Author name: Shannon Garcia

microsoft-says-8.5m-systems-hit-by-crowdstrike-bsod,-releases-usb-recovery-tool

Microsoft says 8.5M systems hit by CrowdStrike BSOD, releases USB recovery tool

Biz & IT, Crowdstrike, microsoft, Tech / /

still striking —

When reboots don’t work, bootable USB sticks may help ease fixes for some PCs.

–

A bad update to CrowdStrike's Falcon security software crashed millions of Windows PCs last week.

Enlarge / A bad update to CrowdStrike’s Falcon security software crashed millions of Windows PCs last week.

CrowdStrike

By Monday morning, many of the major disruptions from the flawed CrowdStrike security update late last week had cleared up. Flight delays and cancellations were no longer front-page news, and multiple Starbucks locations near me are taking orders through the app once again.

But the cleanup effort continues. Microsoft estimates that around 8.5 million Windows systems were affected by the issue, which involved a buggy .sys file that was automatically pushed to Windows PCs running the CrowdStrike Falcon security software. Once downloaded, that update caused Windows systems to display the dreaded Blue Screen of Death and enter a boot loop.

“While software updates may occasionally cause disturbances, significant incidents like the CrowdStrike event are infrequent,” wrote Microsoft VP of Enterprise and OS Security David Weston in a blog post. “We currently estimate that CrowdStrike’s update affected 8.5 million Windows devices, or less than one percent of all Windows machines. While the percentage was small, the broad economic and societal impacts reflect the use of CrowdStrike by enterprises that run many critical services.”

The “easy” fix documented by both CrowdStrike (whose direct fault this is) and Microsoft (which has taken a lot of the blame for it in mainstream reporting, partly because of an unrelated July 18 Azure outage that had hit shortly before) was to reboot affected systems over and over again in the hopes that they would pull down a new update file before they could crash. For systems where that method hasn’t worked—and Microsoft has recommended customers reboot as many as 15 times to give computers a chance to download the update—the recommended fix has been to delete the bad .sys file manually. This allows the system to boot and download a fixed file, resolving the crashes without leaving machines unprotected.

To help ease the pain of that process, Microsoft over the weekend released a recovery tool that helps to automate the repair process on some affected systems; it involves creating bootable media using a 1GB-to-32GB USB drive, booting from that USB drive, and using one of two options to repair your system. For devices that can’t boot via USB—sometimes this is disabled on corporate systems for security reasons—Microsoft also documents a PXE boot option for booting over a network.

WinPE to the rescue

The bootable drive uses the WinPE environment, a lightweight, command-line-driven version of Windows typically used by IT administrators to apply Windows images and perform recovery and maintenance operations.

One repair option boots directly into WinPE and deletes the affected file without requiring administrator privileges. But if your drive is protected by BitLocker or another disk-encryption product, you’ll need to manually enter your recovery key so that WinPE can read data on the drive and delete the file. According to Microsoft’s documentation, the tool should automatically delete the bad CrowdStrike update without user intervention once it can read the disk.

If you are using BitLocker, the second recovery option attempts to boot Windows into Safe Mode using the recovery key stored in your device’s TPM to automatically unlock the disk, as happens during a normal boot. Safe Mode loads the minimum set of drivers that Windows needs to boot, allowing you to locate and delete the CrowdStrike driver file without running into the BSOD issue. The file is located at Windows/System32/Drivers/CrowdStrike/C-00000291*.sys on affected systems, or users can run “repair.cmd” from the USB drive to automate the fix.

For its part, CrowdStrike has set up a “remediation and guidance hub” for affected customers. As of Sunday, the company said it was “test[ing] a new technique to accelerate impacted system remediation,” but it hasn’t shared more details as of this writing. The other fixes outlined on that page include rebooting multiple times, manually deleting the affected file, or using Microsoft’s boot media to help automate the fix.

The CrowdStrike outage didn’t just delay flights and make it harder to order coffee. It also affected doctor’s offices and hospitals, 911 emergency services, hotel check-in and key card systems, and work-issued computers that were online and grabbing updates when the flawed update was sent out. In addition to providing fixes for client PCs and virtual machines hosted in its Azure cloud, Microsoft says it has been working with Google Cloud Platform, Amazon Web Services, and “other cloud providers and stakeholders” to provide fixes to Windows VMs running in its competitors’ clouds.

Microsoft says 8.5M systems hit by CrowdStrike BSOD, releases USB recovery tool Read More »

a-stripped-out-2024-cayenne-v6-may-just-be-porsche’s-best-daily-driver

A stripped-out 2024 Cayenne V6 may just be Porsche’s best daily driver

2024 Porsche Cayenne, car review, Cars, SUV / /

slightly spicy SUV —

Sometimes a simple spec without all the bells and whistles is the way to go.

–

A Porsche Cayenne parked next to a chain link fence by a general aviation airport

Enlarge / It’s all too easy to go nuts with the Porsche option list and spend a fortune, but what if you didn’t do that?

Michael Teo Van Runkle

Porsche’s high-performance variants of the 911 might make for great headlines, proving the incredible potential of the world’s most iconic rear-engined sports car to serve as a track toy and off-road rally racer simultaneously. But while motorsport heritage always factors into any Porsche conversation, the 911 is anything but the top rung of the company’s sales ladder. Instead, the Cayenne and then Macan SUVs have led the pack in volume since 2002, bolstering the company’s financial position and allowing the smaller-scale 911s and 718s to continue production.

For model year 2024, the facelifted third-gen Cayenne now comes in seven trim levels, including the technologically advanced and startlingly quick Turbo E-Hybrid, which offers 35 miles of all-electric range and a 3.5-second sprint to 60 mph. And yet a base V6 Cayenne offers a far more attainable entree into what it’s like to own something other than a fully loaded, paint-to-sample uber-Porsche that can easily cost well over $200,000.

Revisiting the Cayenne SUV

A V6-powered Cayenne starts at $79,200, or almost $20,000 more than the smaller gasoline-powered Macan crossover. But the larger platform allows for a more refined vision of Porsche luxury on the interior, with more headroom, legroom, and cargo capacity. Despite the additional size, however, the latest iteration of the Cayenne never sacrifices the spirit that originally put the Sport in Sport Utility Vehicle. And even a small-displacement turbo V6 still delivers the highlights of Porsche performance, engineering, and reliability.

