'Indian govt is in touch with Microsoft, NIC network is not affected': Vaishnaw on largest IT outage in history

Soon after the world witnessed the largest IT outage in history, Indian IT Minister Ashwini Vaishnaw took to X (formerly Twitter) to share that the Indian government is in touch with Microsoft and its associate CrowdStrike regarding the global outage that resulted in worldwide chaos, impacting airlines, banks, TV channels, healthcare, IT services, and many more sectors.

"MEITY is in touch with Microsoft and its associates regarding the global outage. The reason for this outage has been identified, and updates have been released to resolve the issue," Vaishnaw wrote.

MEITY is in touch with Microsoft and its associates regarding the global outage.

The reason for this outage has been identified and updates have been released to resolve the issue.

CERT is issuing a technical advisory.

NIC network is not affected.

— Ashwini Vaishnaw (@AshwiniVaishnaw) July 19, 2024

He said that the Indian Computer Emergency Response Team (CERT-In) is issuing a technical advisory. He also confirmed that the NIC network was not affected by this outage.

The CERT-In warning, with a critical rating, shares details of the outage: “It has been reported that Windows hosts related to CrowdStrike agent, Falcon Sensor, are facing outages and crashing due to a recent update received in the product. The concerned Windows hosts are experiencing Blue Screen of Death (BSOD) related to Falcon Sensors." 

CERT-In has published Advisory on its website (19-07-2024)

Outage of Microsoft Windows due to Crowd Strike agent Falcon Sensor updatehttps://t.co/Wdbc1FpdS0

— CERT-In (@IndianCERT) July 19, 2024

The issue occurred in the latest update of CrowdStrike, and the changes have been reverted by the CrowdStrike team.

If hosts are still crashing and unable to stay online to receive the Channel File Changes, the following steps can be used as a workaround for this issue:

– Boot Windows into Safe Mode or the Windows Recovery Environment.

– Navigate to the C:\Windows\System32\drivers\CrowdStrike directory.

– Locate the file matching “C-00000291*.sys", and delete it.

– Boot the host normally.

The bulletin also advises users to check the latest updates from the CrowdStrike portal.

US-based cybersecurity firm CrowdStrike, which saw its share price decline over 10%, admitted that the problem was caused by an update to its Falcon antivirus software, which is designed to protect Microsoft Windows devices from malicious attacks.

On the other hand, the tech giant said it is taking "mitigation action" to deal with "the lingering impact" of the outage.

"We're investigating an issue impacting users' ability to access various Microsoft 365 apps and services. We're continuing to reroute the affected traffic to healthy infrastructure," the tech giant.

Meanwhile, a Microsoft spokesperson said: "We anticipate a resolution is forthcoming".

According to CrowdStrike founder George Kurtz, the problems were caused by a "defect" in a "content update" for Microsoft Windows devices. He also clarified that this was not a security incident or cyberattack.

"The issue has been identified, isolated, and a fix has been deployed," he said.