# How many people have a bunch of PCs that are down right now? **URL:** \ **Category:** General Discussion\ **Created:** [July 19, 2024, 10:32am UTC](https://forum.inductiveautomation.com/t/how-many-people-have-a-bunch-of-pcs-that-are-down-right-now/93449 "2024-07-19T10:32:12Z")\ **Posts on this page:** 14\ **Page:** 3
**Author:** ![bkarabinchak.psi](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/bkarabinchak.psi/32/83567_2.png) [@bkarabinchak.psi](https://forum.inductiveautomation.com/u/bkarabinchak.psi)\ **Post date:** [July 22, 2024, 11:34am UTC](https://forum.inductiveautomation.com/t/how-many-people-have-a-bunch-of-pcs-that-are-down-right-now/93449/41 "2024-07-22T11:34:53Z")
Interesting watch - [https://www.youtube.com/watch?v=wAzEJxOo1ts](https://www.youtube.com/watch?v=wAzEJxOo1ts) ---
**Author:** ![michael.flagler](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/michael.flagler/32/26272_2.png) [@michael.flagler](https://forum.inductiveautomation.com/u/michael.flagler)\ **Post date:** [July 22, 2024, 11:55am UTC](https://forum.inductiveautomation.com/t/how-many-people-have-a-bunch-of-pcs-that-are-down-right-now/93449/42 "2024-07-22T11:55:09Z")
I'm seeing on LinkedIn that there was a null pointer used that in turn attempted to access an invalid memory address. ![Screenshot_20240722-065322](https://us1.discourse-cdn.com/inductiveautomation/original/3X/2/5/258d31431abd8f2c7e8afa39a4432768ae7d4026.png) ---
**Author:** ![victordcq](https://avatars.discourse-cdn.com/v4/letter/v/f6c823/32.png) [@victordcq](https://forum.inductiveautomation.com/u/victordcq)\ **Post date:** [July 22, 2024, 12:20pm UTC](https://forum.inductiveautomation.com/t/how-many-people-have-a-bunch-of-pcs-that-are-down-right-now/93449/43 "2024-07-22T12:20:37Z")
No way just one person can be able to push a forced update to all pc's without review, tests, or even partial/region deploys. right? xd ![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/4/a/4ab1130d79abe26d4a670659a190f3a49ecee732.png) Lol they learned to revert the problem... but this should never have even been able to happen in the first place. Anyone that uses this should uninstall it yeah ---
**Author:** ![Steve\_Laubach](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/steve_laubach/32/60900_2.png) [@Steve\_Laubach](https://forum.inductiveautomation.com/u/Steve_Laubach)\ **Post date:** [July 22, 2024, 12:33pm UTC](https://forum.inductiveautomation.com/t/how-many-people-have-a-bunch-of-pcs-that-are-down-right-now/93449/44 "2024-07-22T12:33:36Z")
Zack Vorhies broke it down on twitter. It was a C++ pointer in software that is loaded on startup and runs at a very high permissions level. It was getting pointed to an invalid place in memory which causes windows to crash but then it opening the software on load so it caused a boot loop. ---
**Author:** ![justinedwards.jle](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/justinedwards.jle/32/37854_2.png) [@justinedwards.jle](https://forum.inductiveautomation.com/u/justinedwards.jle)\ **Post date:** [July 22, 2024, 12:35pm UTC](https://forum.inductiveautomation.com/t/how-many-people-have-a-bunch-of-pcs-that-are-down-right-now/93449/45 "2024-07-22T12:35:57Z")
I was in O'Reilly's this morning buying some windshield wipers for my truck. The guy was having trouble getting his table to sort the parts by price, and I said, "Hey, at least it isn't blue screened." He proudly replied, "These are all Linux machines. They don't blue screen." ---
**Author:** ![michael.flagler](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/michael.flagler/32/26272_2.png) [@michael.flagler](https://forum.inductiveautomation.com/u/michael.flagler)\ **Post date:** [July 22, 2024, 3:09pm UTC](https://forum.inductiveautomation.com/t/how-many-people-have-a-bunch-of-pcs-that-are-down-right-now/93449/46 "2024-07-22T15:09:54Z")
I think Crowdstrike's blog post on this is carefully worded. They claim it's not a kernel mode driver, yet in the video @bkarabinchak.psi posted, essentially it sounds like they have a kernel mode driver that is dynamically loading code from these definition files that runs in the kernel/ring 0. This is the quickest way for them to push updates to kernel mode "drivers" without getting them re-certified to be able to adapt to zero-day vulnerabilities. I think in businesses maybe software like AV/Anti-Malware/Cybersecurity should be diversified just like firewalls should be to add additional layers of protection. Run portions of servers on different software so that in the event one has an issue or is compromised in any way, you're only half down. Terminals in banks/airports/etc would be backed up, but not completely down. ---