Porsche hasn't announced a replacement for the Cayenne yet, but we bet it will be electric.

Enlarge / Porsche hasn’t announced a replacement for the Cayenne yet, but we bet it will be electric.

Michael Teo Van Runkle

I took this 2024 Cayenne for a week loan in Los Angeles six months after selling my own 2006 Cayenne Turbo. Half a year without a Stuttgart SUV serving as my daily driver never dampened the impressions that originally inspired my purchase of a high-mileage Typ 955, though—especially that burly 4.5 L twin-turbo V8 pumping out 450 hp (335 kW) and 457 lb-ft (620 Nm) of torque. With a stout Aisin six-speed automatic transmission, 18-inch wheels shod in big knobby tires, and an adjustable air suspension system, my Cayenne Turbo handled far more difficult off-roading trails than I ever expected, all while still being able to cruise home on the freeway at with equal aplomb.

Since that undeniably over-engineered first generation—split between the 955 and later the 957 facelift—the Cayenne has evolved into a leaner, more consumer-focused SUV. The next generation, known as the 958, dropped the two-speed transfer case, locking differentials, and electronically disconnecting sway bars from the platform. With less truck-iness baked in, second and now third-gen (Typ 9Y0) Cayennes nail the sporty side even more effectively.

The biggest difference comes down to sheer weight. Without the substantial heft of a more complex driveline and powered by smaller displacement engine options throughout the lineup, the current Cayenne now tips the scales at 4,678 lbs (2,122 kg). Compare that to my Turbo, at 5,200 lbs (2,359 kg) before I bolted on steel skid plates, a swingout rear spare carrier, and bigger tires, and the difference in horsepower stats versus the V6-powered base Cayenne starts to seem less significant.

There's not much to see under the hood.

Enlarge / There’s not much to see under the hood.

Michael Teo Van Runkle

The single-turbo V6 receives ratings of 348 hp (260 KW) and 368 lb-ft (500 Nm) of torque, though the latter figure peaks at just 1,450 rpm and explains the ability for a full-size SUV to manage a 0–60 time of just 5.4 seconds when equipped with the Sport Plus package and Launch Control. That’s a long way off from a Turbo GT, sure, but it’s better than the V6’s raw specs on paper perhaps suggest.

A stripped-out 2024 Cayenne V6 may just be Porsche’s best daily driver Read More »

the-falcon-9-rocket-may-return-to-flight-as-soon-as-tuesday-night

The Falcon 9 rocket may return to flight as soon as Tuesday night

falcon 9, Science, Space / /

That’s pretty fast —

SpaceX is waiting for a determination from the FAA.

–

File photo of a Falcon 9 launch on May 6 from Cape Canaveral Space Force Station, Florida.

Enlarge / File photo of a Falcon 9 launch on May 6 from Cape Canaveral Space Force Station, Florida.

SpaceX

It was only about 10 days ago that the Falcon 9 rocket’s upper stage failed in flight, preventing the rocket from delivering its 20 Starlink satellites into a proper orbit. Because they were released lower than expected—about 135 km above the Earth’s surface and subject to atmospheric drag—these satellites ultimately reentered the planet’s atmosphere and burnt up.

Typically, after a launch failure, a rocket will be sidelined for months while engineers and technicians comb over the available data and debris to identify a cause, perform tests, and institute a fix.

However, according to multiple sources, SpaceX was ready to launch the Falcon 9 rocket as soon as late last week. Currently, the company has a launch opportunity for no earlier than 12: 14 am ET (04: 14 UTC) on Wednesday for its Starlink 10-4 mission.

A quick fix?

In a summary of the anomaly posted shortly afterward, SpaceX did not identify the cause of the failure beyond saying, “The Merlin Vacuum engine experienced an anomaly and was unable to complete its second burn.”

Officially, the company has provided no additional information since then. However, the company’s engineers were able to identify the cause of the failure almost immediately and, according to sources, the fix was straightforward.

SpaceX was confident enough in this determination to resume launches of the Falcon 9 rocket one week after the failure. However, it is precluded from doing so while the US Federal Aviation Administration conducts a mishap investigation.

To that end, a week ago on July 15, SpaceX submitted a request to the FAA to resume launching its Falcon 9 rocket while this investigation into the anomaly continues. “The FAA is reviewing the request and will be guided by data and safety at every step of the process,” the FAA said in a statement at the time.

Crewed missions on deck

So, as of today, SpaceX is waiting for a determination from the FAA as to whether it will be allowed to resume Falcon 9 launches less than two weeks after the failure occurred.

The company plans to launch at least three Starlink missions in rapid succession from its two launch pads in Florida and one in California to determine the effectiveness of the fix. It would like to demonstrate the reliability of the Falcon 9 rocket, which had recorded more than 300 successful missions since its last failure during a pad accident in September 2016, before two upcoming crewed missions.

There is still a slight possibility that the Polaris Dawn mission, led by commercial astronaut Jared Isaacman, could launch in early August. This would be followed by the Crew-9 mission for NASA, which will carry four astronauts to the International Space Station.

Notably, neither of these crewed missions requires a second burn of the Merlin engine, which is where the failure occurred earlier this month during the Starlink mission.

The Falcon 9 rocket may return to flight as soon as Tuesday night Read More »

mini-neptune-turned-out-to-be-a-frozen-super-earth

Mini-Neptune turned out to be a frozen super-Earth

astronomy, exoplanets, planetary science, Science / /

Like Earth, but super —

The density makes it look like a water world, but its dim host star keeps it cool.

–

Image of three planets on a black background, with the two on the left being mostly white, indicating an icy composition. The one on the right is much smaller, and represents Earth.

Enlarge / Renditions of a possible composition of LHS 1140 b, with a patch of ocean on the side facing its host star. Earth is included at right for scale.

Of all the potential super-Earths—terrestrial exoplanets more massive than Earth—out there, an exoplanet orbiting a star only 40 light-years away from us in the constellation Cetus might be the most similar to have been found so far.

