CrowdStrike
| Type: | Public |
|---|---|
| Traded As: | Template:Ubl |
| Founded: | Template:Start date and ageend_date |
| Founders: | Template:Ubl |
| Industry: | Information security |
| HQ Location City : | Austin, Texas |
| HQ Country : | {{{chq_location_country }}} |
| key_people : | Template:Ubl |
| Number of Employees : | 7,925 |
| Revenue : | Template:Increase Template:US$ |
| Website : | Template:Official URL |
CrowdStrike Holdings, Inc. is an American cybersecurity technology company based in Austin, Texas. It provides endpoint security, threat intelligence, and cyberattack response services.[1]
The company has been involved in investigations of several high-profile cyberattacks, including the 2014 Sony Pictures hack, the 2015–16 cyberattacks on the Democratic National Committee (DNC), and the 2016 email leak involving the DNC.[2][3] In July 2024, a faulty update to its security software caused global computer outages that disrupted air travel, banking, broadcasting, and other services.[4][5][6]
History
[edit | edit source]Founding: 2011–2019
[edit | edit source]CrowdStrike was co-founded in 2011 by George Kurtz (CEO), Dmitri Alperovitch (former CTO), and Gregg Marston (CFO, retired).[7][8][9][10] The following year, they hired Shawn Henry, a former Federal Bureau of Investigation (FBI) official, to lead the subsidiary CrowdStrike Services, Inc., which offered security and response services.[11][12] The company launched CrowdStrike Falcon, an antivirus package, as its first product in June 2013.[13][14]
In May 2014, CrowdStrike's reports helped the United States Department of Justice to charge five Chinese military hackers with economic cyber espionage against U.S. corporations.[15] CrowdStrike also uncovered the activities of Energetic Bear, a group connected to Russia's Federal Security Service that conducted intelligence operations against global targets, primarily in the energy sector.[16]
After the Sony Pictures hack, CrowdStrike uncovered evidence implicating the government of North Korea and demonstrated how the attack was carried out.[17] In 2014, CrowdStrike helped identify members of Putter Panda, the state-sponsored Chinese group of hackers also known as PLA Unit 61486.[18][19]
In May 2015, the company released information about VENOM, a critical flaw in an open-source hypervisor called Quick Emulator (QEMU) that allowed attackers to access sensitive personal information.[20][21] In October 2015, CrowdStrike announced that it had identified Chinese hackers attacking technology and pharmaceutical companies around the time that U.S. President Barack Obama and China's leader Xi Jinping publicly agreed not to conduct economic espionage against each other. The alleged hacking would have been in violation of that agreement.[22]
In July 2015, Google invested in the company's Series C funding round, which was followed by Series D and Series E, raising a total of $480 million as of May 2019.[23][24][25]
In 2017, the company reached a valuation of more than $1 billion with an estimated annual revenue of $100 million.[26] In June 2018, the company said it was valued at more than $3 billion.[24] Investors include Telstra, March Capital Partners, Rackspace, Accel Partners and Warburg Pincus.[27][28]
In June 2019, the company made an initial public offering on the Nasdaq.[29][30]
Acquisitions: 2020–2024
