13 ms·

The reason the attack happened to including British National Health Service hospitals was because they didn't follow manufacturer's instructions (in this case M

The reason the attack happened to including British National Health Service hospitals was because they didn't follow manufacturer's instructions (in this case Microsoft) and upgrade their Windows XP software to Windows 10. The only people to blame are those that don't follow manufacturers instructions. They were warned ahead of time. There were even news reports about this. Target and Home Depot both had credit card hacks precisely because they did not follow manufacturer (again Microsoft) instructions of upgrading Windows XP embedded to a supported version of the OS. I don't understand how hospitals can get accredited if their IT systems are not up-to-date and verified by cybersecurity experts. Since the companies and the NHS can't be counted on to follow manufacturer instructions, this is extremely important. May 11, 2017: British Medical Journal: The hackers holding hospitals to ransom - Hospitals need to be prepared to avoid shutdowns http://www.bmj.com/content/bmj/357/bmj.j2214.full.pdf http://www.bmj.com/content/bmj/357/bmj.j2214.full.pdf Also: Hospital accreditation http://www.uktreatment.com/why-the-uk/hospital-accreditation/ http://www.uktreatment.com/why-the-uk/hospital-accreditation... EDIT: The computer systems are capital equipment and like any other form of capital equipment (eg, vehicles in the motor vehicle pool) they must be maintained. Complex machines undergo changes over the life of the equipment and manufacturers issue updates (eg, field change orders) that should be followed by the purchasers of the equipment. Regarding proper cybersecurity, that would include hardware upgrades since later Intel CPUs incorporate hardware that assist with proper security that is taken advantage of by later versions of the Microsoft OS. The problems of hospitals both in the US and in Britain were because of a refusal to follow the manufacturer's (Microsoft's in this case) instructions. Those familiar with the hacks of Target and Home Depot would know that they were hacked because Target and Home Depot refused to follow Microsoft's instructions to upgrade their point of sale software from unsupported Windows XP embedded to a later, supported version of the OS.

