Slashdot Mirror
World's Largest Chip Maker Will Lose $250M For Not Patching Windows 7 Computers (networkworld.com)
A major virus infection forced the closure of Taiwan Semiconductor Manufacturing Company (TSMC) factories last weekend..." writes Slashdot reader Mark Wilson, noting that it's the largest semiconductor manufacturer in the world, selling chips to Apple, Nvidia, AMD, Qualcomm, and Broadcom, and "responsible for producing iPhone processors."
Now Network World reports: The infection struck on Friday, August 3, and affected a number of unpatched Windows 7 computer systems and fab tools over two days. TSMC said it was all back to normal by Monday, August 6. TSMC did not say it was WannaCry, aka WannaCrypt, in its updates, but reportedly blamed WannaCry in follow-up conference calls with the press.... The company said this incident would cause shipment delays and additional costs estimated at 3 percent of third quarter revenue. The company had previously forecast revenues of $8.45 billion to $8.55 billion for its September quarter. A 3 percent loss would mean $250 million, though actual losses may come out lower than that. Still, that's a painful hit. TSMC also said no customer data was compromised....
TSMC isn't directly to blame here; someone [an infected production tool provided by an unidentified vendor] brought WannaCry into their offices and behind their firewall, but TSMC is still culpable because it left systems unpatched more than a year after WannaCry hit.
Now Network World reports: The infection struck on Friday, August 3, and affected a number of unpatched Windows 7 computer systems and fab tools over two days. TSMC said it was all back to normal by Monday, August 6. TSMC did not say it was WannaCry, aka WannaCrypt, in its updates, but reportedly blamed WannaCry in follow-up conference calls with the press.... The company said this incident would cause shipment delays and additional costs estimated at 3 percent of third quarter revenue. The company had previously forecast revenues of $8.45 billion to $8.55 billion for its September quarter. A 3 percent loss would mean $250 million, though actual losses may come out lower than that. Still, that's a painful hit. TSMC also said no customer data was compromised....
TSMC isn't directly to blame here; someone [an infected production tool provided by an unidentified vendor] brought WannaCry into their offices and behind their firewall, but TSMC is still culpable because it left systems unpatched more than a year after WannaCry hit.
for not patching your systems.
``World's Largest Chip Maker Will Lose $250M For Using Known-Vulnerable Operating Software''
The correct conclusion is that windows just isn't suitable to run multi-billion operations with. As long as you ignore that reality, you leave the door open to other parties to take advantage of that.
Sounds much better than: World's Largest Chip Maker Will Lose $250M For using Windows Computers
dude, it's Saturday
We stopped patching Win7 when MSFT changed EULA to allow their spying and forced patching. When they stopped providing data about individual patches, we began switching to a different OS.
We are small and the OS didn't matter thanks to our brilliant CIO who mandated webapps for everything using standard protocols since the company was founded.
We did have 2 people quit when MS-Outlook wasn't available. They were marketing/sales people with lots of paid outlook addons for CRM. They didn't like the F/LOSS CRM we provided which integrated with our F/LOSS communications server and F/LOSS document management server solutions.
Now we aren't a Windows shop, patching non-Windows systems is fairly easy, as is remote management. The 2 remaining Windows machines (used in accounting) which might be impacted aren't actually used on the internet and don't have access to other storage. Backups are "pulled", not "pushed".
When guests visit our company, they are put onto wifi outside our desktop LAN. That wifi is effectively like being on the internet. We don't allow direct wifi access to our internal networks without using a VPN + 2FA.
I feel bad for larger companies that don't have much choice other than to let vendors onto their Windows networks. Companies that do are playing Russian Roulette. It isn't if, it is when they get a major attack.
It appears that the affected machines were those running process control systems. Because of their VERY finicky nature (and usually being designed to be used on a closed intranet), they almost NEVER apply post-production patches.
I once worked on a medical device where each and very build installed MUST be a bit-perfect replication of the original. Any new release went through horrific levels of qualification and then IT had to be bit-perfect until the next release.
The typical "patch Tuesday" crap just cannot work in these environments.
$250M is nothing if this sort of thing happens once or twice a decade considering Microsoft releases regressive and debilitating patches once or twice a year.
The classical effect of mindless bean-counters that do not understand risk-management at all. Pathetic. And, since further up you usually find the same bean-counters, those that messed up massively here will likely not even be fired.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
The screw-up here is using an OS that cannot be professionally operated...