[edit | edit source]In September 2020, CrowdStrike acquired zero trust and conditional access technology provider Preempt Security for $96 million.[31] In February 2021, the company acquired Danish log management platform Humio for $400 million with plans to integrate Humio's log aggregation into CrowdStrike's XDR offering.[32] Later that November, CrowdStrike acquired SecureCircle, a SaaS-based cybersecurity service that extends zero trust endpoint security to include data.[33] In December 2021, the company moved its headquarters location from Sunnyvale, California, to Austin, Texas.[34] In 2023, CrowdStrike introduced CrowdStream service in collaboration with Cribl.io.[35] CrowdStrike has also focused on working with the U.S. government and selling its services to government agencies.[36] CrowdStrike joined the S&P 500 index in June 2024.[37] In 2023, CrowdStrike acquired Israeli cybersecurity startup Bionic.ai.[38] In 2024, CrowdStrike acquired Israeli startup Flow Security.[39]
Russian hacking investigations
[edit | edit source]CrowdStrike helped investigate the Democratic National Committee cyberattacks and a connection to Russian intelligence services. On March 20, 2017, James Comey testified before congress stating, "CrowdStrike, Mandiant, and ThreatConnect review[ed] the evidence of the hack and conclude[d] with high certainty that it was the work of APT 28 and APT 29 who are known to be Russian intelligence services."[40] Comey previously testified in January 2017 that a request for FBI forensics investigators to access the DNC servers was denied, saying "Ultimately what was agreed to is the private company [CrowdStrike] would share with us what they saw."[41]
In December 2016, CrowdStrike released a report stating that Russian government-affiliated group Fancy Bear had hacked a Ukrainian artillery app.[42] They concluded that Russia had used the hack to cause large losses to Ukrainian artillery units. The app (called ArtOS) is installed on tablet PCs and used for fire-control.[43] CrowdStrike also found a hacked variation of POPR-D30 being distributed on Ukrainian military forums that utilized an X-Agent implant.[44]
The International Institute for Strategic Studies rejected CrowdStrike's assessment that claimed hacking caused losses to Ukrainian artillery units, saying that their data on Ukrainian D30 howitzer losses was misused in CrowdStrike's report. The Ukrainian Ministry of Defense also rejected the CrowdStrike report, stating that actual artillery losses were much smaller than what was reported by CrowdStrike and were not associated with Russian hacking.[45] Prior to this, CrowdStrike had published a report claiming that malware used in Ukraine and against the Democratic National Committee (DNC) appeared to be unique and identical, further evidence for a Russian origin of the DNC attack.[46]
Cybersecurity firm SecureWorks discovered a list of email addresses targeted by Fancy Bear in phishing attacks. The list included the email address of Yaroslav Sherstyuk, the developer of ArtOS.[47] Additional Associated Press research supports CrowdStrike's conclusions about Fancy Bear.[48] Radio Free Europe notes that the AP report "lends some credence to the original CrowdStrike report, showing that the app had, in fact, been targeted."[49]
In the Trump–Ukraine scandal, Donald Trump, then the president of the United States, held a July 25, 2019, phone call with Volodymyr Zelensky, the president of Ukraine, in which Trump asked Zelensky to look into a conspiracy theory that was being promoted on far-right websites such as Breitbart News and Russian state media outlets such as Russia Today and Sputnik.[50] The theory held that namely, that the Ukrainian government used CrowdStrike to hack into the Democratic National Committee's servers in 2016 and frame Russia for the crime to undermine Trump in the 2016 presidential election.[51][52] The conspiracy theory has been repeatedly debunked.[53][54][55]
Severe outage incidents
[edit | edit source]Template:MainCrowdStrike software has a history of causing serious outages on various platforms. At times these are fairly isolated, affecting a specific application[56][57][58] or operating system that is not as widely deployed as others.[59] In some cases, these issues have caused serious outages that impacted servers across the world.
