Comment by Rotdhizon | Hacker News Reader

Comment by Rotdhizon | Hacker News Reader

>> against unpatched Windows 7 systems

>> Since data integrity and confidential information haven’t been compromised, the company believes the attack wasn’t the work of a hacker

>> According to CEO C.C. Wei, the attack is purely due to the company’s own negligence. Wei also said that he doesn’t think there is any hacking behavior involved.

Those three lines sum up the article.

From a different article, the virus got onto their network when they installed some type of new software/tool. They didn't check it before they deployed it, turns out it had wannacry on it. Since the networks this virus infected weren't internet connected, it didn't hit the kill-switch domain. So it was left to run wild until they contained it.

https://www.databreachtoday.com/wannacry-outbreak-hits-chipm...

It's not surprising that the system was using an unpatched OS. Many of these tools are not connected to the external internet, and they are qualified using the exact version of the software that is installed during delivery. I don't really know the details of foundry operations, but it seems like there are more incentives against installing windows updates than for it. Looking at your article it seems to say the same thing:

> patching is not always an easy endeavor in manufacturing environments because any code changes must be rigorously tested to ensure they don't have a real-world impact - for example on industrial control systems or supervisory control and data acquisition systems, which control the software and hardware that runs manufacturing processes. Indeed, ICS and SCADA systems may have a lifespan of 20 to 30 years. Many were never designed to be internet connected.

Since this is ransomware, it's unclear how an OS patch would have helped anyway.

The ransomeware in this case spreads by exploiting a vulnerability that is now patched in Windows.

Additionally, if the machines were connected to the internet, the killswitch would've prevented it from spreading. WannaCry doesn't spread if a particular hostname resolves; this acts as a killswitch. Marcus Hutchins purchased the relevant domain name after reverse engineering WannaCry and noticing the killswitch.

Edit: That's not to say the machines should be connected to the internet; I'm just explaining the circumstances that allowed this to occur.

Reply on news.ycombinator.com