Exoplanet LHS 1140 b was assumed to be a mini-Neptune when it was first discovered by NASA’s James Webb Space Telescope toward the end of 2023. After analyzing data from those observations, a team of researchers, led by astronomer Charles Cadieux, of Université de Montréal, suggest that LHS 1140 b is more likely to be a super-Earth.

If this planet is an alternate version of our own, its relative proximity to its cool red dwarf star means it would most likely be a gargantuan snowball or a mostly frozen body with a substellar (region closest to its star) ocean that makes it look like a cosmic eyeball. It is now thought to be the exoplanet with the best chance for liquid water on its surface, and so might even be habitable.

Cadieux and his team say they have found “tantalizing evidence for a [nitrogen]-dominated atmosphere on a habitable zone super-Earth” in a study recently published in The Astrophysical Journal Letters.

Sorry, Neptune…

In December 2023, two transits of LHS 1140 b were observed with the NIRISS (Near-Infrared Imager and Slitless Spectrograph) instrument aboard Webb. NIRISS specializes in detecting exoplanets and revealing more about them through transit spectroscopy, which picks up the light of an orbiting planet’s host star as it passes through the atmosphere of that planet and travels toward Earth. Analysis of the different spectral bands in that light can then tell scientists about the specific atoms and molecules that exist in the planet’s atmosphere.

To test the previous hypothesis that LHS 1140 b is a mini-Neptune, the researchers created a 3D global climate model, or GCM. This used complex math to explore different combinations of factors that make up the climate system of a planet, such as land, oceans, ice, and atmosphere. Several different GCMs of a mini-Neptune were compared with the light spectrum observed via transit spectroscopy. The model for a mini-Neptune typically involves a gas giant with a thick, cloudless or nearly cloudless atmosphere dominated by hydrogen, but the spectral bands of this model did not match NIRISS observations.

With the possibility of a mini-Neptune being mostly ruled out (though further observations and analysis will be needed to confirm this), Cadieux’s team turned to another possibility: a super-Earth.

An Earth away from Earth?

The spectra observed with NIRISS were more in line with GCMs of a super-Earth. This type of planet would typically have a thick nitrogen or CO2-rich atmosphere enveloping a rocky surface on which there was some form of water, whether in frozen or liquid form.

The models also suggested a secondary atmosphere, which is an atmosphere formed after the original atmosphere of light elements, (hydrogen and helium) escaped during early phases of a planet’s formation. Secondary atmospheres are formed from heavier elements released from the crust, such as water vapor, carbon dioxide, and methane. They’re usually found on warm, terrestrial planets (Earth has a secondary atmosphere).

The most significant Webb/NIRISS data that did not match the GCMs was that the planet has a lower density (based on measurements of its size and mass) than expected for a rocky world. This is consistent with a water world with a mass that’s about 10 to 20 percent water. Based on this estimate, the researchers think that LHS 1140 b might even be a hycean planet—an ocean planet that has most of the attributes of a super-Earth, but an atmosphere dominated by hydrogen instead of nitrogen.

Since it orbits a dim star closely enough to be tidally locked, some models suggest a mostly icy planet with a substellar liquid ocean on its dayside.

While LHS 1140 b may be a super-Earth, the hycean planet hypothesis might end up being ruled out. Hycean planets are prone to the runaway greenhouse effect, which occurs when enough greenhouse gases accumulate in a planet’s atmosphere and prevent heat from escaping. Liquid water will eventually evaporate on a planet that cannot cool itself off.

Though we are getting closer to finding out what kind of planet LHS 1140 b is, and whether it could be habitable, further observations are needed. Cadieux wants to continue this research by comparing NIRISS data with data on other super-Earths that had previously been collected by Webb’s Near-Infrared Spectrograph, or NIRSpec, instrument. At least three transit observations of the planet with Webb’s MIRI, or Mid-Infrared instrument, are also needed to make sure stellar radiation is not interfering with observations of the planet itself.

“Given the limited visibility of LHS 1140b, several years’ worth of observations may be required to detect its potential secondary atmosphere,” the researchers said in the same study.

So could this planet really be a frozen exo-earth? The suspense is going to last a few years.

The Astrophysical Journal Letters, 2024.  DOI:  10.3847/2041-8213/ad5afa

Mini-Neptune turned out to be a frozen super-Earth Read More »

apple-vision-pro’s-content-drought-improves-with-new-3d-videos

Apple Vision Pro’s content drought improves with new 3D videos

Apple, Apple TV, culture, Immersive Video, Mixed Reality, Tech, virtual reality, vision pro, visionOS / /

Immersive Video —

It’s still not the weekly cadence we expected, but it’s something.

–

  • Boundless premieres tonight, taking Vision Pro users on a hot air balloon ride in Turkey.

  • Submerged will be Apple’s first fictional short film for Vision Pro.

  • Users will get a glimpse into the 2024 NBA All-Star Weekend.

  • This cryptic image teases The Weeknd’s Vision Pro “experience.”

  • The new series Elevated will tour places of interest around the world from above.

  • Apple is partnering with Red Bull for a surfing documentary.

  • Wild Life returns with an episode about elephants in a wildlife preserve.

Today, Apple announced a slate of more than a dozen upcoming Immersive Videos for its Vision Pro spatial reality headset. The first, titled Boundless, launches tonight at 9 pm ET. More will follow in the coming weeks and months.

The announcement follows a long, slow period for new Vision Pro-specific video content from Apple. The headset launched in early February with a handful of Immersive Video episodes ranging from five to 15 minutes each. Since then, only three new videos have been added.

On March 28, Apple released a highlight reel of Major League Soccer plays from the season that had ended months prior. A second episode of Prehistoric Planet, Apple’s Immersive Video dinosaur nature documentary, went live on April 19. Likewise, a new episode of the Adventure series titled “Parkour” landed on May 24.

The MLS video played more like a short ad for Apple’s MLS programming than anything else, but other Immersive Videos have impressed with their quality if not their creative ambition. They’re all short videos that put the viewer inside a moment in space and time with either animals or people doing their thing. The videos are high-resolution, and the 3D is generally well done. The production values are high, even if the narratives are light. They come across as tech demos, as much as anything, but they are impressive.

