]

@@gibbogleWhy? The keyboard and mouse work the same?

[@gibbogle]

@@pgpleroux Different software - or am I behind the times? I was using Linux about 20 years ago.

[@pgpleroux]

@@gibbogle Are you still using Linux? A few years ago I upgraded a government field office to Linux without telling users. Their comment to the "Windows upgrade" was "it looks different, but it is much faster". After a user's son told her "it is not windows" users started complaining...

[@gibbogle]

@@pgpleroux I no longer use Linux at home, but I make extensive use of a site with many hundreds of processors running Linux.

[@ZERO-CAPACITANCE]

Single women…

[@xmj6830]

🤣...I though the same but most unlikely. In real, she just met a better match...

[@ZERO-CAPACITANCE]

I meant the flirting

[@swiftuiforever]

BSOD

[@prostytroll]

After this I like electronic money even more... 'sarcasm'

[@dontplayformenero]

@@prostytroll why? You couldn't access it if there was an outage in the least. You'd be better off having chickens to barter 😆

[@6risk9]

If ever the saying Cash is King it makes more sense than ever today!

[@6risk9]

@@dontplayformenero why do you think gold and silver is so expensive now It's will be more easier to barter than with chickens 😁

[@travisgoesthere]

@@6risk9 You arent too bright are you lol?

[@prostytroll]

sarcasm, sarcasm, people...