ajason
(aJason)
2
I saw this article this morning and skimmed through it. I thought it was interesting about how most ATMs run Windows XP still. I don’t know much about software and hardware development, but I would have thought that it would be worth the time and effort to get those updated.
8 Spice ups
If those ATMs are open circuit, then I would be worried. If they are closed circuit and there is no possible way to access from the outside. They can run 3.1.
That’s my logic anyway.
11 Spice ups
ajason
(aJason)
4
Agreed. Hopefully, they are closed circuit.
The Wikipedia article on ATMs is an interesting, related read:
5 Spice ups
In my experience, at least, more run OS/2 than XP/NT at this point.
There’s also a company actively making new commercial versions of officially-licensed OS/2 for use-cases like this as well, and keeping up-to-date on security fixes and such. I can’t remember their name offhand, but I was really tempted to buy a copy myself to play around with a couple years back, but really couldn’t justify the price.
6 Spice ups
Regardless of what some may say, XP SP3 was solid as a rock.
11 Spice ups
Jake1590
(Jake1590)
7
I used to do work for a fantastic eatery that had a casino attached. Most of my calls there were to fix the GM’s excel macros for a report that was generated out of Aloha (POS). On occasion they would call for ATM work in the casino. I was very shocked the first time my boss sent me out with instructions to ask for the case key. I open the case up and plug in and found it was XP. A simple reboot, or a netsh winsock reset was the fix every time…But was still blown away that an important machine like that was so far behind. One of the account reps at another place had Windows Vista that they refused to move off of, so that was another “Please just die already” ones… pretty sure she is still using that machine.
4 Spice ups
Very unlikely that “most” ATMs run XP at this point (the article says “many”, not “most”). Diebold ATMs used to run XP, at least the 10 I had anything to do with did. However, as XP was nearing end of life, all of ours were updated to Windows 7. For most of ours, the upgrade was simply a matter of reimaging the computers with a W7 disk image that was customized for Diebold’s software (I think we had 1-2 that the tech had to replace the computer itself). Before W7 hit EoL, the bank was bought out by a bigger bank, so I couldn’t tell you what happened to those ATMs from that point.
3 Spice ups
Easily my favorite operating system. It just worked. Shame SSDs weren’t more prevalent during the XP era, as that combo would have been great.
6 Spice ups
No doubt. The original consumer SSD’s were about 1GB and so expensive.
5 Spice ups
ajason
(aJason)
11
I see that I had misread the article. It does say “many” not “most.” My apologies.
If I were a bank with one of the many ATMs that are still running Windows XP, I would think I would at least consider an alternative brand ATM to update if the current brand is not staying up to date.
5 Spice ups
Sadly, in the case of ATMs, it’s likely the bank cheaping out by not updating them. Our COO (my bosses boss) was very proactive on anything “security”, so the upgrade was an easy sell for her. A previous bank I worked at would likely have been a much harder sell.
Fun story about working at that prior bank: We had two “sister” banks (different banks owned by the same holding company). I would occasionally be sent to one of them to do some network engineering work since they had no one on staff to do it. I had arrived at the main office of one of those banks, and was standing outside talking to their COO. I noticed a car pull up to their drive through ATM. I asked the COO if he knew whether the passcode had been changed on that ATM from the default. “I don’t know. How would we find out?” I told him that, with his permission, I could check. Once the car pulled away, he and I walked over together, and he watched me log into his ATM using the factory default code. I told him that, were I a criminal, I could then disable the 10’s cassette, and reprogram the 20’s cassette as a 5’s cassette, log out, and then request $300 using a stolen CC. “Your ATM would then give me $1200!” (No OS vulnerability needed for that!) That morning, I changed the passcode on that ATM for them. LOL Only reason I thought to ask him that question was because those ATMs had recently been in the news for breaches due to the easy default passcode. That manufacturer soon thereafter started forcing the change of the passcode during initial setup.
