Microsoft Blames European Commission for Major Worldwide Outage

[AppliedMicro]

The whole IT didnt know this was an issue.

They did know. They knew the software had kernel-level access.
And Microsoft themselves are literally saying such driver can crash the kernel.

You forgot the part where the EU forced Microsoft to allow 3rd parties the same kernel access

Microsoft gives the access anyway.
It’s always

So yes, Cloudstrike screwed up, but the EU created the conditions that enabled a company like Cloudstrike to be in the position where they could screw up to such an extent.

The conditions weren’t created by the EU.
They were created by Microsoft, whose driver model depended on it since forever.

If Microsoft didn’t feel like they had to give kernel-level access to everyone, it would have been technologically impossible for Cloudstrike to brick 8 million computers however problematic their patch was to begin with.

Microsoft has felt like giving anyone kernel access since the dawn of Windows drivers.

 

[rp2011]

And for me, the most troubling part of the increased and aggressive nature of the EU and also here with our own clueless politicians is that the changes or proposed mandates are not be use there was a call to arms by its citizens, but by the clueless politicians themselves hoping to get brownie points going after the big bad profitable companies.

 

[Supermallet]

Microsoft is lying by omission. They say they’re bound by this law, which is true, but they don’t mention they could have prevented this from happening by redesigning the architecture of the OS so their own first party security products don’t access the kernel. Then the third party security services can be denied access to the kernel while still remaining within the law. And they should be doing this anyway even if there isn’t a law because it would have avoided exactly the disaster that just happened!

Microsoft is trying to deflect from their own culpability and simultaneously trying to create an atmosphere of distrust for government regulation. Despicable behavior, sadly expected behavior as well. And sadly as we can see from this very thread plenty of people are falling for it, as the anti-regulation propaganda by corporations is extremely strong.

 

[AppleCinco]

Apple doesn't allow it's own security software to run in Ring 0. Microsoft could easily move theirs outside the kernel, so that it competed on an even basis. And to be clear: this could have easily happened with a Defender update from a technical standpoint.

...but it didn't. The EU didn't cause this issue, but without these poorly conceived regulations...it also would not have happened. The right response would be not to allow anyone to run software in Ring 0. However, € > best security practices.

 

[ikramerica]

Apple doesn't allow it's own security software to run in Ring 0. Microsoft could easily move theirs outside the kernel, so that it competed on an even basis. And to be clear: this could have easily happened with a Defender update from a technical standpoint.

Apple removed kernel extensions for everyone including themselves. While I have had a slow down here and there requiring a restart to stop whatever runaway process was happening, and have had some wonky behavior where an app takes control of the keyboard and won’t let go, I have’t had a KP in years. And that’s a good thing.

 

[ikramerica]

As always probably no money for testers, testers blamed for too slow product deployment but damn smokes on several versions of Windows it's not that hard... like 10 virtual machines or physical (not sure how it's done on such low level, had only experience with Windows RTX apps and normal ones), Jenkins and little time. The more the machines shorter tests of installing windows, updates for app, and updates for windows scenarios.

Then doing 2 more stupid things - deploying by Friday (ok if this was serious issue to be fixed with this antivirus update it can be missed) + deploying everywhere at once FFS... then as we know sys admins also should have possibilities to get patches always on test machines at first (so on "animals" to sacrifice) but who cares... maybe this almighty product does not have such line.... so let's allow auto updates on everything they have in the middle of night what could go wrong

Edit - this issue was on system boot so... extremely hard to test and notice on sysadmin side. Literally a clocking bomb.
If it was during system run - system crash would trigger guys.

Also I am surprised why kernel-level app has not done any more verification another than check for CRC and sign as it was said that faulty file had many nulls inside - so lack of data required I guess (not expert on such low level but somehow embedded stuff has that).

Shame on their testers indeed, hopefully they still had some humans on this role... but McAffee guys knows this f up very well. The more I think the more I see that the whole line of responsibilities was broken...
/tester

Shame on the customers allowing a third party to push ANY kernel level anything onto their mission critical systems.

You need a room of machines running your setup in a sandbox where you test any updates to mission critical systems then YOU push them out when you are satisfied.

I am an unimportant nobody and I don’t let Apple push an OS update to any of my deci except my spare watch, AppleTV and my iPad. None are that important. I then wait for the reports on the updates bricking devices before I consider updating my phone or Mac or main watch.

 

[ikramerica]

After watching the excellent video provided by user Xioa_Xi I must modify my statement. It does appear this is all on CrowdStrike for the way they have chosen to install their code universally, not just in the EU. The video clearly explains what CrowdStrike did to bypass Microsoft’s testing and signing process for software that runs inside the kernel in the interest of acting quickly to confront newly discovered threats. Apple doesn’t allow any third party code to run in the kernel. Microsoft is claiming they were forced to allow this because of an agreement they made with the EU.