Tonight’s Boundless episode will allow viewers to see what it’s like to ride in a hot air balloon over sweeping vistas. Another episode titled “Arctic Surfing” will arrive this fall, Apple says. Sometime next month, Apple will publish the second episode of its real wildlife documentary, simply titled Wild Life. The episode will focus on elephants in Kenya’s Sheldrick Wildlife Trust. Another episode is in the works, too. “Later this year,” Apple writes in its newsroom post, “viewers will brave the deep with a bold group of divers in the Bahamas, who come face-to-face with apex predators and discover creatures much more complex than often portrayed.”

More on the way

In September, we’ll see the debut of a new Immersive Video series titled Elevated. Apple describes it as an “aerial travel series” in which viewers will fly over places of interest. The first episode will take viewers to Hawaii, while another planned for later this year will go to New England.

Apple is additionally partnering with Red Bull for a look at surfing called Red Bull: Big-Wave Surfing.

In addition to those documentary episodes, there will be three short films by year’s end. One will be a musical experience featuring The Weeknd, and another will take basketball fans inside the 2024 NBA All-Star Weekend. There will also be Submerged, the first narrative fictional Immersive Video on the platform. It’s an action short film depicting struggles on a submarine during World War II.

It’s good to see Apple finally making some movement here; the drought of content after the launch didn’t inspire confidence in the platform. Many people with mixed reality headsets use them a bunch for a few weeks but either fail to find ways to fit them into their daily habits or run out of compelling content and taper off before long. To keep people invested in visionOS, Apple needs to keep a rapid cadence of new content that users look forward to at least every week. Otherwise, some users will see their headsets sit on shelves, forgotten.

When I reviewed the Vision Pro, I assumed that the Immersive Video episodes would roll out weekly. That hasn’t proven the case, and it still doesn’t look like it will. Apple is going to have to invest more in content (and take more risks with that content, moving beyond short tech demo documentaries) to make the Vision Pro stick with customers.

Listing image by Apple

Apple Vision Pro’s content drought improves with new 3D videos Read More »

netflix-is-kicking-us-subscribers-off-its-cheapest-ad-free-plan-soon

Netflix is kicking US subscribers off its cheapest ad-free plan soon

ads, netflix, streaming, Tech / /

It was only a matter of time —

Subscribers will have to pay $15.49 for commercial-free Netflix.

–

cobra kai

Enlarge / Ad-free Basic subscribers will be crane-kicked off the plan soon.

Netflix/YouTube

Netflix today confirmed suspicions that it will stop letting people pay $12 per month to stream without commercials.

The ad-free Basic plan was the cheapest way to watch Netflix without commercials. The plan limits users to 720p resolution and one device and lets people download content. Netflix stopped offering the Basic plan to new subscribers in January. In June, Netflix started booting subscribers in the UK and Canada off the plan and automatically put them onto a cheaper subscription plan with ads.

In a letter to shareholders today [PDF], Netflix confirmed publicly for the first time that it “will now start” to phase out the ad-free Basic plan in the US and France. This will make the cheapest commercial-free Netflix plan $15.49/month in the US. That Standard plan supports up to two devices, downloads, and 1080p resolution.

Netflix thinks killing the Basic plan will help it gain more subscribers who watch commercials, which, on average, generates more revenue for the company.

As expected from a streaming company these days, Netflix touted its ad tier to shareholders, noting that the $7 tier now represents “over 45 percent” of new sign-ups in areas where it’s sold. Per Netflix’s letter, ads will only be an increasingly larger part of its strategy, as Netflix aims to “achieve critical ad subscriber scale for advertisers in our ad countries in 2025, creating a strong base from which we can further increase our ad membership in 2026 and beyond.”

The news comes as streamers grapple with increasing streaming subscription costs. Netflix most recently hiked pricing in October. In January, the company suggested to shareholders that more price hikes were possible, saying that it would “occasionally ask our members to pay a little extra to reflect” platform improvements.

Not cozying up with competition

If today’s news makes you hope for a convenient streaming-only deal that lets you subscribe to Netflix and another video streaming service for cheaper, you’re out of luck. Netflix today said it’s not interested in streaming-only bundles.

Bundle deals, which combine streaming and other services for a cheaper subscription rate, have become the streaming industry’s answer to high cancellation rates among subscribers, including those who quickly cancel and resubscribe depending on what’s available to stream that month.

In its letter, Netflix noted that although cable or mobile providers or device-makers may offer deals combining Netflix and another streaming service, Netflix does not make deals that bundle it with another rival streamer, like Disney+ or Max. The company claimed that Netflix is already “a go-to destination,” which “limits the benefit to Netflix of bundling directly with other streamers.”

That means if you’re hoping to save money on your Netflix subscription, which keeps getting more expensive, the only options are to watch Netflix with commercials or get a cable-reminiscent bundle that includes a different kind of service, like Comcast or Verizon Wireless.

We know which option Netflix would like you to pick. But for frustrated streamers, finding a reasonable way to watch all the stuff you want online the way you want keeps getting harder.

Netflix added 8 million subscribers in Q2 2024, it said today. It’s still the biggest video streaming service by subscriber count at 278 million. Amazon Prime Video, which claimed “over 200 million” users in April, follows.

Netflix is kicking US subscribers off its cheapest ad-free plan soon Read More »

Navigating the CrowdStrike Outage: Insights from a Tech Industry Veteran

Navigating / /

As a seasoned CIO/CISO and tech industry analyst with 35 years of experience, I’ve seen my fair share of cybersecurity incidents. However, the recent CrowdStrike outage stands out due to its extensive impact across multiple sectors. Here’s a deep dive into what happened, the repercussions, and the lessons we can all learn from this incident.

Background and Initial Reaction

I started my journey in IT in the late ’80s when I wrote a piece of software called PleadPerfect. Over the years, I’ve worn many hats—engineer, architect, and executive at both large and small companies. For the last 18 years, I’ve been a CIO/CISO for organizations ranging from 8-11 figures in revenue.