deleted 9y ago
[deleted]
pjc50 9y ago
> get accredited By whom? It's the other way round: shutting down an NHS hospital is the sort of thing that would normally be a front-page disaster for the government, so it's almost never going to happen.
- davidf18 9y ago
  Accreditation is the US is done by The Joint Commission. Hospitals without Joint Commission accreditation cannot get paid for Medicare or Medicaid bills. In Britain the accreditation is done by Care Quality Commission: http://www.cqc.org.uk http://www.cqc.org.uk What's the point of an accreditation agency if they aren't going to ensure that the hospital is run safely which includes running on current software?
dclowd9901 9y ago
In engineering, we should assume the users will not adhere to instruction. This is why in physical engineering, tolerances for usage are often 3x their advertised value. In Microsoft's case, they have the means to know who their users are and ensure they upgrade. Forced upgrades should be an opt-out feature, especially with an OS as prominent as Windows.
- pjc50 9y ago
  The NHS had already opted out - because of the difficulties in upgrading.
  - davidf18 9y ago
    The NHS had warned hospitals several years in advance that Windows XP would be discontinued and that they would have to upgrade the OS. The NHS took out a 1 year contract on Windows XP updates at great financial expense which gave responsible authorities plenty of time to do the system upgrades.
- davidf18 9y ago
  Don't know what kind of engineer you are, but I have BS EE with minor CS from top engineering school. Airplanes have to undergo preventative maintenance. We don't count on airplanes not being maintained. Sorry. Highway bridges and other structures undergo constant inspection. It is one matter for individuals in their homes choosing not to update a computer or for a privately held firm. But firms with stockholders, or governments must follow manufacturers instructions when they purchase equipment and that includes maintenance whether for their vehicle pool or other equipment.
  - scott_karana 9y ago
    > Highway bridges and other structures undergo constant inspection. They are supposed to, but underfunding/mismanagement can abuse the overengineering (which thankfully existed in the first place!) and skip regular inspections, sometimes with fatal consequences. http://www.nbcnews.com/id/22300234/ns/us_news-bridge_inspections/t/feds-let-states-delay-inspections-bad-bridges/ http://www.nbcnews.com/id/22300234/ns/us_news-bridge_inspect...
geofft 9y ago
> The reason the attack happened to including British National Health Service hospitals was because they didn't follow manufacturer's instructions (in this case Microsoft) and upgrade their Windows XP software to Windows 10. Well, on one side, you have the OS manufacturer's instructions to update to Windows 10. On the other side, you have the software manufacturer's instructions to stay on Windows XP at all costs. Which instructions do you listen to? (Arguably, before this week, it would have been empirically correct to listen to the software manufacturer; upgrading from XP would have definitely broken the system, but staying on XP didn't break it so far.)
- davidf18 9y ago
  > "On the other side, you have the software manufacturer's instructions to stay on Windows XP at all costs." It is one thing for an individual to purchase software for their own needs, but any firm or government should not purchase software that will not be upgraded to the current versions of the Operating System. That is simply irresponsible and should have been rectified in the purchase contract. As it is, are there specific examples of software used by firms and government that are not updated to current versions of Windows?
  - jvgiuiigvuuc 9y ago
    > That is simply irresponsible and should have been rectified in the purchase contract. Have you heard the expression "captive market"? It's not like they can buy equivalent software from a company that guarantees upgrades.
    - davidf18 9y ago
      > "As it is, are there specific examples of software used by firms and government that are not updated to current versions of Windows?" Sounds like a hypothetical. What applications software is being purchased for which there is no equivalent and only a captive market?
  - acqq 9y ago
    Even common hardware devices as plain notebooks don't run properly with the "newer" OS. I have one notebook for which the drivers break with anything above Windows 7. I have another which can't be upgraded over Windows 8.1. For both Microsoft's "Get Windows 10" claimed they "will work" with Windows 10 (there were ads running on both which do the "check" before). I've tried the upgrade for both. The Windows 7 one has problems with the WiFi card -- reason: Intel never made newer drivers, the old aren't actually compatible with the newer systems. The Windows 8.1 one has problems with the touchpad: reason: the newer drivers are broken for that model. It also has some display issues on the Windows 10. The WiFi card, the touchpad and the display effectively aren't replaceable. But the computers, apart from not running the newer OS, work without a flaw. If I as a consumer with only a few computers have such problems, I can't see how you don't understand that the whole companies can have immense number of computers that work perfectly with their current OS and would simply break with the newer one. They would not upgrade, but they would install the security updates. But guess what, Microsoft doesn't want to give the security updates to everybody who has Windows XP. Only after this failure they "exceptionally" did it. So Microsoft is absolutely responsible. They can say "we'd prefer to motivate people to buy new" but they are still morally responsible for not releasing updates when there are so many actively used systems.
kevindqc 9y ago
I don't think it's that easy though. For example, if your CT scan software was made for Windows XP and you randomly update to Windows 10, then if you have any problems, the company making the software can blame you for not using Windows XP and you're on your own, since that's what the software has been tested/accredited for? That's what I read somewhere, not sure how accurate it is. I imagine the ideal solution would be to have a clause in the contract with the software company that they have to test and re-validate their software on new versions of windows and updates in a timely fashion so that the computers running the software can be updated? That would probably increase costs though
- davidf18 9y ago