2024 Debian Linux incident
[edit | edit source]On April 19, 2024, it was reported that a flawed software update pushed on a Friday evening was incompatible with up-to-date Debian Linux builds, despite being supported. A week later that caused all of the servers in the lab to crash and refuse to subsequently boot. When CrowdStrike was removed from the machine, it booted fine. CrowdStrike acknowledged the bug a day later and weeks later determined the root case.[60]
2024 Linux incident
[edit | edit source]On May 13, 2024, it was reported that RockyLinux servers with CrowdStrike software may freeze after upgrading to RockyLinux 9.4.[61] CrowdStrike reported that they were aware of the problem as it was the same issue due to a Linux Sensor in user mode combined with specific 6.x kernel versions.[62]
2024 Windows incident
[edit | edit source]On July 19, 2024, CrowdStrike released a software update to the vulnerability scanner Falcon Sensor. Flaws in the update caused blue screens of death on Microsoft Windows machines, disrupting millions of Windows computers worldwide.[63][64] Affected machines were forced into a bootloop, making them unusable. This was caused by an update to a configuration file, Channel File 291, which CrowdStrike says triggered a logic error and caused the operating system to crash.[65] The downtime caused a widespread global impact, grounding commercial airline flights, temporarily taking Sky News and other broadcasters offline, and disrupting banking and healthcare services as well as 911 emergency call centers.[66][67] By the end of the day, CrowdStrike shares closed trading at a price of $304.96, down 38.09 points or 11.10%.[68]
Although CrowdStrike fixed the update, computers stuck in a bootloop were still unable to connect to the Internet to download the patch before Falcon can load in and crash the device again. The recommended solution from CrowdStrike was to boot into safe mode or Windows Recovery Mode and manually delete Channel File 291.[69] This requires local administrator access and if the device is encrypted by Bitlocker will also require a recovery key.[70] Microsoft has reported that some customers have been able to remediate the issue solely by rebooting impacted devices up to 15 times.[71]Template:Pp Template:Current related Template:Short description Template:Use American English Template:Use dmy dates
| Type: | Public |
|---|---|
| Traded As: | Template:Ubl |
| Founded: | Template:Start date and ageend_date |
| Founders: | Template:Ubl |
| Industry: | Information security |
| HQ Location City : | Austin, Texas |
| HQ Country : | {{{chq_location_country }}} |
| key_people : | Template:Ubl |
| Number of Employees : | 7,925 |
| Revenue : | Template:Increase Template:US$ |
| Website : | Template:Official URL |
CrowdStrike Holdings, Inc. is an American cybersecurity technology company based in Austin, Texas. It provides endpoint security, threat intelligence, and cyberattack response services.[72]
The company has been involved in investigations of several high-profile cyberattacks, including the 2014 Sony Pictures hack, the 2015–16 cyberattacks on the Democratic National Committee (DNC), and the 2016 email leak involving the DNC.[73][74] In July 2024, a faulty update to its security software caused global computer outages that disrupted air travel, banking, broadcasting, and other services.[4][75][76]
History
[edit | edit source]Founding: 2011–2019
[edit | edit source]CrowdStrike was co-founded in 2011 by George Kurtz (CEO), Dmitri Alperovitch (former CTO), and Gregg Marston (CFO, retired).[77][78][79][80] The following year, they hired Shawn Henry, a former Federal Bureau of Investigation (FBI) official, to lead the subsidiary CrowdStrike Services, Inc., which offered security and response services.[81][82] The company launched CrowdStrike Falcon, an antivirus package, as its first product in June 2013.[83][84]
In May 2014, CrowdStrike's reports helped the United States Department of Justice to charge five Chinese military hackers with economic cyber espionage against U.S. corporations.[85] CrowdStrike also uncovered the activities of Energetic Bear, a group connected to Russia's Federal Security Service that conducted intelligence operations against global targets, primarily in the energy sector.[86]
After the Sony Pictures hack, CrowdStrike uncovered evidence implicating the government of North Korea and demonstrated how the attack was carried out.[87] In 2014, CrowdStrike helped identify members of Putter Panda, the state-sponsored Chinese group of hackers also known as PLA Unit 61486.[88][89]
In May 2015, the company released information about VENOM, a critical flaw in an open-source hypervisor called Quick Emulator (QEMU) that allowed attackers to access sensitive personal information.[90][91] In October 2015, CrowdStrike announced that it had identified Chinese hackers attacking technology and pharmaceutical companies around the time that U.S. President Barack Obama and China's leader Xi Jinping publicly agreed not to conduct economic espionage against each other. The alleged hacking would have been in violation of that agreement.[92]