When I first heard about the CrowdStrike-related outage, my initial reaction was one of deep concern. I took a moment of silence in honor of the lost hours my peers and fellow IT pros sacrificed with their families to fix a problem that should never have occurred. The lack of good QA practices shown by CrowdStrike is deeply upsetting. They should have caught this issue in testing before releasing it to the public. The fact that it affected every Windows OS since 2008 is inexcusable.

Understanding the Incident

CrowdStrike’s Falcon software is installed at the core of the OS, which is how it protects machines so effectively. However, this tight integration also causes significant problems when updates are not properly tested. The faulty update led to widespread instances of the “Blue Screen of Death” (BSOD), causing machines to crash and not automatically recover. The recovery process involved booting machines in safe mode and deleting a CrowdStrike file—a task complicated by the inability to remotely enter safe mode on every device/OS. Additionally, best practices dictate securing the boot drive with BitLocker, which requires a key to unlock and enter safe mode. These keys are often stored in systems also affected by this flaw, greatly increasing the effort and time required for recovery.

Such incidents are not uncommon in the cybersecurity industry, but this one is particularly damaging because it stems from a QA and testing issue, not a cybersecurity breach. The tight integration between Falcon and the OS made the damage far more widespread and the recovery process far more onerous.

Impact on Businesses and Services

All sectors and industries were affected, but critical infrastructure sectors were hit the hardest. Transportation (airlines), banking/financial services, and healthcare (hospitals and emergency rooms) pose the most risk to world economies when disrupted. The three biggest US airlines, as well as those around the world, experienced grounded flights and communication issues. Banks in many countries went offline, and hospital networks faced significant disruptions.

Response and Resolution

CrowdStrike’s response to the incident was swift, but I am not sure what more they can do at this point. I did not feel George Kurtz’s (the CEO) apology was “full-throated” and took sufficient responsibility for the incident. This is nobody else’s fault but CrowdStrike’s. While they have committed to helping everyone affected, they have 24,000 customers, all of whom are impacted, so they cannot give each the attention they need. Billions of dollars in damage are being done to those companies from this outage.

Lessons Learned

The key lessons from this incident are clear: Be careful where you place your trust in other companies and partners. Ensure your contracts allow you to seek damages, as that may be the only recourse in such situations. Have a comprehensive disaster recovery (DR) plan and test it regularly. The number of companies having to rebuild their backup infrastructure just to restore systems because they cannot access (or do not have) their BitLocker keys is far too great.

To better prepare for and prevent similar issues, develop and thoroughly test your recovery plans. Consider using a completely different set of security tools for backup and recovery to avoid similar attack vectors. Treat backup and recovery infrastructure as a critical business function and harden it as much as possible.

Future of Cybersecurity

Time will tell how this incident influences future cybersecurity practices and policies. Between the SolarWinds and CrowdStrike issues, both being failures of best practices by the companies themselves, something has to change.

Emerging technologies like AI and machine learning could help predict and prevent similar issues by identifying potential vulnerabilities before they become problems. However, the real fix may lie in revamping processes and possibly having independent bodies audit and certify the practices of technology companies.

Personal Insights

As someone deeply involved in the tech industry, I stay updated with the latest cybersecurity trends and threats by reading extensively, following industry developments, consuming relevant content, talking to peers, and moving out of my silo to share and learn from others.

My advice to fellow CIOs and CISOs is simple: Plan for the worst and test for the worst. If you fail to prepare for these kinds of incidents, you will be in the worst possible position when the board asks for your response.

Final Thoughts

The recent CrowdStrike outage was a wake-up call for many in the tech industry. It highlighted the vulnerabilities inherent in our interconnected world and underscored the need for robust cybersecurity measures. By learning from this incident and implementing the lessons outlined above, we can better prepare for and prevent similar issues in the future.

Stay vigilant, stay prepared, and let’s continue to fortify our defenses against the ever-evolving landscape of cybersecurity threats.

Navigating the CrowdStrike Outage: Insights from a Tech Industry Veteran Read More »

illegal-drug-found-in-diamond-shruumz-candies-linked-to-severe-illnesses

Illegal drug found in Diamond Shruumz candies linked to severe illnesses

diamond shruumz, hallucinogenic, health, muscimol, Mushroom, poison, psilocin, psilocybin, psychedelics, Science / /

More drugs —

New testing finds psilocin, related to psilocybin, in gummies purchased in 2023.

–

Illegal drug found in Diamond Shruumz candies linked to severe illnesses

Newly released testing data of Diamond Shruumz-brand gummies purchased in 2023 identified the presence of psilocin, a hallucinogenic drug closely related to the magic-mushroom drug psilocybin that is classified as a Schedule I drug, alongside psilocybin, heroin, and LSD.

The finding comes as Diamond Shruumz’s current line of gummies, chocolates, and candy cones is being recalled and are under active investigation in connection to a nationwide rash of severe illnesses, which have involved seizures, intubation, and intensive care. As of the latest update on July 15, 69 people in 28 states have been sickened after eating a Diamond Shruumz product. Sixty of the 69 sought medical care, 36 were hospitalized, and there is one potentially associated death under investigation.

The new finding of psilocin in the products, published by researchers at the University of Virginia, adds to growing concern about psychedelic mushroom candies generally. Although the candies are marketed as being legal, they have often been found to contain various undisclosed illegal drugs, gray market synthetic versions of drugs, as well as dangerous adulterants and contaminants.

In the ongoing investigation of Diamond Shruumz candies—led by the Food and Drug Administration and the Centers for Disease Control and Prevention, with the help of America’s Poison Centers and state and local partners—researchers have not identified psilocin in products linked to the illnesses. Instead, they have found a closely related synthetic hallucinogenic compound called 4-acetoxy-N,N-dimethyltryptamine, also known as psilacetin or 4-AcO-DMT. Psilacetin is thought to be metabolized into psilocin in the body and is said to have similar effects as taking magic mushrooms or psilocybin. The different testing results between the FDA-led investigation and the new UVA study may be due to possible formulation changes between 2023 and 2024 or simply differences in the products or batches of candies tested so far.