  It is a terrible business and business arrangement (eg, the original contracts to purchase said software or equipment that uses software) that doesn't insist that the purchased software/machine run on manufacturer (in this case Microsoft) approved OSs. If the manufacturer says upgrade, then upgrade. When you purchase software and equipment, this should be part of any standard contract.
  - cmurf 9y ago
    People in the know have been complaining about this for many years, and it's corporate bean counters that collude with a sclerotic corporate IT mentality to be conservative in all things including software. And the reality is, the overwhelming majority of IT people have no training or background in risk assessment, they are not computer security people. But the bean counters, always optimizing, without good information let alone perfect information, have assessed risk incorrectly. And now there's a wildfire in progress, and basically being incompetent at the task they were handed, are all surprised. Many other people who have considered this eventuality are not surprised.
    - davidf18 9y ago
      > "And the reality is, the overwhelming majority of IT people have no training or background in risk assessment,..." But in this case, as in the case of credit card hacks of Target and Home Depot, it was simply a matter of following manufacturers maintenance instructions and upgrading the OS version from an unsupported version to a supported version. As many have pointed out, in the case of Windows 10, the upgrades had been free at no charge from Microsoft.
Silhouette 9y ago
The reason the attack happened to including British National Health Service hospitals was because they didn't follow manufacturer's instructions (in this case Microsoft) and upgrade their Windows XP software to Windows 10. And what happens if some of the software or equipment used with that system is not compatible with Windows 10? I can make a very secure house if I give it solid, metre-thick concrete walls, ceiling and floor, but it won't be very useful as a house without things like doors and windows. You're far too quick to excuse Microsoft for what was, ultimately, a defect in the original product.
- davidf18 9y ago
  > "And what happens if some of the software or equipment used with that system is not compatible with Windows 10?" It is irresponsible for a firm or government (as opposed to an individual) to purchase software without a contract that ensures that it will be upgraded to current versions of the OS. > "You're far too quick to excuse Microsoft for what was, ultimately, a defect in the original product." What defect are you referring to exactly? That Microsoft years ago couldn't predict every way that cybersecurity attacks happened to their OS? Or that users of versions of Microsoft software still under support contracts (including firms and governments) did not run software update tools for a patch released in mid-March? It is simply unrealistic for a firm to anticipate all forms of cybersecurity attacks. Later versions of OSs include not only different architectures to fix cybersecurity flaws but take into account changes in the Intel hardware that help to combat cybersecurity attacks.
  - Silhouette 9y ago
    It is irresponsible for a firm or government (as opposed to an individual) to purchase software without a contract that ensures that it will be upgraded to current versions of the OS. We're talking about things like medical equipment, often in regulated fields. There may be no such contract available, and even if there is, upgrading to a totally new OS may or may not be acceptable. The idea that you should throw out millions of pounds of high-tech medical scanner every few years because a hundred buck OS that it was supplied with couldn't be kept secure is laughable. What defect are you referring to exactly? They supplied an OS that was not secure. The rest is just rationalisation and apologies. It is simply unrealistic for a firm to anticipate all forms of cybersecurity attacks. It is also unrealistic to expect organisations concerned with literally saving lives not to buy equipment unless they have a plan in place to deal with updating the software on or used with that equipment in arbitrary ways with arbitrary consequences whenever anyone responsible for any part of its software sneezes. The need for stability, reliability and longevity is precisely why so much in this kind of sector is regulated in the first place. Perhaps the problem here was that such systems should never have been built on such an insecure platform and then connected to a network, but that too is on the device manufacturer and not the hospital. There are basic standards of fitness for purpose that are reasonably expected with such devices, even without more specific regulation. Particularly in this sort of field, those devices should then be supported for their entire working lives, not some arbitrarily shortened version of their working lives dictated by one software development organisation.
ajross 9y ago
> The reason the attack happened ... A reason. Real events have lots of root and proximate causes. MS could also have avoided writing the bug, or discovered it themselves with better auditing. NHS could have disabled SMB on systems that don't use it, or otherwise firewalled it. And, of course, the NSA could have disclosed the bug when they found it instead of hoarding it. Or better protected their tools from theft. Or the Shadow Brokers could have better audited their disclosure to avoid spilling active hacks into the public. Almost all of these things were required to get to where we are, and all of them are "simple and expected" from at least someone's perspective. Lots of blame to go around, basically.
- deleted 9y ago
  [deleted]
- davidf18 9y ago
  > "A reason. Real events have lots of root and proximate causes. MS could also have avoided writing the bug, or discovered it themselves with better auditing. NHS could have disabled SMB on systems that don't use it, or otherwise firewalled it." No machines are built perfectly from the start and there are changes made over the capital equipment's life be it airframes, jet engines, or computer systems. When purchasing capital equipment or buildings, bridges, etc, part of the responsibility of the firm is to follow the manufacturer's or builder's instructions and including maintenance upgrades. In the case of Microsoft, they gave warnings for years that the Windows XP software would not continue to be maintained. The issue was not Microsoft, but NHS (and other governments, firms) decisions not to budget for and perform maintenance for the capital equipment that they purchased.
- bwanab 9y ago
