OPSWAT MetaDefender Platform Not Affected by CrowdStrike Sensor (Real-Time Protection) Update Issue

Recently, CrowdStrike's Falcon Sensor experienced a significant issue causing system instability and crashes due to a conflict with Windows memory allocation methods. This incident raised concerns about the reliability of endpoint security solutions.

Statement on Falcon Content Update for Windows Hosts

Understanding the CrowdStrike Issue

The core of the issue was the Falcon Sensor's real-time protection, which, when combined with certain memory allocation operations in Windows, resulted in system instability. This affected many users who rely on CrowdStrike for endpoint security.

OPSWAT MetaDefender Unaffected

OPSWAT MetaDefender, which uses multiple antivirus engines including CrowdStrike, is unaffected by this issue. The primary reason is that MetaDefender utilizes the "scan file" feature of these engines rather than their real-time protection capabilities. This design choice ensures that issues affecting real-time protection on endpoints do not impact MetaDefender’s scanning functionality.

Technical Resilience and Failover Mechanisms

MetaDefender's architecture is designed for stability and reliability. It operates the scanning engines in a controlled and secure environment, ensuring consistent performance even if individual engines encounter issues. Additionally, MetaDefender incorporates robust failover mechanisms and watchdogs to detect engine failures. These systems automatically redirect scanning tasks to stable engines, maintaining seamless and effective security operations.

Recent Damage and Impacts

The recent CrowdStrike Falcon Sensor issue led to widespread system crashes, particularly impacting organizations with large deployments of the sensor such as critical infrastructure like airlines, banks, hospitals, emergency services, media and news outlets and more. Tens of thousands of devices globally experienced Blue Screen of Death (BSOD) errors due to this conflict, requiring significant manual intervention to resolve the issue.

Conclusion 

MetaDefender’s strategy of using file scanning features rather than real-time protection ensures it remains reliable and effective, providing robust security without risking system instability. This approach, combined with failover mechanisms and watchdogs, demonstrates MetaDefender's commitment to maintaining continuous and dependable security scanning. 

How OPSWAT Can Help  

OPSWAT is committed to helping fix this issue for its customers. Impacted CrowdStrike customers can use our MetaDefender Drive to help accelerate the remediation process and reduce downtime. Please contact one of our experts, or your OPSWAT customer support representative to learn more.  

Best regards,
Benny Czarny