by Juli Clover
Last Friday, a major CrowdStrike outage impacted PCs running Microsoft Windows, causing worldwide issues affecting airlines, retailers, banks, hospitals, rail networks, and more. Computers were stuck in continuous recovery loops, rendering them unusable.
The failure was caused by an update to the CrowdStrike Falcon antivirus software that auto-installed on Windows 10 PCs, but Mac and Linux machines were not affected even though they received the same software. A report from The Wall Street Journal delves into what happened and includes some critical information from Microsoft on why Macs did not get taken out by the update.
On Windows machines, CrowdStrike’s Falcon security software is a kernel module, which gives the software full access to a PC. The kernel manages memory, processes, files, and devices, and it’s basically the heart of the operating system. Much of the software on a PC is typically limited to user mode, where bad code can’t cause harm, but software with kernel mode access can cause catastrophic total machine failures, like what was encountered last week.
The Falcon software was not able to wreak similar havoc on Macs because Apple does not give software makers kernel access. In macOS Catalina, which came out in 2019, Apple deprecated kernel extensions and transitioned to system extensions that run in a user space instead of at a kernel level. The change made Macs more stable and more secure, adding protection against unstable software updates like the one CrowdStrike pushed out. It is not possible for Macs to have a similar failure because of the change that Apple made.
In a statement to The Wall Street Journal, Microsoft blamed the European Commission for an inability to offer the same protections that Macs have. Microsoft said that it is unable to wall off its operating system because of an “understanding” with the European Commission. Back in 2009, Microsoft agreed to interoperability rules that provide third-party security apps with the same level of access to Windows that Microsoft gets. Microsoft agreed to provide kernel access in order to resolve multiple longstanding competition law issues in Europe.
Apple has not been forced to make changes to how Macs work, but the European Commission has been targeting the closed nature of iOS, and Apple has warned that the updates that have already been implemented could lead to security risks in the future. The European Union’s Digital Markets Act has pushed Apple to allow developers to offer apps through third-party marketplaces and websites. Apple says explicitly that the DMA compromises its ability to “detect, prevent, and take action against malicious apps.”
The major CrowdStrike failure that affected Windows PCs highlights some of the unintended consequences and the tradeoffs inherent in legislation that weakens security in the name of open access. CrowdStrike’s simple software update impacted global infrastructure, bringing travel, commerce, and healthcare to a standstill.
Microsoft does not seem to have a way to stop a recurrence because it can’t cut off kernel access. The company says that significant incidents “are infrequent” and that less than one percent of all Windows machines were impacted. CrowdStrike says that it is “deeply sorry for the inconvenience and disruption,” and that in the future, it will share the steps that it is taking to prevent a similar situation.
Popular Stories
iPhone SE 4 Rumored to Use Same Rear Chassis as iPhone 16
Apple will adopt the same rear chassis manufacturing process for the iPhone SE 4 that it is using for the upcoming standard iPhone 16, claims a new rumor coming out of China. According to the Weibo-based leaker “Fixed Focus Digital,” the backplate manufacturing process for the iPhone SE 4 is “exactly the same” as the standard model in Apple’s upcoming iPhone 16 lineup, which is expected to…
iPhone 16 Series Is Just Two Months Away: Everything We Know
Apple typically releases its new iPhone series around mid-September, which means we are about two months out from the launch of the iPhone 16. Like the iPhone 15 series, this year’s lineup is expected to stick with four models – iPhone 16, iPhone 16 Plus, iPhone 16 Pro, and iPhone 16 Pro Max – although there are plenty of design differences and new features to take into account. To bring …
Crowdstrike Says Global IT Outage Impacting Windows PCs, But Mac and Linux Hosts Not Affected
A widespread system failure is currently affecting numerous Windows devices globally, causing critical boot failures across various industries, including banks, rail networks, airlines, retailers, broadcasters, healthcare, and many more sectors. The issue, manifesting as a Blue Screen of Death (BSOD), is preventing computers from starting up properly and forcing them into continuous recovery…
Cellebrite Unable to Unlock iPhones on iOS 17.4 or Later, Leak Reveals
Thursday July 18, 2024 4:18 am PDT by Tim Hardwick
Israel-based mobile forensics company Cellebrite is unable to unlock iPhones running iOS 17.4 or later, according to leaked documents verified by 404 Media. The documents provide a rare glimpse into the capabilities of the company’s mobile forensics tools and highlight the ongoing security improvements in Apple’s latest devices. The leaked “Cellebrite iOS Support Matrix” obtained by 404 Media…
2024 Apple Watch Lineup: Key Changes We’re Expecting
Apple is seemingly planning a rework of the Apple Watch lineup for 2024, according to a range of reports from over the past year. Here’s everything we know so far. Apple is expected to continue to offer three different Apple Watch models in five casing sizes, but the various display sizes will allegedly grow by up to 12% and the casings will get taller. Based on all of the latest rumors,…
TinyPod Turns Your Apple Watch Into an iPod
Wednesday July 17, 2024 3:18 pm PDT by Juli Clover
If you have an old Apple Watch and you’re not sure what to do with it, a new product called TinyPod might be the answer. Priced at $79, the TinyPod is a silicone case with a built-in scroll wheel that houses the Apple Watch chassis. When an Apple Watch is placed inside the TinyPod, the click wheel on the case is able to be used to scroll through the Apple Watch interface. The feature works…
