Glitch in software update may have triggered global Microsoft-CrowdStrike outage: experts

Microsoft Azure outage caused by CrowdStrike Falcon agent bug check, impacting users globally, including flight operations and stock exchanges.

In the early hours (IST) of July 19, reports emerged that Microsoft’s Azure cloud service was facing an outage, affecting users in the Central U.S. area. Within the next few hours, the service outage spread like wildfire to several other countries, including India, disrupting flight operations and air traffic, brokerages and stock exchanges, and throwing digital lives of many out of gear.

The Indian Computer Emergency Response Team, CERT-In, has issued a severity rating of “Critical” for the incident.

Microsoft, while acknowledging the outage in a blog post noted that “Virtual Machines running Windows Client and Windows Server, running the CrowdStrike Falcon agent, may encounter a bug check”.

The tech giant estimated the approximate time of impact as early as 4.09 a.m. UTC (9.39 a.m. IST) on July 18, when this update started rolling out.

While Microsoft has not fully revealed what caused the outage on its cloud service, one incident seems to have triggered this cyber event — a glitch in the software update of CrowdStrike’s end point protection programme, Falcon Sensor.

Crowdstrike is a cybersecurity firm that deploys unified security programme to stop breaches in real time. The Falcon Sensor platform runs with high privileges and is built to protect endpoints (basically, any devices connected to a computer network). A mishap in this security platform can cause the operating system to crash, like what several users faced globally on July 19 with the Blue Screen of Death (BSOD). Once BSOD flashes on a user’s screen, they will be caught in a boot loop cycle, which simply means that they won’t be able to access their devices linked to CrowdStrike’s Falcon platform. This is because the security solution is deployed at the BIOS level.

BSOD is a warning that users see on their computer when the system interrupts operations and displays it on a blue screen. This is what many users saw today when they tried to access their affected devices during the outage.