Microsoft admits hackers took advantage of unknown bug in Windows to infect computers with mysterious Duqu virus

By DAILY MAIL REPORTER

Last updated at 1:21 AM on 3rd November 2011

Microsoft Corp said hackers exploited a previously unknown bug in its Windows operating system to infect computers with the Duqu virus, which some security experts say could be the next big cyber threat.

'We are working diligently to address this issue and will release a security update for customers,' Microsoft said on Tuesday in a short statement.

News of Duqu surfaced in October when security software maker Symantec Corp said it had found a mysterious computer virus that contained code similar to Stuxnet, a piece of malicious software believed to have wreaked havoc on Iran's nuclear programme.

Government and private investigators around the world are racing to unlock the secret of Duqu, with early analysis suggesting that it was developed by sophisticated hackers to help lay the groundwork for attacks on critical infrastructure such as power plants, oil refineries and pipelines.

Details on how Duqu got on to infected machines emerged for the first time on Tuesday as Microsoft disclosed its link to the infection

Separately, Symantec researchers said they believe hackers sent the virus to targeted victims via emails with tainted Microsoft Word documents attached.

If a recipient opened the Word document and infected the PC, the attacker could take control of the machine and reach into an organization's network to propagate itself and hunt for data, Symantec researcher Kevin Haley said.

He said some of the source code used in Duqu was also used in Stuxnet, a cyber weapon believed to have crippled centrifuges that Iran uses to enrich uranium.

That suggests that the attackers behind Stuxnet either gave that code to the developers of Duqu, allowed it to be stolen, or are the same people who built Duqu, Haley said.

'We believe it is the latter,' he said.

Read more: http://www.dailymail.co.uk/sciencetech/article-2056842/Duqu-virus-Microsoft-admits-hackers-took-advantage-bug-Windows.html#ixzz1cdLpYJ9x

Hard Drive Disruptions/Thai Flooding – “Deluges” Now Driving Supply Risk and Disruptions

November 2, 2011 6:57 AM | Categories: Jason Busch, Supply Risk

In less than a year, we've now seen natural disasters wreak havoc with Asian supply chains not once, but twice (and arguably more, if you count more minor incidents on the broader sub-continent, including India, where food disruptions have led to numerous price spikes since last summer). Most recently, the flooding in Thailand has emerged as the cause of significant disruptions in the hard drive business (which impacts a wide variety of items from PCs to DVD players to cars to industrial controls). According to the above-linked analysis from HIS iSuppli, as a result of the flooding, "the HDD industry in the fourth quarter will suffer its worst downturn in three years. HDD shipments in the fourth quarter will decline to 125 million units, down 27.7 percent from 173 million in the third quarter."

iSuppli further notes that "the drop is the largest sequential decrease on a percentage basis since the fourth quarter of 2008 whenments fell 21.2 percent during the worst point of the last electronics downturn" and that an estimate of "30 percent of HDD production in the fourth quarter this year will be lost because of the disaster" resulting in "a significant shortage of HDDs." The flooding will also shake up the overall supply market for hard drives and "Western Digital is likely to lose its status as the world's largest shipper of HDDs, with its rank expected to fall two positions to third in the fourth quarter, down from first place in the third quarter. Toshiba's rank could fall to fourth place, down from fifth." 

In an earlier post on supply risk, we noted that geographic and geo-spatial (i.e., map/location-based) analysis of suppliers and facilities can be key to rapidly determine the impact of potential disasters on your supply chain -- including tier one and lower tier suppliers. Moreover, in the wake of these Black Swan supply chain events, it's crucial to think through all of the disaster recovery elements necessary to respond quickly and effectively. D&B, which offers supply risk monitoring services and software, suggests that to respond effectively in the immediate wake of such a supply chain event, there are a few questions companies ask themselves as part of their supplier risk planning, including "how quickly can I access reliable information about the situation?" and "how quickly can I analyze the information to understand how the situation affects me?"

While access to information is essential, our own research suggests that the ability to share information internally and collaborate across functions (e.g., a centralized risk function sharing information with materials managers and plant managers) is essential. And when it comes to information sharing, especially around immediate information to surface in the aftermath of an event, there's no replacement for tools that enable the gathering and sharing of both structured and unstructured general content (e.g., news feeds, information shared on social networks) as well as the plotting of such information using geographic and geo-spatial-focused tools.

We often hear as horrible floods proverbially described -- no pun intended -- as biblical in proportion and nature. Given the long history we've had in managing events just like this, one might think that the over-localization of an entire supply chain is something we would consider as part of overall sourcing strategy and supplier selection. Guess again. Let's hope this time around, after the Japanese tsunami, nuclear and earthquake disaster and now Thailand, that geospatial and region-centric analysis plays a greater role in our overall strategic sourcing and supply risk mitigation planning efforts.

- Jason Busch

http://www.spendmatters.com/index.cfm/2011/11/2/Hard-Drive-DisruptionsThai-Flooding--Deluges-Now-Driving-Supply-Risk-and-Disruptions