In July 2015, Google invested in the company's Series C funding round, which was followed by Series D and Series E, raising a total of $480 million as of May 2019.[93][24][94]
In 2017, the company reached a valuation of more than $1 billion with an estimated annual revenue of $100 million.[95] In June 2018, the company said it was valued at more than $3 billion.[24] Investors include Telstra, March Capital Partners, Rackspace, Accel Partners and Warburg Pincus.[96][97]
In June 2019, the company made an initial public offering on the Nasdaq.[98][99]
Acquisitions: 2020–2024
[edit | edit source]In September 2020, CrowdStrike acquired zero trust and conditional access technology provider Preempt Security for $96 million.[100] In February 2021, the company acquired Danish log management platform Humio for $400 million with plans to integrate Humio's log aggregation into CrowdStrike's XDR offering.[101] Later that November, CrowdStrike acquired SecureCircle, a SaaS-based cybersecurity service that extends zero trust endpoint security to include data.[102] In December 2021, the company moved its headquarters location from Sunnyvale, California, to Austin, Texas.[103] In 2023, CrowdStrike introduced CrowdStream service in collaboration with Cribl.io.[104] CrowdStrike has also focused on working with the U.S. government and selling its services to government agencies.[105] CrowdStrike joined the S&P 500 index in June 2024.[106] In 2023, CrowdStrike acquired Israeli cybersecurity startup Bionic.ai.[107] In 2024, CrowdStrike acquired Israeli startup Flow Security.[108]
Russian hacking investigations
[edit | edit source]CrowdStrike helped investigate the Democratic National Committee cyberattacks and a connection to Russian intelligence services. On March 20, 2017, James Comey testified before congress stating, "CrowdStrike, Mandiant, and ThreatConnect review[ed] the evidence of the hack and conclude[d] with high certainty that it was the work of APT 28 and APT 29 who are known to be Russian intelligence services."[109] Comey previously testified in January 2017 that a request for FBI forensics investigators to access the DNC servers was denied, saying "Ultimately what was agreed to is the private company [CrowdStrike] would share with us what they saw."[110]
In December 2016, CrowdStrike released a report stating that Russian government-affiliated group Fancy Bear had hacked a Ukrainian artillery app.[111] They concluded that Russia had used the hack to cause large losses to Ukrainian artillery units. The app (called ArtOS) is installed on tablet PCs and used for fire-control.[112] CrowdStrike also found a hacked variation of POPR-D30 being distributed on Ukrainian military forums that utilized an X-Agent implant.[113]
The International Institute for Strategic Studies rejected CrowdStrike's assessment that claimed hacking caused losses to Ukrainian artillery units, saying that their data on Ukrainian D30 howitzer losses was misused in CrowdStrike's report. The Ukrainian Ministry of Defense also rejected the CrowdStrike report, stating that actual artillery losses were much smaller than what was reported by CrowdStrike and were not associated with Russian hacking.[114] Prior to this, CrowdStrike had published a report claiming that malware used in Ukraine and against the Democratic National Committee (DNC) appeared to be unique and identical, further evidence for a Russian origin of the DNC attack.[115]
Cybersecurity firm SecureWorks discovered a list of email addresses targeted by Fancy Bear in phishing attacks. The list included the email address of Yaroslav Sherstyuk, the developer of ArtOS.[116] Additional Associated Press research supports CrowdStrike's conclusions about Fancy Bear.[117] Radio Free Europe notes that the AP report "lends some credence to the original CrowdStrike report, showing that the app had, in fact, been targeted."[118]
In the Trump–Ukraine scandal, Donald Trump, then the president of the United States, held a July 25, 2019, phone call with Volodymyr Zelensky, the president of Ukraine, in which Trump asked Zelensky to look into a conspiracy theory that was being promoted on far-right websites such as Breitbart News and Russian state media outlets such as Russia Today and Sputnik.[119] The theory held that namely, that the Ukrainian government used CrowdStrike to hack into the Democratic National Committee's servers in 2016 and frame Russia for the crime to undermine Trump in the 2016 presidential election.[120][121] The conspiracy theory has been repeatedly debunked.[122][123][124]
Severe outage incidents
[edit | edit source]Template:MainCrowdStrike software has a history of causing serious outages on various platforms. At times these are fairly isolated, affecting a specific application[125][126][127] or operating system that is not as widely deployed as others.[128] In some cases, these issues have caused serious outages that impacted servers across the world.
