Matthew RosenquistFounder & CISO Advisor, Cybersecurity Insights · CISO, Cybersecurity Strategist, & Industry Advisor

How CrowdStrike Broke Millions of Windows Systems

24 Jul 2024 · 1 min

Watch on YouTube

0:57

In this segment of the video, the narrator explains that a flawed software update, once installed, performed privileged operations deep within the Windows operating system. These improper actions triggered a critical condition that Windows detected, causing the system to invoke its traditional fail‑safe response: the Blue Screen of Death (BSOD). The speaker contextualises the BSOD as a legacy mechanism from early Windows versions, designed to halt the system and protect data when a misbehaving program was detected. While this approach was appropriate two decades ago given hardware and software constraints, the narrator argues that the architecture has not evolved to match the sophistication of modern attackers, making the BSOD an outdated defensive measure in today’s threat landscape.

Chapters

The flawed update, once uploaded and employed by the system, basically began doing some privileged things. And remember, it has deep access to the system. And these things weren't proper, which caused a critical condition that was detected by the operating system. For such critical conditions, the standard response for Windows is to halt all functions and display that dreaded blue screen of death, or the BSOD. The BSOD is a throwback to one of the early versions of Windows, and the thinking at the time was that if a program was doing something really naughty, the system should fail safe to protect the data and stop the harmful activities. That was great 20 years ago. It was all we could really do given the limitations in hardware and software, but that architecture has never really evolved the way it needed to. Remember, attackers have rapidly evolved, but the BSOD has largely remained the same.