Chip flinger TSMC warns 'WannaCry' outbreak will sting biz for $250m

Chipmaker TSMC has warned that a previously disclosed virus infection of its Taiwanese plant may cost it up to $250m. The malware struck on Friday, and affected a number of unpatched Windows 7 computer systems and fab tools over two days. "The degree of infection varied by fab," the firm said in an update on Sunday. "TSMC …

[EveryTime]

Presumably "pin the domain" should be "ping the domain".

[stephanh]

so installing critical security patches

on critical infrastructure is still not a thing?

Yeah, I understand these systems were "air-gapped". Supposedly.

[MrReal]

Re: so installing critical security patches

Some of the computers that run these fabs are stuck on obsolete versions of Windows NT etc., on companies that need to get stuff out of the door it's common for them not so kill off their tools and scripts that do the work by installing the latest version of Windows every time M$ comes out with a new one.

A windows upgrade might stop your favourite game from working until an update but these guys stand to lose business and $millions when the new version stops the fab.

This is an example of why toy operating systems from Microsoft should never be used for anything critical.

[Sceptic Tank]

Re: so installing critical security patches

What toy operating system do you recommend then?

[herman]

Re: so installing critical security patches

Microsoft's other operating system is rather more stable and secure than Windows.

[stephanh]

Re: so installing critical security patches

@MrReal

"Some of the computers that run these fabs are stuck on obsolete versions of Windows NT"

Earlier reporting on WannaCry indicated that it could not infect Windows XP, only Windows 7. I assume NT is then also not "supported".

Based on this, I would assume that the infected computers are Windows 7 which means that a patch was available (for a long time). I realise there is always a risk in patching in an industrial system, but as we have learned many times before and now again, *not* patching also comes with a risk.

[paulf]

Re: so installing critical security patches

@Stephanh, "Based on this, I would assume that the infected computers are Windows 7 "

FTA (Paragraph 2): "The malware struck on Friday, and affected a number of unpatched Windows 7 computer systems and fab tools over two days."

[vir]

Re: so installing critical security patches

Anyone have any data on what the economic impact of patching systems vs not patching them is? E.g. lost work/downtime/cost to "recover" from patches that break tools or destroy workflow vs malware that does the same?

[alain williams]

Re: so installing critical security patches

Anyone have any data on what the economic impact of ...

Does anyone have any data on the economic impact of installing an operating system that is more resistant than what comes from Redmond? Tooling up to use a safe operating system might cost a bit more to start with (if some of the stuff that you use needs porting) ... but $250m pays for a lot of tooling up.

[sanmigueelbeer]

Wow. WannaCrypt, huh? At this "day & age".

I hope the poor guy who introduced the virus is still alive.

[Sceptic Tank]

Tool?

"...an infected sub-component of an unspecified tool was connected to its network"

I am not even going to speculate about what that "tool" was doing on the network.

[herman]

Re: Tool?

Ayup - it sounds like they have quite a few tools in their IT department.