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
Just delayed until the next quarter.
Also, lower revenues are not money "lost".
Also, a newer story says it's $170 M, (2% of revenue), not $250M: https://digitimes.com/news/a20...
But it wouldn't be a modern news story without a bunch of exaggeration and misunderstood info, would it? The important thing isn't the correct facts, the important thing is to point and laugh at someone's misfortune. Because news...
As anti Windows 7 propaganda. All the while Windows 10 is getting worse. I did a clean install of 1803 in a VM today and it came with a dozen pay to win games pre-installed on the start menu and $kype. This was on the pro version as well. The security risks of using Windows 7 outweigh the time wasted de-bloating Windows 10. Intel is even making new motherboards to support Windows 7.
If I had lost $250 million, I would WannaCry too!
#DeleteFacebook
... like MS-DOS.
#DeleteFacebook
From the article: "TSMC isn't directly to blame here". Quite the opposite, they are. Either they should have patched (and they did not), or if they intentionally decided not to patch (which is understandable for some process control systems) they failed to implement protocols for bringing other systems into the environment. Heads you lose, tails you lose. I would hope the C-level execs that approved this entire process get their heads handed to them, but they will probably fire some low level techie who had no real control over anything.
Google learned this lesson and banned Windows from inside their network, a Windows machine can now be connected to the network only with VP approval. Other organizations are perhaps more stupid.
Windows is also banned from the world's financial systems after the LSE fiasco. But US Navy is too stupid to ban Windows even after towing that missile cruiser back to port. It should be illegal to use Windows in medical devices, until it does become illegal it should should be a lucrative income source for ambulance chasers.
When all you have is a hammer, every problem starts to look like a thumb.
Headline corrected for accuracy :]
Given the size and numbers, is $250 million more or less than the cost of keeping their infrastructure up to date?
And even after this costly mistake by a vendor, just keeping their systems tightly locked down and having much better controls over who or what gets plugged into their network may be far cheaper than updating everything.
Given that they were back up and running quickly, it does appear that they have everything locked down and backed up. I expect they knew what the risks where and are and will update their procedures appropriately.
That's a good point. Especially the " they failed to implement protocols for bringing other systems into the environment.", as there are many reasons why they may not have been able to patch the system.
I think we've pushed this "anyone can grow up to be president" thing too far.
Right because Linux is so perfect and secure and never has been hacked before or needs patching.
http://saveie6.com/
This is what I don't get - people keep using Windows even though it sucks. Every reason I always hear is just people being set in their ways and now want to change. And they keep getting hacked. Insanity.
You never want to take a wafer fabrication plant offline for unscheduled maintenance, because having a line down costs you $1 to $10 million an hour while you're down. Worse, if you take it down for anything but regularly scheduled maintenance, you have to re-qualify the tool, which can take weeks.
And if you have to take all your etch tools, or all your metal deposition tools, or all your steppers down, because they all run on the same version of Windows 7, then you're burning through tens of millions of dollars worth of opportunity cost while the tools are getting patched and requaled to make sure that none of the hundreds, if not thousands, or process parameters were changed due to the upgrade.
In that environment, not patching is the economically logical choice.
Lawrence Person (lawrencepersonh@gmailh.com (remove all "h"s to mail)
http://www.lawrenceperson.com/
You are saying "Linux", I did not. One advantage of Linux is that it usually does not break on update, though. That is, before systemd. But there are other alternatives.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
Windows lost its way a long time ago. Why is _ANYONE_ using it for process control? (apart from stupidity)
The US Navy got a Microsoft extension for an expired Windows that the Navy has deployed. Remember that we do not own Windows. We only paid to use Windows as a license. It's up to Microsoft to update and repair their Operating System.
I think you should really think about upgrading to Linux. If you need time to migrate your Windows App/Software to Linux then run your Windows App/Software in Linux. You would not of had this problem if your IT used Linux instead of Windows.
Microsoft sues everybody like Oracle. If I were you that lost $Millions of dollars then I would do what Microsoft likes to do. Sue them, ie Microsoft.
?? Have you seriously ever ran a distro without updating? No distro in existence can still function after 2 updates. It always requires a re-install because it lacks an ABI driver model which every other OS has for decades now.
http://saveie6.com/
I have automatic updates every 3 days enabled on some of my servers. No problems in about 12 years now. Were does this stupidity about "no distro can function after 2 updates" come from? Are you utterly clueless what you are talking about?
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.