The UVA researchers, who published their findings in the CDC’s Morbidity and Mortality Weekly Report, looked into the mushroom candies after four adults reported illnesses to a local poison control center between September and November 2023. The people went to the emergency department with tachycardia, confusion, anxiety or somnolence, and nausea after eating gummy candies labeled as containing Amanita muscaria mushrooms. Amid their investigation into those cases, a 3-year-old also fell ill in June 2024 after accidentally eating two gummies sold as containing A. muscaria. All of the adults and the toddler recovered from their illnesses quickly, though the toddler was hospitalized for a day for observation.

Not legal or safe

A. muscaria is a legal hallucinogenic mushroom that contains psychoactive compounds ibotenic acid and muscimol. These resemble neurotransmitters in the brain and can cause gastrointestinal symptoms, agitation, and seizures.

The UVA researchers couldn’t track down the specific brands or products the sickened adults took, but they collected six similar products from nearby gas stations and smoke shops. Those six products included two Diamond Shruumz products, which were not sold as containing A. muscaria. Using liquid chromatography-mass spectrometry, the researchers found that the two Diamond Shruumz gummy products (Sour Peach Apple and Rainbow flavors) contained psilocin. The Rainbow flavor also contained caffeine.

In addition, a product labeled as “Wonderland Legal Psychedelics Cherry Nirvana” contained psilocin, the synthetic hallucinogen N,N-dimethyltryptamine, a compound found in kratom called mitragynine, and caffeine.  A product labeled as “Urb Magic Amanita Mushroom Watermelon” contained psilocybin, psilocin, and the stimulant 2-phenethylamine. A product called “Psilly’s Legal Psychedelic Mushrooms Fruit Punch” contained the stimulant ephedrine, and the product “Tryp mushroom gummies” wasn’t found to contain any concerning compounds.

The UVA study was not able to test for ibotenic acid or muscimol. In Diamond Shruumz’s recall notice, the company said it had found higher than normal levels of muscimol in its products. FDA testing has not identified muscimol in product testing, according to results released so far.

“People tend to equate ‘legal’ with ‘safe,’ which is not necessarily the case. These products are not regulated and can contain any number of unlabeled substances which, when consumed, can cause undesired symptoms,” lead author of the UVA study Avery Michienzi said in a statement. “Some packages will have QR codes showing that the products were tested in a lab and contain only what they are labeled to contain. These have been found to be inaccurate.”

The FDA this week warned that even though all of Diamond Shruumz’s products have been recalled, they remain on the shelves of stores nationwide. The agency said it is reaching out to industry partners to raise awareness of the recall and monitoring the effectiveness of Diamond Shruumz’s recall efforts.

Illegal drug found in Diamond Shruumz candies linked to severe illnesses Read More »

formula-e-wraps-its-10th-season-this-weekend—what’s-next-for-the-sport?

Formula E wraps its 10th season this weekend—what’s next for the sport?

Cars, Formula E / /

gen3 eco sounds good —

Team bosses and Formula E’s CEO tell us what has worked and where things go next.

–

Antonio Felix da Costa, TAG Heuer Porsche Formula E Team, Porsche 99X Electric Gen3

Enlarge / Antonio Felix da Costa leads the way into turn one at Portland International Raceway.

Sam Bagnall/Formula E

PORTLAND, Ore.—Formula E wraps up its 10th series with a pair of races in London this weekend. It’s been a competitive manufacturer’s championship between Porsche and Jaguar. This weekend, seven drivers are still in contention to win the driver’s title after a double-header in Portland on June 29-30 that saw cars going five-wide down the main straight as they reached the highest top speeds of the season. It was the second visit by Formula E to the picturesque Portland International Raceway, and Ars spoke with some of the sport’s bigwigs to see what they think it’s getting right and where the technical evolution of the cars is headed.

Formula E has come a long way since 2014. Racing then exclusively in city centers, the cars were slow at first. And even as they developed, they carried too small a battery to complete even a relatively short race distance. There was a big upgrade in 2018 with the start of season five: The Gen2 car now has battery packs sufficient for 45 minutes-plus-a-lap races. The Gen2 car raced well, too, even putting on a better show at Monaco than Formula 1 has been able to muster for decades.

We expected another big improvement in lap times when the Gen3 car arrived at the start of last season. The Gen3 car featured much less weight and much more power, but also a change of tire supplier. Originally meant to last multiple race weekends, the rubber supplied by Hankook this season and last has much less grip than the Michelins it replaced. That’s kept cornering speeds relatively low and made the cars even harder to drive.

There are no bad drivers in Formula E, but the cars are hard to handle.

Enlarge / There are no bad drivers in Formula E, but the cars are hard to handle.

Sam Bagnall/Getty Images.

That is not necessarily a bad thing, as the series has always written the rules to make things hard on the drivers and teams. For example, while the battery packs are larger now, they still don’t actually have quite enough charge to complete a race distance without careful energy management. But while the race officials get data-rich telemetry streams from all the cars during a race, the teams have to rely on each driver keeping tabs on their own state of charge and reporting that back via radio to the engineers in the garage so the boffins can calculate the optimal strategy.

More technical changes are in store. In 2025 and 2026, the series will move to the Gen3 Evo car, which will have on-demand all-wheel drive and more grip from better tires, among other tweaks. Meanwhile, everyone in Formula E has been thinking hard about Gen4, which is due to arrive for season 13.

What has worked?

I asked Formula E CEO Jeff Dodds, as well as some of the team principals, to start off by blowing their own horns a bit—what’s Formula E been doing right? “We’ve just announced our Gen3 Evo car, which gets to 60 miles an hour in 1.8 seconds, and we’re still an infancy business, only 10 years old, still playing around with early tech. So I think over time, a massive strength of ours is how that technology allows performance of the car to improve,” Dodds said.

At Portland, we saw pack racing down the main straight.

Enlarge / At Portland, we saw pack racing down the main straight.

Simon Galloway/Formula E

McLaren team principal Ian James, who previously led Mercedes to a Formula E championship before it quit the sport, was proud of how far Formula E has come over the last decade. “Gen2 really saw a step forward in that respect and a professionalization of the whole series. I think with Gen3 we’re really starting to unlock the performance potential of electric motorsport. And we’re going to see that take another notch up in Gen3 Evo,” James said.