2024 Debian Linux incident
[edit | edit source]On April 19, 2024, it was reported that a flawed software update pushed on a Friday evening was incompatible with up-to-date Debian Linux builds, despite being supported. A week later that caused all of the servers in the lab to crash and refuse to subsequently boot. When CrowdStrike was removed from the machine, it booted fine. CrowdStrike acknowledged the bug a day later and weeks later determined the root case.[129]
2024 Linux incident
[edit | edit source]On May 13, 2024, it was reported that RockyLinux servers with CrowdStrike software may freeze after upgrading to RockyLinux 9.4.[130] CrowdStrike reported that they were aware of the problem as it was the same issue due to a Linux Sensor in user mode combined with specific 6.x kernel versions.[131]
2024 Windows incident
[edit | edit source]On July 19, 2024, CrowdStrike released a software update to the vulnerability scanner Falcon Sensor. Flaws in the update caused blue screens of death on Microsoft Windows machines, disrupting millions of Windows computers worldwide.[132][64] Affected machines were forced into a bootloop, making them unusable. This was caused by an update to a configuration file, Channel File 291, which CrowdStrike says triggered a logic error and caused the operating system to crash.[133] The downtime caused a widespread global impact, grounding commercial airline flights, temporarily taking Sky News and other broadcasters offline, and disrupting banking and healthcare services as well as 911 emergency call centers.[134][135] By the end of the day, CrowdStrike shares closed trading at a price of $304.96, down 38.09 points or 11.10%.[136]
Although CrowdStrike fixed the update, computers stuck in a bootloop were still unable to connect to the Internet to download the patch before Falcon can load in and crash the device again. The recommended solution from CrowdStrike was to boot into safe mode or Windows Recovery Mode and manually delete Channel File 291.[137] This requires local administrator access and if the device is encrypted by Bitlocker will also require a recovery key.[138] Microsoft has reported that some customers have been able to remediate the issue solely by rebooting impacted devices up to 15 times.[139]
See also
[edit | edit source]- Operating systems
- Chinese intelligence activity abroad
- Chinese intelligence operations in the United States
- Timeline of Russian interference in the 2016 United States elections
- Timeline of investigations into Donald Trump and Russia (January–June 2017)
References
[edit | edit source]Page Template:Reflist/styles.css must have content model "Sanitized CSS" for TemplateStyles (current model is "wikitext").
- ↑ Template:Cite web
- ↑ Template:Cite web
- ↑ Template:Cite news
- ↑ 4.0 4.1 Template:Cite news
- ↑ Template:Cite web
- ↑ Template:Cite web
- ↑ Template:Cite web
- ↑ Template:Cite web
- ↑ Template:Cite news
- ↑ Template:Cite web
- ↑ Template:Cite web
- ↑ Template:Cite web
- ↑ Template:Cite web
- ↑ Template:Cite news
- ↑ Template:Cite news
- ↑ Template:Cite web
- ↑ Template:Cite web
- ↑ Template:Cite news
- ↑ Template:Cite news
- ↑ Template:Cite web
- ↑ Template:Cite web
- ↑ Template:Cite news
- ↑ Template:Cite web
- ↑ 24.0 24.1 24.2 24.3 Template:Cite web
- ↑ Template:Cite web
- ↑ Hackett, Robert. (May 17, 2017). "Hack Investigator CrowdStrike Reaches $1 Billion Valuation". Fortune website Template:Webarchive Retrieved 9 June 2017.