  I agree this should be upvoted more than ten times. It's staggering to me that so many recent revelations have shown that in their efforts to protect us, the 3 letter agencies have allowed vulnerabilities to exist on our machines -- and considered them assets -- without warning us.
cmurf 9y ago
There's plenty of blame to go around, if you want to play blame games. The "free market" has no mechanism for 3rd parties to affect the decision making process. Microsoft has its policies, well known to the buyers, and the buyers accepted this as well as their own policy to delay recommended upgrades. A completely neutral person, a patient, is put at risk through no fault of their own, had absolutely no say in either transaction (either the original point of sale of the OS, or the policy to not keep software up to date) is injured. This person arguably has an injury claim against Microsoft (their bug, their policy to stop updating software without disabling it thereby permitting the broad weaponization of their software). And they have an injury claim against each medical service institution who refused service because their systems were fully or partially non-functional due to their negligent choice to run old software; to not have their own user space programs on a constant "everygreen" cycle so that, without any gaps, it's possible to run their mission critical software on a currently supported and secure OS. Basically, these injured 3rd parties have to sue or legislate. Either way it requires a sovereign to intervene in the market. And what role and blame do millions of non-business end users running outdated software, and their computer was part of a web enabling such prolific spreading of malware? Do they get sued or billed their incremental share? What if it's $1000 per person running Windows XP? And now that they have liability, maybe they can all sue Microsoft because Microsoft permits them to run outdated software? This shit really needs to be engineered better, and really where we're at is, we're monkeys playing with computers and reveling in our own self-importance, when in reality we still sometimes suck. And this is an (yet another) example of how primitive we are still.
- davidf18 9y ago
  > There's plenty of blame to go around, if you want to play blame games. The "free market" has no mechanism for 3rd parties to affect the decision making process. Microsoft has its policies, well known to the buyers, and the buyers accepted this as well as their own policy to delay recommended upgrades." Nobody forced people to purchase Microsoft software. There are other vendors (Apple, Linux based systems). But if they choose to purchase the software, they need to follow the vendors maintenance instructions if they want properly operating equipment. Does United Airlines ignore the maintenance instructions of Boeing or Airbus? If they even thought about it, the FAA would be all over them. In the case of hospitals in the US and the UK there are accrediting agencies. In the US it is The Joint Commission. In the UK it is Care Quality Commission. If the people running hospitals are irresponsible and choose not to follow manufacturers instructions for maintenace for any capital equipment, then the accrediting agencies should refused accreditation.
digi_owl 9y ago
Best i recall, the NHS had signed an extended maintenance contract for XP. But it had recently been dropped because some beancounter had decided they could not afford it. In the end it may well be a big validation of the FSF message, as then the NHS (or anyone really) could hire someone to maintain the software beyond the existence of the original company. This much like how i can find someone to repair something for me that physically broke, because the tools and such are widely available and known (or even attempt to do so myself).
- davidf18 9y ago
  According to an NHS blog post about the matter, the NHS corporate (or whatever) had been warning hospitals, etc. that Microsoft was discontinuing maintenance of XP and to upgrade. They purchased an additional year of coverage giving hospitals yet another year to upgrade to a supported version of Windows. Many ignored the one year time they had as well as the earlier warnings.
PakG1 9y ago
While that's true, there is a flip side that there were likely a lot of custom-made or proprietary systems that only worked on XP. Even worse, there were likely various medical hardware that only had drivers for XP. So upgrading from XP is not necessarily an easy project, and definitely not cheap. It's likely a huge project that would be like doing a complete circulatory system transplant, not a simple isolated heart transplant.
- davidf18 9y ago
  As far as I recall, one should generally be able to use a Win XP in a VM running say, on a Win 10 OS. Fixing by writing drivers may not be cheap for the vendor of the software, but they should do it. You simply can't get around the fact that each new version of the OS is more secure than previous versions.
  - PakG1 9y ago
    Yeah, but let's not punish customers for choosing a vendor that sucks more than they already get punished. Bad decisions have their own consequences, that should be punishment enough. Also, who knows how many good vendors are out there for medical equipment. I'm not an expert, but I only hear horror stories, which may or may not just be because only the horror stories are worth telling others.
    - davidf18 9y ago
      Healthcare is a mission critical business and they need to be responsible when purchasing capital equipment including of course, software. If it doesn't operate properly for example, in the US there could not only be patient harm or disclosure of their private information, the firm could be liable for malpractice or HIPAA (law regarding health record security) the later two can have financial consequences as well as direct patient health consequences. Running on an unsupported and even if supported, not updated, software, invites failure and nobody can feel that their health records are secure. Airplane maintenance for a Boeing or Airbus is very expensive, but you have to do it. The same may be true of devices and software in healthcare. Still need to do it right. I don't see the alternative. Do you?
korethr 9y ago