Existing as a relevant arena for electric vehicle R&D is Formula E’s big strength, according to Nissan team principal Tommaso Volpe. “Representing a big car manufacturer in the sport I think the main strength is how relevant it is for a big transformation that is happening in mobility… using electrification as a key technology,” Volpe said. This is something that the motorsports cannot claim. They have other strengths, but they can not claim to be that relevant, purely speaking from the R&D perspective,” Volpe said.

For a company like Nissan, the primary benefit is still getting its EV tech in front of eyeballs, something Formula E’s deal to stream races live over Roku has no doubt helped. But there are other benefits to participation. “You cannot use the same motor, but the efforts that we put in place when we develop a Formula E car, in maximizing the energy efficiency of the hardware—so the materials we use, the solutions, the design—is something that is absolutely relevant for the core business and you can transfer some of these ideas and experience,” Volpe said.

Formula E wraps its 10th season this weekend—what’s next for the sport? Read More »

crowdstrike-fixes-start-at-“reboot-up-to-15-times”-and-get-more-complex-from-there

CrowdStrike fixes start at “reboot up to 15 times” and get more complex from there

azure, Biz & IT, BSOD, Crowdstrike, microsoft, microsoft azure, Tech / /

turning it off and back on again, and again, and again —

Admins can also restore backups or manually delete CrowdStrike’s buggy driver.

–

CrowdStrike fixes start at “reboot up to 15 times” and get more complex from there

Airlines, payment processors, 911 call centers, TV networks, and other businesses have been scrambling this morning after a buggy update to CrowdStrike’s Falcon security software caused Windows-based systems to crash with a dreaded blue screen of death (BSOD) error message.

We’re updating our story about the outage with new details as we have them. Microsoft and CrowdStrike both say that “the affected update has been pulled,” so what’s most important for IT admins in the short term is getting their systems back up and running again. According to guidance from Microsoft, fixes range from annoying but easy to incredibly time-consuming and complex, depending on the number of systems you have to fix and the way your systems are configured.

Microsoft’s Azure status page outlines several fixes. The first and easiest is simply to try to reboot affected machines over and over, which gives affected machines multiple chances to try to grab CrowdStrike’s non-broken update before the bad driver can cause the BSOD. Microsoft says that some of its customers have had to reboot their systems as many as 15 times to pull down the update.

Early guidance for fixing the CrowdStrike bug is simply to reboot systems over and over again so that they can try to grab a non-broken update.

Enlarge / Early guidance for fixing the CrowdStrike bug is simply to reboot systems over and over again so that they can try to grab a non-broken update.

Microsoft

If rebooting doesn’t work

If rebooting multiple times isn’t fixing your problem, Microsoft recommends restoring your systems using a backup from before 4: 09 UTC on July 18 (just after midnight on Friday, Eastern time), when CrowdStrike began pushing out the buggy update. Crowdstrike says a reverted version of the file was deployed at 5: 27 UTC.

If these simpler fixes don’t work, you may need to boot your machines into Safe Mode so you can manually delete the file that’s causing the BSOD errors. For virtual machines, Microsoft recommends attaching the virtual disk to a known-working repair VM so the file can be deleted, then reattaching the virtual disk to its original VM.

The file in question is a CrowdStrike driver located at Windows/System32/Drivers/CrowdStrike/C-00000291*.sys. Once it’s gone, the machine should boot normally and grab a non-broken version of the driver.

Deleting that file on each and every one of your affected systems individually is time-consuming enough, but it’s even more time-consuming for customers using Microsoft’s BitLocker drive encryption to protect data at rest. Before you can delete the file on those systems, you’ll need the recovery key that unlocks those encrypted disks and makes them readable (normally, this process is invisible, because the system can just read the key stored in a physical or virtual TPM module).

This can cause problems for admins who aren’t using key management to store their recovery keys, since (by design!) you can’t access a drive without its recovery key. If you don’t have that key, Cryptography and infrastructure engineer Tony Arcieri on Mastodon compared this to a “self-inflicted ransomware attack,” where an attacker encrypts the disks on your systems and withholds the key until they get paid.

And even if you do have a recovery key, your key management server might also be affected by the CrowdStrike bug.

We’ll continue to track recommendations from Microsoft and CrowdStrike about fixes as each company’s respective status pages are updated.

“We understand the gravity of the situation and are deeply sorry for the inconvenience and disruption,” wrote CrowdStrike CEO George Kurtz on X, formerly Twitter. “We are working with all impacted customers to ensure that systems are back up and they can deliver the services their customers are counting on.”

CrowdStrike fixes start at “reboot up to 15 times” and get more complex from there Read More »

major-outages-at-crowdstrike,-microsoft-leave-the-world-with-bsods-and-confusion

Major outages at CrowdStrike, Microsoft leave the world with BSODs and confusion

airlines, Biz & IT, Crowdstrike, Cybersecurity, falcon sensor, global outage, microsoft, microsoft azure, Security / /

Y2K24 —

Nobody’s sure who’s at fault for each outage: Microsoft, CrowdStrike, or both.

–

A passenger sits on the floor as long queues form at the check-in counters at Ninoy Aquino International Airport, on July 19, 2024 in Manila, Philippines.

Enlarge / A passenger sits on the floor as long queues form at the check-in counters at Ninoy Aquino International Airport, on July 19, 2024 in Manila, Philippines.

Ezra Acayan/Getty Images

Millions of people outside the IT industry are learning what CrowdStrike is today, and that’s a real bad thing. Meanwhile, Microsoft is also catching blame for global network outages, and between the two, it’s unclear as of Friday morning just who caused what.

After cybersecurity firm CrowdStrike shipped an update to its Falcon Sensor software that protects mission-critical systems, blue screens of death (BSODs) started taking down Windows-based systems. The problems started in Australia and followed the dateline from there.

TV networks, 911 call centers, and even the Paris Olympics were affected. Banks and financial systems in India, South Africa, Thailand, and other countries fell as computers suddenly crashed. Some individual workers discovered that their work-issued laptops were booting to blue screens on Friday morning. The outages took down not only Starbucks mobile ordering, but also a single motel in Laramie, Wyoming.

