2024.07.21. The Fair Economy — A security product from information security solutions company CrowdStrike caused a conflict with Microsoft Windows OS during an update process. This led to the shutdown of various major systems worldwide, resulting in diverse damages. Information security experts have proposed measures to prevent similar incidents, including adopting hardware-level remote control solutions that are independent of the OS and conducting sufficient testing before updates.
On the 19th, while CrowdStrike was updating its Falcon Sensor product, one of its cloud-based solutions, some files of the product caused a conflict with Windows OS.
The Falcon Sensor, which triggered the incident, is an Endpoint Detection and Response (EDR) product responsible for blocking attacks on Windows OS connected to the cloud while capturing and recording activities to quickly detect threats.
The Windows OS-based systems affected displayed a "Blue Screen"—the screen that appears when a system crashes due to a fatal error—and then shut down abnormally. As a result, worldwide Windows OS-based systems malfunctioned, causing service disruptions in various industries such as transportation, healthcare, logistics, finance, and IT.
George Kurtz, CEO of CrowdStrike, said on X (formerly Twitter) regarding the incident, "A defect occurred in a content update for hosts using MS Windows. This is not a security incident or a cyberattack." Later, in a conversation with NBC, he said, "We deeply apologize to everyone affected by the incident. We are working with customers to restore services."
The Korean government immediately began assessing the situation and preparing response measures after the incident occurred.
The Ministry of Science and ICT announced that it is working with Microsoft Korea to determine the exact cause of the domestic cloud service outage and assess the extent of local damage.
Additionally, as Crowd Strike software was identified as the primary cause of the outage, the Ministry of Science and ICT, together with the Korea Internet & Security Agency (KISA), formed an emergency response team to address the Windows OS Blue Screen issue and launched an urgent response.
The Ministry of Science and ICT and Kisa have posted emergency measures on the Kisa website (www.boho.or.kr) to delete the problematic update files, and are strengthening monitoring for potential cyberattacks related to the incident.
Damage has been confirmed at 10 domestic companies, which are currently restoring or have completed restoring their systems. None of the 26 major telecommunications carriers, which are obligated to report disaster outages under the Basic Act on Broadcasting and Communications Development, reported damage from this incident.
Major telecommunications carriers include 11 basic telecommunications carriers such as SKT, KT, and LGU+, seven value-added telecommunications carriers such as Naver, Kakao, and Google, and eight data center operators such as SKB and NAVER Cloud.
Information security experts emphasized the need to develop rapid recovery measures for this incident. They also warned that similar incidents could occur in environments that do not use the cloud, and stressed the importance of preventing this event from leading to "cloud distrust".
Lee Jin, director of the Cyber Security Research Institute, said, "The issue with this incident is that each system displaying a Blue Screen error must be booted into safe mode and manually recovered either directly on-site or via remote console." He added, "It has been a reminder of the significant value of hardware-level remote control solutions such as IPMI or vPro that IT equipment companies, including server manufacturers, have implemented."
Subsequently, regarding the fact that major public administrative services and critical infrastructure in Korea did not suffer significant damage, he analyzed, "Most major infrastructure operates on internal networks and receives updates irregularly through its own update servers, so the lack of real-time updates, which caused this incident, had limited impact." He also evaluated that many institutions have adopted a practice of applying updates in a test environment that closely resembles actual operational systems, assessing the impact before deployment, based on prior experiences with similar issues when using domestic security solutions.
Lee Jin stated, "It would be irrational to avoid adopting cloud-based EDR solutions due to this incident," expressing a negative stance on the incident being used as a basis for cloud distrust.
He said, "Through this incident, both suppliers and customers have come to realize that sufficient testing must be conducted before applying updates, and if hardware-based remote management solutions become more widely adopted, it could be a silver lining."
He added, "The result of one company's mistake showed a pattern perfectly identical to the outcome of a supply chain attack," evaluating it as "a case that will be studied as an example of the destructive results of supply chain attacks, which have been discussed internationally in academia, government, and industry."
The head of a domestic cyber security solutions company also stated in a phone interview, "The problem with cloud-based information security solutions should not lead to distrust of the entire cloud. Such problems can easily occur in self-built (on-premises) systems as well. The important point is that if we cannot prevent all problems in advance, we must recover quickly when an incident occurs."
As a measure to prevent recurrence of this incident, he said, "Since institutions and companies configure and operate various systems tailored to their purposes, it is necessary to adopt solutions that strengthen the resilience of each system."
0 Comments
No comments yet.