One thing that comes to mind is that while dropping XP might be the manufacturer's recommendation for the OS, it's not the only manufacturer's recommendation in play here. Only geeks like us and the ones in IT departments care about the OS. Most of the rest of people don't care about the OS -- they care about the applications and devices they can use with it. The OS only matters to the degree it enables or hinders that. So when it comes to the computers used by hospitals and doctos and the like, OS manufacturer instructions are lower down on the priority list, below the manufacturer instructions for the applications and medical devices they use. And if $MedicalRecordsApp or $MedicalEquipmentController is only certified by the manufacturer to run properly under Windows XP, then you can bet that the hospitals and doctors offices are going to continue to run Windows XP.
- davidf18 9y ago
  > "One thing that comes to mind is that while dropping XP might be the manufacturer's recommendation for the OS, it's not the only manufacturer's recommendation in play here. Only geeks like us and the ones in IT departments care about the OS." The OS is simply a part of a piece of capital equipment. Like any other form of capital equipment (think trucks that need their oil, brakes, and tires replaced) the computer is also a piece of capital equipment that must be maintained. The fact that it is not maintained is a function of poor management that should be replaced with management that is more responsible. Nobody would settle for a truck not having brake jobs and tires replaced. That same standard should apply to any form of capital equipment. In this case, MS said that the OS was no longer supported. End of Story. Responsible boards need to start hiring CEOs that understand that it is important to maintain capital equipment.
  - korethr 9y ago
    The piece of capital equipment as far as a hospital or doctor's office is concerned is the medical application software or the MRI machine, not so much the OS, IMO. If Cessna says the only powerplant that your Cessna 172H is certified to use is the Continental O-300, then that's what you run. Continental doesn't make the O-300 or parts for it anymore? Too bad, you fly with an O-300, or you don't fly. Guess it's time to turn to the secondary market for parts and support for that engine. Get a newer airplane with a newer, better engine that's still being supported by the manufacturer? Hmm, the presently-owned 172H is paid off, still flies and still makes money. Buying a brand new 172S requires taking out a new mortgage and isn't going to make any more money than the 172H does. Seems like we're going to keep the 172H for the time being. I don't disagree with you that capital assets should be maintained. However, the companies running these older applications that require older OSes aren't the only ones at fault here. The manufacturers of the medical devices and software themselves are just as much to blame. This situation didn't come about solely because CEOs were being slackers about maintaining capital assets.
glax 9y ago
What about windows 7 and 8.1 ? They were also hacked.The uncertain nature of windows 10 update and the bad press about the telemetry issues was also the reason for the IT Departments to stay clear of it. Why would someone ignore a free windows upgrade ?
- davidf18 9y ago
  It is always best policy in my opinion, to upgrade to the next OS version after the first (point) release. Each new version of the OS (eg, Win 10 over 8.1) has additional security measures not in the previous version. I use Mac primarily and I always do fresh install at the .1 update (eg, 10.12.1 and not 10.12). I run Win 10 on my Parallels VM.
  - glax 9y ago
    Yes i also the same point, why would any one want to miss the free upgrade. The whole update hijack and privacy concerns kept some people away. Organization running bulk of window's xp and 7, for sheer cost cutting purposes. But still the whole thing affected all, if some people weren't hesitant to migrate to the newer update , they would have been saved.
    - davidf18 9y ago
      > "Organization running bulk of window's xp and 7, for sheer cost cutting purposes." I agree with this observation. I believe this also was the reason that Target and Home Depot did not follow manufacturers (Microsoft) recommendations to upgrade point of sale terminals from the (now) unsupported Windows XP embedded to a later version of the OS still supported. Because they disregarded the advice, millions of people had their credit cards hacked. At least the CEO of Target got sacked as a result.
drzaiusapelord 9y ago
>The only people to blame are those that don't follow manufacturers instructions. And even then if you absolutely can't upgrade that XP machine running an MRI then there are best practices to segregate and isolate it from the network properly. I'm getting a little sick of the people with an anti-whatever axe to grind pretending this was some big sophisticated attack that only nation states can do. This patch was released months ago, there's no excuse not to have it. It was just one of the hundreds of Windows exploits found per year. If admins aren't upgrading their equipment or segregating them properly then that's on them. Note, there was no NSA leak for Conficker, codered, heartbleed, slammer, etc. This stuff will not stop unless admins and management take security more seriously. No admin, myself included, had any issues this weekend. It was completely avoidable.
- davidf18 9y ago
  Similarly, all of the brouhaha about Clinton campaign chairman John Podesta getting his gmail account hacked. He was in a very sensitive position and he should have had 2-factor authentication turned on. Gmail has great support for that. If you look through Wikileaks, only after the email hack does he get the recommendation to turn on the 2FA which presumably happens.
danesparza 9y ago
"The only people to blame are those that don't follow manufacturers instructions." I disagree. I think it was the folks that thought it was OK to encrypt files and hold them for ransom in the first place.
- davidf18 9y ago
  Banks have vaults to store money and other valuables. Theft is going to happen even with great policemen. People who don't follow manufacturers instructions (especially when they are told the software is no longer supported and yet they fail to upgrade to a supported OS) are culpable. To run on unsupported software or not to run security updates on supported software is like banks without vaults. Just unrealistic in either case.
silentguy 9y ago
It is tough to discern whether the instruction from Microsoft is to safeguard customers or to increase their marketshare.
- davidf18 9y ago
  Windows XP was released in 2001. Just exactly how long should a company supported outdated software? Since XP there have been the following releases. (1) Windows Vista (2) Windows 7 (3) Windows 8 (4) Windows 8.1 (5) Windows 10. Actually, it is the best policy to upgrade to the latest version of the OS, for security reasons if for no other reason.