- ↑ Template:Cite web
- ↑ Template:Cite web
- ↑ Template:Cite web
- ↑ Template:Cite web
- ↑ Template:Cite web
- ↑ Template:Cite web
- ↑ Template:Cite web
- ↑ Template:Cite web
- ↑ Template:Cite web
- ↑ Template:Cite news
- ↑ Template:Cite web
- ↑ Template:Cite news
- ↑ Template:Cite news
- ↑ Template:Cite news
- ↑ Template:Cite news
- ↑ Template:Cite web
- ↑ Template:Cite web
- ↑ Template:Cite web
- ↑ Template:Cite news
- ↑ Template:Cite news
- ↑ Template:Cite news
- ↑ Template:Cite news
- ↑ Template:Cite news
- ↑ Template:Cite web
- ↑ Template:Cite news
- ↑ Template:Cite news
- ↑ Template:Cite web
- ↑ Template:Cite web
- ↑ Template:Cite web
- ↑ Template:Cite web
- ↑ Template:Cite web
- ↑ Template:Cite web
- ↑ Template:Cite web
- ↑ Template:Cite web
- ↑ Template:Cite web
- ↑ Template:Cite web
- ↑ Template:Cite web
- ↑ 64.0 64.1 Template:Cite web
- ↑ Template:Cite web
- ↑ Template:Cite web
- ↑ Template:Cite web
- ↑ Template:Cite web
- ↑ Template:Cite web
- ↑ Template:Cite web
- ↑ Template:Cite web
- ↑ Template:Cite web
- ↑ Template:Cite web
- ↑ Template:Cite news
- ↑ Template:Cite web
- ↑ Template:Cite web
- ↑ Template:Cite web
- ↑ Template:Cite web
- ↑ Template:Cite news
- ↑ Template:Cite web
- ↑ Template:Cite web
- ↑ Template:Cite web
- ↑ Template:Cite web
- ↑ Template:Cite news
- ↑ Template:Cite news
- ↑ Template:Cite web
- ↑ Template:Cite web
- ↑ Template:Cite news
- ↑ Template:Cite news
- ↑ Template:Cite web
- ↑ Template:Cite web
- ↑ Template:Cite news
- ↑ Template:Cite web
- ↑ Template:Cite web
- ↑ Hackett, Robert. (May 17, 2017). "Hack Investigator CrowdStrike Reaches $1 Billion Valuation". Fortune website Template:Webarchive Retrieved 9 June 2017.
- ↑ Template:Cite web
- ↑ Template:Cite web
- ↑ Template:Cite web
- ↑ Template:Cite web
- ↑ Template:Cite web
- ↑ Template:Cite web
- ↑ Template:Cite web
- ↑ Template:Cite web
- ↑ Template:Cite web
- ↑ Template:Cite news
- ↑ Template:Cite web
- ↑ Template:Cite news
- ↑ Template:Cite news
- ↑ Template:Cite news
- ↑ Template:Cite news
- ↑ Template:Cite web
- ↑ Template:Cite web
- ↑ Template:Cite web
- ↑ Template:Cite news
- ↑ Template:Cite news
- ↑ Template:Cite news
- ↑ Template:Cite news
- ↑ Template:Cite news
- ↑ Template:Cite web
- ↑ Template:Cite news
- ↑ Template:Cite news
- ↑ Template:Cite web
- ↑ Template:Cite web
- ↑ Template:Cite web
- ↑ Template:Cite web
- ↑ Template:Cite web
- ↑ Template:Cite web
- ↑ Template:Cite web
- ↑ Template:Cite web
- ↑ Template:Cite web
- ↑ Template:Cite web
- ↑ Template:Cite web
- ↑ Template:Cite web
- ↑ Template:Cite web
- ↑ Template:Cite web
- ↑ Template:Cite web
- ↑ Template:Cite web
- ↑ Template:Cite web
- ↑ Template:Cite web
External links
[edit | edit source]
See also
[edit | edit source]- Operating systems
- Chinese intelligence activity abroad
- Chinese intelligence operations in the United States
- Timeline of Russian interference in the 2016 United States elections
- Timeline of investigations into Donald Trump and Russia (January–June 2017)
References
[edit | edit source]Page Template:Reflist/styles.css must have content model "Sanitized CSS" for TemplateStyles (current model is "wikitext").