Again, this is totally on CrowdStrike and everyone here should watch the video in its entirety.

Crowdstrike caused the problem. MS made it possible.

 

[Tomasulu]

Couldn’t microsoft grant access AND still provide some level of oversight? I feel this is a cop out.

 

[cyb3rdud3]

Whether a third part had this access or not is irrelevant, Microsoft could have made the same mistake, or any other company. Crowdstrike did do their testing, but messed up in the deployment. That is not good, they should own that. That is not Microsoft's fault. Could Microsoft do more to prevent this, possibly, and they should look into that. Are they to blame? No, I don't think so, the blame is purely with Crowdstrike. Did the EU cause this, or is to blame for it? No, of course not.

 

[breenmask]

people pick a side and defend it to no end, finding all sorts of scraps to support their view and deny anything from the opposite side.

seems like what you're doing now.

 

[cyb3rdud3]

...but it didn't. The EU didn't cause this issue, but without these poorly conceived regulations...it also would not have happened. The right response would be not to allow anyone to run software in Ring 0. However, € > best security practices.

The ruling was over a decade ago, and wasn't specific to doing this particular installation. Microsoft had plenty of opportunity to change the way it worked, both for themselves and thus equally for third parties as that is what it was about; the uncompetitive nature where consumers and businesses could not choose an alternative product, it was not about weakening security or operating system protections.

 

[ItWasNotMe]

Of course instead of Windows, they could have been running a server version of MacOS... provided it was Monterey. Oh and support for the server version was discontinued April 2022.

 

[bartmoss]

Or we could blame the people actually responsible - CrowdStrike. Just saying.

 

[xyz01]

The real issue here is lack of testing by CrowdStrike, whose CEO was the CTO of McAfee the last time a similar thing happened:

This is the 2nd time CrowdStrike CEO George Kurtz has been at the center of a global tech failure

CrowdStrike CEO George Kurtz was the CTO of McAfee in 2010 when another security update caused millions of computers to crash around the world.

www.businessinsider.com

I disagree slightly. Testing will never catch everything, that's why you do staged rollouts. This would have limited the damage immensely.

Not doing that should get someone fired.

 

[henkie]

I mean, if not for the EU ruling, you wouldn’t have a need for companies like cloudstrike in the first place.

So yes, Cloudstrike screwed up, but the EU created the conditions that enabled a company like Cloudstrike to be in the position where they could screw up to such an extent. If Microsoft didn’t feel like they had to give kernel-level access to everyone, it would have been technologically impossible for Cloudstrike to brick 8 million computers however problematic their patch was to begin with.

It’s similar to how on android, it’s possible to install malware on your device via shady facebook ads, while iOS devices don’t have this problem because users just can’t physically carry out such an action.

My takeaway is still that everything is ultimately a trade-off, even regulations, and there are always unforeseen consequences that may not be apparent until years or even decades later. There’s plenty of blame to go around, and the EU doesn’t get to both claim the credit of regulation dating back 2 decades, while washing its hands off the repercussions that do occur subsequently.



Which is why I say - screw it, and fork a version of windows specially for the EU that adheres to whatever terms was agreed to in the past. The rest of the word can get a version of windows where only Microsoft privileges itself with kernel access for their own software (and nobody else), and I don’t really care.

1) Security software of MS had an unfair advantage because its own software could use kernel access, while others could not. So, any security software trying to compete, was not doing so at a level playing field. Given the massive leverage of the installed base of Windows throughout the world, this means that all security software not from MS has a hard time competing with MS (similar thing as IE strategy back in the days). In the long term this could mean that the security of Windows completely relies on MS (all other security software makers are competed out of the market). Which is problematic in itself, since other software, like mentioned in 2, still had access to the windows kernel. Again, but not security software!
2) Anti game cheat software even uses kernel access. Many games nowadays use this, because the cheat software also uses kernel exploits to do its thing: https://www.pcgamer.com/according-t...its-not-perfect-and-2-its-not-going-anywhere/
3) maybe MS should rethink its strategy and go the MacOS way: disallowing kernel access altogether (might bring some headaches for drivers though).

 

[macbookj0e]

Hang on MS, you’re the one that agreed to the EU’s request. How is that then their fault? You should have declined.

 

[svish]

Great to hear that Macs cannot be affected.

 

[davide_eu]

No, because you don't have any power to do anything about it.

Not true! He has the power to decide to install or not any software like Crowdstrike.