**Author:** ![bkarabinchak.psi](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/bkarabinchak.psi/32/83567_2.png) [@bkarabinchak.psi](https://forum.inductiveautomation.com/u/bkarabinchak.psi)\ **Post date:** [July 22, 2024, 3:29pm UTC](https://forum.inductiveautomation.com/t/how-many-people-have-a-bunch-of-pcs-that-are-down-right-now/93449/47 "2024-07-22T15:29:24Z")
I think the real issue as @pturmel pointed out is that a single company has kernel access to millions of computers across industries. I assume Crowdstrike had a target on its back before but I think it just got 10x larger with seeing how damage they could do. How much do we trust their internal security, especially after their internal culture allowed them to make a mistake like the one they just did? Trust is easy to lose and hard to get back in their space. Their stock is tanking and estimates now are $900 billion worth of damages inflicted from the mistake and probably still counting - I know some airports are still having issues for instance. When we inevitably start seeing lawsuits who knows how long they may even be around for going forward tbch. I know this was not all related to what you said but this whole story has got me swept in up in it lol. ---
**Author:** ![Joe\_Harvey](https://avatars.discourse-cdn.com/v4/letter/j/e9a140/32.png) [@Joe\_Harvey](https://forum.inductiveautomation.com/u/Joe_Harvey)\ **Post date:** [July 22, 2024, 3:38pm UTC](https://forum.inductiveautomation.com/t/how-many-people-have-a-bunch-of-pcs-that-are-down-right-now/93449/48 "2024-07-22T15:38:15Z")
doubt very many ---
**Author:** ![justinedwards.jle](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/justinedwards.jle/32/37854_2.png) [@justinedwards.jle](https://forum.inductiveautomation.com/u/justinedwards.jle)\ **Post date:** [July 22, 2024, 3:39pm UTC](https://forum.inductiveautomation.com/t/how-many-people-have-a-bunch-of-pcs-that-are-down-right-now/93449/49 "2024-07-22T15:39:45Z")
On the bright side, the memes have been great. This one pretty much sums up my view on what happened: ![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/7/6/764d669a8a81b31934303e48df329417c9c46f85.png) So far, I'd have to say this one is my favorite: 🤣 ![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/c/a/ca978b35d99e06c8bae2e2da108422187a55d749.jpeg) ---
**Author:** ![Steve\_Laubach](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/steve_laubach/32/60900_2.png) [@Steve\_Laubach](https://forum.inductiveautomation.com/u/Steve_Laubach)\ **Post date:** [July 22, 2024, 4:09pm UTC](https://forum.inductiveautomation.com/t/how-many-people-have-a-bunch-of-pcs-that-are-down-right-now/93449/50 "2024-07-22T16:09:39Z")
I know of a handful of plants that were taken down by this. It definitely impacted industrial automation. As for our company... We weren't putting crowdstrike on anything and we will continue in that vein. ---
**Author:** ![pturmel](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/pturmel/32/3295_2.png) [@pturmel](https://forum.inductiveautomation.com/u/pturmel)\ **Post date:** [July 22, 2024, 4:19pm UTC](https://forum.inductiveautomation.com/t/how-many-people-have-a-bunch-of-pcs-that-are-down-right-now/93449/51 "2024-07-22T16:19:10Z")
If you don't put Crowdstrike on boxes, but some other third party AV solution, you have to have given that other solution similar privilege. Maybe Crowdstrike was the biggest, but AV tools **must** have high privilege to do their job. That, mixed with automatic updates, simply yields _another_ security hole. 🤷‍♂️ You need an OS that is fundamentally secure out of the box, whose public access is provided by easily-constrained, well-audited applications. Updated on command, not automatically. I'll consider trusting Windows when there is no longer a **market** for kernel-resident AV tools. ---
**Author:** ![Joe\_Harvey](https://avatars.discourse-cdn.com/v4/letter/j/e9a140/32.png) [@Joe\_Harvey](https://forum.inductiveautomation.com/u/Joe_Harvey)\ **Post date:** [July 22, 2024, 4:30pm UTC](https://forum.inductiveautomation.com/t/how-many-people-have-a-bunch-of-pcs-that-are-down-right-now/93449/52 "2024-07-22T16:30:42Z")
This is a very good video so far, excellent explanation, will probably follow this guy's channel. ---
**Author:** ![pturmel](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/pturmel/32/3295_2.png) [@pturmel](https://forum.inductiveautomation.com/u/pturmel)\ **Post date:** [July 22, 2024, 4:48pm UTC](https://forum.inductiveautomation.com/t/how-many-people-have-a-bunch-of-pcs-that-are-down-right-now/93449/53 "2024-07-22T16:48:38Z")
> [@Joe\_Harvey](#): > > probably follow this guy's channel. Concur. ---
**Author:** ![dkhayes117](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/dkhayes117/32/68344_2.png) [@dkhayes117](https://forum.inductiveautomation.com/u/dkhayes117)\ **Post date:** [July 22, 2024, 5:37pm UTC](https://forum.inductiveautomation.com/t/how-many-people-have-a-bunch-of-pcs-that-are-down-right-now/93449/54 "2024-07-22T17:37:40Z")
I'm setting up an Ubuntu server to test right now. Hopefully, I can switch production to it soon 🙂 [Previous page](https://forum.inductiveautomation.com/t/how-many-people-have-a-bunch-of-pcs-that-are-down-right-now/93449.md?page=2)