Cybersecurity firm CrowdStrike is facing a lawsuit from its shareholders following a faulty software update that crashed over eight million computers worldwide, causing significant disruption. The lawsuit, filed in federal court in Austin, Texas, alleges that CrowdStrike made “false and misleading” statements about its software testing processes.
According to the suit, CrowdStrike’s share price plummeted by 32% in the 12 days following the incident, resulting in a $25 billion (£14.5 billion) loss in market value. Shareholders claim that the company’s executives misled investors about the adequacy of their software testing, pointing to a statement from CEO George Kurtz in March, asserting that the software was “validated, tested and certified.”
CrowdStrike denies the allegations and has announced its intention to vigorously defend itself against the proposed class-action lawsuit. “We believe this case lacks merit,” a company spokesperson told BBC News.
The global IT outage, which began on July 19, has now been resolved. CrowdStrike reported that as of 5 p.m. local time on Monday, July 29 (00:00 GMT, Tuesday), the affected computers were effectively back to normal.
The lawsuit seeks unspecified compensation for investors who held CrowdStrike shares between November 29 and July 29. It alleges that CrowdStrike executives defrauded investors by falsely assuring them about the robustness of their software updates.
The disruption caused by the outage was widespread, impacting businesses and services globally, including airlines, banks, and hospitals. In an interview with CNBC, Delta Air Lines CEO Ed Bastian stated that the outage cost the airline $500 million in lost revenue and passenger compensation. Delta has reportedly hired a prominent lawyer and is preparing to seek compensation from CrowdStrike.
In a detailed review of the incident, CrowdStrike identified a “bug” in a system designed to ensure the proper functioning of software updates. The company acknowledged that the glitch allowed “problematic content data” in a file to go undetected. CrowdStrike has stated that it will implement better software testing and more stringent checks to prevent a recurrence of the incident.
CrowdStrike has released a detailed post-incident review of the faulty update that crippled 8.5 million Windows machines last week. The cybersecurity firm identified a bug in its test software that failed to properly validate a content update, which was subsequently distributed to millions of systems on Friday. In response, CrowdStrike has pledged to enhance its content update testing, improve error handling, and implement staggered deployments to prevent similar incidents in the future.
CrowdStrike’s Falcon software, widely used by businesses globally to protect against malware and security breaches, experienced a major issue when a routine content configuration update led to Windows crashes. The problematic update was intended to “gather telemetry on possible novel threat techniques” but instead caused widespread system failures.
The company typically issues configuration updates in two forms: Sensor Content updates, which directly update the Falcon sensor at the kernel level, and Rapid Response Content updates, which modify the sensor’s behavior to detect malware. The trouble stemmed from a small 40KB Rapid Response Content file.
These updates usually bypass the cloud, incorporating AI and machine learning models to enhance long-term detection capabilities. One such capability, Template Types, configures new detection methods, and is updated via Rapid Response Content like the one issued last Friday.
CrowdStrike manages its own cloud system to validate content before release, aiming to prevent incidents like Friday’s crash. However, a bug in the Content Validator allowed one of two Template Instances to pass validation despite containing flawed data.
While CrowdStrike conducts both automated and manual testing on Sensor Content and Template Types, it appears that the Rapid Response Content update on Friday did not undergo the same rigorous testing. Trust in the Content Validator’s checks led to the assumption that the Rapid Response Content rollout would be issue-free. This assumption proved costly when the sensor loaded the problematic content, triggering an out-of-bounds memory exception and causing Windows systems to crash with a Blue Screen of Death (BSOD).
To avoid future incidents, CrowdStrike has committed to enhancing its Rapid Response Content testing procedures. This will include local developer testing, content update and rollback testing, along with stress testing, fuzzing, and fault injection. Stability and content interface testing will also be applied to Rapid Response Content.
Additionally, CrowdStrike will update its cloud-based Content Validator to better scrutinize Rapid Response Content releases, incorporating new checks to prevent problematic content from being deployed.
On the driver side, CrowdStrike plans to “enhance existing error handling in the Content Interpreter,” part of the Falcon sensor. A staggered deployment approach for Rapid Response Content will also be implemented, gradually rolling out updates to larger portions of its user base instead of an immediate system-wide push. These improvements and staggered deployments have been endorsed by security experts following the recent incident.