5 Spice ups
Being in Manufacturing IT, dealing with built-in hardware is a daily occurrence. There’s no way to upgrade it as the people who made the machine won’t bother writing updated drivers every time Windows releases a new version and if/when they do, the cost to upgrade the controller is staggering.
6 Spice ups
jrblood
(JRBlood)
14
Russia still uses Windows XP for some of their number stations, so it’s got to be secure. 
8 Spice ups
eljosero
(ElJosero)
15
Yep, I used to work on optical exam equipment that was running embedded XP well past the EoL date. Highly likely that there’s a lot of things like that floating around because they aren’t going to update the drivers just so MS can push more units.
4 Spice ups
One of my previous jobs still had a Windows 3.1 box controlling a very expensive electron beam machine, but it was air gapped from the LAN with no Internet access. My father-in-law actually worked on San Francisco’s rail system in the early 2000s.
There is also a cottage industry of flash based floppy disk emulators for things like embroidery machines and CNC machines.
5 Spice ups
With embedded systems, the impediment usually isn’t the lack of hardware support in newer operating systems, it’s the licensing cost for the upgraded proprietary software that the system runs to operate whatever machine it’s operating.
Most owners of this equipment would gladly pay a few thousand dollars to upgrade the computers running the machines, as well as the hardware that interfaces the computer with the machine (which is, more often than not, a commodity PLC). But when the software has license costs exceeding $50,000 or more (because the vendor sells only a few dozen copies a year but still has high development costs to recoup), it’s a difficult pill to swallow that may not be justified by the balance sheet.
3 Spice ups
shnool
(SHNOOL)
18
You guys are missing a major reason a lot of these systems still exist. Validation effort. In our world, revalidating a system verified to work on Operating System say XP, to move it to something newer, like Windows 7, requires the entire system be taken offline (and any other systems it controls), upgraded, tested against the new OS, and then OQ, and PQed. In the case of our labs, we cannot be out of operation for the 2-3 weeks it sometimes takes.
There is the issue of the vendors also not testing with newer OSes. I’ve personally been on a bent to get all these XP/7 boxes out (and have been nearly 100% successful) and the Windows 10 we’ve migrated to (LTSC) and we now start the process of moving to 11 LTSC, which usually happens when the hardware it is tied to starts to show signs of failure. Lifecycles for these machines is at least 10 years some cases 20!
Manufacturing in GxP environments, the whole validation process itself in my opinion is pretty broken and belies good security, which is why you hear so often of IoT vulnerabilities and PLC exposures for manufacturers. Your OT network has to be completely isolated.
8 Spice ups
Isolated and/or air gapped systems are usually how that goes. One place I worked at ended up having to build out a whole second network, almost totally inaccessible to the main network, to connect all the machines to, with its own storage solution. Engineering was the only department that had access from the main network, it was a royal pain to setup but once everyone involved got the hang of it, it went smoothly. Lots of access control rules on the network gear. I wouldn’t want to have to help do that again!
3 Spice ups
Always appalled by how few know about the embedded systems on our CRITICAL INFRASTRUTCTURE.
People who insist that everything must be updated & patched, have little foresight…
Like @Jay-Updegrove my manufacturing environment uses XP & there is that one machine I got up to 32bit Win7 etc…
It is not always about budget, although telling someone to upgrade their industrial machine that cost several million back then, is not a conversation you will win. It is most often about the companies no longer existing.
We are resurrecting manufacturing in our country, as many of you are in yours - but how many of those big machines are made by people who even speak the same language as you now days?
Expand to thoughts of who made the machine that lifts a drawbridge near you, how many drawbridge lifting machine manufacturers exist now? How many can upgrade the local version in place? Were upgrades ever created? Can the road be closed while the update is delivered?
In Sydney AU, we have massive problems with our rail network at this time - because!? They are trying to update & attach some new systems - but homey don’t play with homey no more.
Leave it alone & homey is a happy clown…
If you search how many issues we have, you can find constant reports going back several years & ongoing…
1 Spice up