 

[bergert]

Couldn’t microsoft grant access AND still provide some level of oversight? I feel this is a cop out.

Oversight is not allowed by regulators (US and EU).

Myself, can't understand why alternate app-stores are needed, and why (lack of oversight) should be a good thing? If you really don't like the app-store, then why are you buying a Apple device in the first place?

 

[davide_eu]

Last Friday, a major CrowdStrike outage impacted PCs running Microsoft Windows, causing worldwide issues affecting airlines, retailers, banks, hospitals, rail networks, and more. Computers were stuck in continuous recovery loops, rendering them unusable.

The failure was caused by an update to the CrowdStrike Falcon antivirus software that auto-installed on Windows 10 PCs, but Mac and Linux machines were not affected even though they received the same software. A report from The Wall Street Journal delves into what happened and includes some critical information from Microsoft on why Macs did not get taken out by the update.

On Windows machines, CrowdStrike's Falcon security software is a kernel module, which gives the software full access to a PC. The kernel manages memory, processes, files, and devices, and it's basically the heart of the operating system. Much of the software on a PC is typically limited to user mode, where bad code can't cause harm, but software with kernel mode access can cause catastrophic total machine failures, like what was encountered last week.

The Falcon software was not able to wreak similar havoc on Macs because Apple does not give software makers kernel access. In macOS Catalina, which came out in 2019, Apple deprecated kernel extensions and transitioned to system extensions that run in a user space instead of at a kernel level. The change made Macs more stable and more secure, adding protection against unstable software updates like the one CrowdStrike pushed out. It is not possible for Macs to have a similar failure because of the change that Apple made.

In a statement to The Wall Street Journal, Microsoft blamed the European Commission for an inability to offer the same protections that Macs have. Microsoft said that it is unable to wall off its operating system because of an "understanding" with the European Commission. Back in 2009, Microsoft agreed to interoperability rules that provide third-party security apps with the same level of access to Windows that Microsoft gets. Microsoft agreed to provide kernel access in order to resolve multiple longstanding competition law issues in Europe.

Apple has not been forced to make changes to how Macs work, but the European Commission has been targeting the closed nature of iOS, and Apple has warned that the updates that have already been implemented could lead to security risks in the future. The European Union's Digital Markets Act has pushed Apple to allow developers to offer apps through third-party marketplaces and websites. Apple says explicitly that the DMA compromises its ability to "detect, prevent, and take action against malicious apps."

The major CrowdStrike failure that affected Windows PCs highlights some of the unintended consequences and the tradeoffs inherent in legislation that weakens security in the name of open access. CrowdStrike's simple software update impacted global infrastructure, bringing travel, commerce, and healthcare to a standstill.

Microsoft does not seem to have a way to stop a recurrence because it can't cut off kernel access. The company says that significant incidents "are infrequent" and that less than one percent of all Windows machines were impacted. CrowdStrike says that it is "deeply sorry for the inconvenience and disruption," and that in the future, it will share the steps that it is taking to prevent a similar situation.

Article Link: Microsoft Blames European Commission for Major Worldwide Outage

MR aligned to the war against EU to protect a$$le; but we know how it works: one bad comment, a non positive review and you enter into the cult marketing black list. No more pear stickers, ...

 

[Jamie0003]

Nope. You clearly misunderstood.

You linked two posts that say you can’t access the Kernal on iOS or Mac, even via sideloading. What makes you think you can?

 

[lxmeta]

This is from the company who „lost“ the key to the kingdom, that should not exist in the first place.
But let’s blame the EU for decades old forked up kernel design!

 

[SanderEvers]

This is a VERY good example why you should NEVER give a user or an app full kernel control. Honestly a user / app should not even have root access if you'd ask me either. It would break 99.9% of all malware instantly.

'Freedom' is not the solution. Because most people can't handle it. So yes, MS is correct here. And if you have any doubt? Just give a regular user full root access on a Linux system for a week. It will end badly.

 

[SanderEvers]

This is from the company who „lost“ the key to the kingdom, that should not exist in the first place.
But let’s blame the EU for decades old forked up kernel design!

Forked up kernel design? Please eleborate here.

 

[cyb3rdud3]

This is a VERY good example why you should NEVER give a user or an app full kernel control. Honestly a user / app should not even have root access if you'd ask me either. It would break 99.9% of all malware instantly.

'Freedom' is not the solution. Because most people can't handle it. So yes, MS is correct here. And if you have any doubt? Just give a regular user full root access on a Linux system for a week. It will end badly.

You seem to miss the point. People aren’t disagreeing with you about that. The point is that this is wholly within control of Microsoft, and has nothing to do with the EU. It’s Microsoft choice how they implement it, just do it in compliance with the rules.