CERT-In Issues Urgent Advisory on Windows System Outage Due to CrowdStrike Update

CERT-In has issued an advisory regarding a severe Microsoft Windows system outage caused by a recent CrowdStrike Falcon Sensor update. The issue, resulting in system crashes and the 'Blue Screen of Death,' is being addressed with remedial steps and continued monitoring by Microsoft and Indian authorities.

The Indian Computer Emergency Response Team (CERT-In) has issued an advisory, CIAD-2024-0035, concerning a severe outage impacting Microsoft Windows systems. This disruption is attributed to the recent update of the CrowdStrike agent, Falcon Sensor, causing widespread system crashes and the notorious 'Blue Screen of Death' (BSOD).

Recent reports indicate that Windows hosts equipped with the CrowdStrike Falcon Sensor are encountering significant stability issues due to the product's latest update. These issues have led to extensive system outages, rendering many Windows hosts inoperable and displaying the BSOD.

In response, the CrowdStrike team has rolled back the changes made in the recent update. However, if systems continue to crash and are unable to stay online for the necessary Channel File Changes, CERT-In recommends the following steps: booting Windows into Safe Mode or the Windows Recovery Environment, navigating to the directory C:\Windows\System32\drivers\CrowdStrike to locate and delete the file matching the pattern 'C-00000291*.sys', and then rebooting the host normally.

Additionally, users are advised to check for the latest updates and further instructions on the CrowdStrike support portal. Union Minister for Information Technology, Ashwini Vaishaw, assured that the Government is in touch with Microsoft and its associates regarding the global outage. The Minister stated that the issue has been identified and updates have been released to resolve it, emphasizing that the NIC network remains unaffected.

On Friday, Microsoft acknowledged the global outage affecting its online services. Windows users reported experiencing BSOD errors, with many taking to social media platform X to voice their concerns. In its latest update, Microsoft stated that continuous improvements are being made as mitigation actions progress, and multiple services are seeing improvements in availability.