Airlines, never the most agile of networks, were particularly hard-hit, with American Airlines, United, Delta, and Frontier among the US airlines overwhelmed Friday morning.

CrowdStrike CEO “deeply sorry”

Fixes suggested by both CrowdStrike and Microsoft for endlessly crashing Windows systems range from “reboot it up to 15 times” to individual driver deletions within detached virtual OS disks. The presence of BitLocker drive encryption on affected devices further complicates matters.

CrowdStrike CEO George Kurtz posted on X (formerly Twitter) at 5: 45 am Eastern time that the firm was working on “a defect found in a single content update for Windows hosts,” with Mac and Linux hosts unaffected. “This is not a security incident or cyberattack. The issue has been identified, isolated and a fix has been deployed,” Kurtz wrote. Kurtz told NBC’s Today Show Friday morning that CrowdStrike is “deeply sorry for the impact that we’ve caused to customers.”

As noted on Mastodon by LittleAlex, Kurtz was the Chief Technology Officer of security firm McAfee when, in April 2010, that firm sent an update that deleted a crucial Windows XP file that caused widespread outages and required system-by-system file repair.

The costs of such an outage will take some time to be known, and will be hard to measure. Cloud cost analyst CloudZero estimated mid-morning Friday that the CrowdStrike incident had already cost $24 billion, based on a previous estimate.

Multiple outages, unclear blame

Microsoft services were, in a seemingly terrible coincidence, also down overnight Thursday into Friday. Multiple Azure services went down Thursday evening, with the cause cited as “a backend cluster management workflow [that] deployed a configuration change causing backend access to be blocked between a subset of Azure Storage clusters and compute resources in the Central US region.”

A spokesperson for Microsoft told Ars in a statement Friday that the CrowdStrike update was not related to its July 18 Azure outage. “That issue has fully recovered,” the statement read.

News reporting on these outages has so far blamed either Microsoft, CrowdStrike, or an unclear mixture of the two as the responsible party for various outages. It may be unavoidable, given that the outages are all happening on one platform, Windows. Microsoft itself issued an “Awareness” regarding the CrowdStrike BSOD issue on virtual machines running Windows. The firm was frequently updating it Friday, with a fix that may or may not surprise IT veterans.

“We’ve received feedback from customers that several reboots (as many as 15 have been reported) may be required, but overall feedback is that reboots are an effective troubleshooting step at this stage,” Microsoft wrote in the bulletin. Alternately, Microsoft recommend customers that have a backup from “before 19: 00 UTC on the 18th of July” restore it, or attach the OS disk to a repair VM to then delete the file (Windows/System32/Drivers/CrowdStrike/C00000291*.sys) at the heart of the boot loop.

Security consultant Troy Hunt was quoted as describing the dual failures as “the largest IT outage in history,” saying, “basically what we were all worried about with Y2K, except it’s actually happened this time.”

United Airlines told Ars that it was “resuming some flights, but expect schedule disruptions to continue throughout Friday,” and had issued waivers for customers to change travel plans. American Airlines posted early Friday that it had re-established its operations by 5 am Eastern, but expected delays and cancellations throughout Friday.

Ars has reached out to CrowdStrike for comment and will update this post with response.

This is a developing story and this post will be updated as new information is available.

Major outages at CrowdStrike, Microsoft leave the world with BSODs and confusion Read More »

fcc-closes-“final-loopholes”-that-keep-prison-phone-prices-exorbitantly-high

FCC closes “final loopholes” that keep prison phone prices exorbitantly high

Policy, prison phone prices / /
A telephone on a wall inside a prison.

Enlarge / A telephone in a prison.

The Federal Communications Commission today voted to lower price caps on prison phone calls and closed a loophole that allowed prison telecoms to charge high rates for intrastate calls. Today’s vote will cut the price of interstate calls in half and set price caps on intrastate calls for the first time.

The FCC said it “voted to end exorbitant phone and video call rates that have burdened incarcerated people and their families for decades. Under the new rules, the cost of a 15-minute phone call will drop to $0.90 from as much as $11.35 in large jails and, in small jails, to $1.35 from $12.10.”

The new rules are expected to take effect in January 2025 for all prisons and for jails with at least 1,000 incarcerated people. The rate caps would take effect in smaller jails in April 2025.

Worth Rises, a nonprofit group advocating for prison reform, said it “estimates that the new rules will impact 83 percent of incarcerated people (about 1.4 million) and save impacted families at least $500 million annually.”

New power over intrastate calls

The FCC has taken numerous votes to lower prison phone rates over the years, but today’s is particularly significant. While the FCC was previously able to cap prices of interstate calls, an attempt to set prices for intrastate calls was struck down in court in 2017.

Prison phone companies could sue again. But the FCC said it now has authority over intrastate prison phone prices because of the Martha Wright-Reed Just and Reasonable Communications Act, which was approved by Congress and signed by President Biden in January 2023. The new law “empowered the FCC to close the final loopholes in the communications system,” the commission said.

The 2023 law—named for a grandmother who campaigned for lower prison phone rates—”removes the principal statutory limitations that had prevented the Commission from setting comprehensive just and reasonable rates,” the FCC said. Specifically, the law removed “limits to the Commission’s ability to regulate rates for intrastate calls and video communications.”

More than half of prison audio call traffic is intrastate, with the calling and called parties both in the same state, according to data in a draft of the FCC order released before the meeting.

The FCC’s work to reduce prison phone rates “was not always embraced by the courts,” Chairwoman Jessica Rosenworcel said today. “We were told—over and over again—that the commission did not have the authority to address every aspect of these rates, because while interstate calls fell within our jurisdiction, intrastate calls did not.”

Previously, the FCC imposed price caps on interstate calls ranging from $0.14 to $0.21 per minute for audio calls, depending on the size of the facility. Going forward, a uniform set of price caps ranging from $0.06 to $0.12 per minute will apply to both interstate and intrastate calls.

FCC closes “final loopholes” that keep prison phone prices exorbitantly high Read More »