deleted 9y ago

[deleted]

pjc50 9y ago

> get accredited By whom? It's the other way round: shutting down an NHS hospital is the sort of thing that would normally be a front-page disaster for the government, so it's almost never going to happen.

davidf18 9y ago
Accreditation is the US is done by The Joint Commission. Hospitals without Joint Commission accreditation cannot get paid for Medicare or Medicaid bills. In Britain the accreditation is done by Care Quality Commission: http://www.cqc.org.uk http://www.cqc.org.uk What's the point of an accreditation agency if they aren't going to ensure that the hospital is run safely which includes running on current software?

dclowd9901 9y ago

In engineering, we should assume the users will not adhere to instruction. This is why in physical engineering, tolerances for usage are often 3x their advertised value. In Microsoft's case, they have the means to know who their users are and ensure they upgrade. Forced upgrades should be an opt-out feature, especially with an OS as prominent as Windows.

pjc50 9y ago
The NHS had already opted out - because of the difficulties in upgrading.
- davidf18 9y ago
  The NHS had warned hospitals several years in advance that Windows XP would be discontinued and that they would have to upgrade the OS. The NHS took out a 1 year contract on Windows XP updates at great financial expense which gave responsible authorities plenty of time to do the system upgrades.
davidf18 9y ago
Don't know what kind of engineer you are, but I have BS EE with minor CS from top engineering school. Airplanes have to undergo preventative maintenance. We don't count on airplanes not being maintained. Sorry. Highway bridges and other structures undergo constant inspection. It is one matter for individuals in their homes choosing not to update a computer or for a privately held firm. But firms with stockholders, or governments must follow manufacturers instructions when they purchase equipment and that includes maintenance whether for their vehicle pool or other equipment.
- scott_karana 9y ago
  > Highway bridges and other structures undergo constant inspection. They are supposed to, but underfunding/mismanagement can abuse the overengineering (which thankfully existed in the first place!) and skip regular inspections, sometimes with fatal consequences. http://www.nbcnews.com/id/22300234/ns/us_news-bridge_inspections/t/feds-let-states-delay-inspections-bad-bridges/ http://www.nbcnews.com/id/22300234/ns/us_news-bridge_inspect...

geofft 9y ago

> The reason the attack happened to including British National Health Service hospitals was because they didn't follow manufacturer's instructions (in this case Microsoft) and upgrade their Windows XP software to Windows 10. Well, on one side, you have the OS manufacturer's instructions to update to Windows 10. On the other side, you have the software manufacturer's instructions to stay on Windows XP at all costs. Which instructions do you listen to? (Arguably, before this week, it would have been empirically correct to listen to the software manufacturer; upgrading from XP would have definitely broken the system, but staying on XP didn't break it so far.)

davidf18 9y ago
> "On the other side, you have the software manufacturer's instructions to stay on Windows XP at all costs." It is one thing for an individual to purchase software for their own needs, but any firm or government should not purchase software that will not be upgraded to the current versions of the Operating System. That is simply irresponsible and should have been rectified in the purchase contract. As it is, are there specific examples of software used by firms and government that are not updated to current versions of Windows?
- jvgiuiigvuuc 9y ago
  > That is simply irresponsible and should have been rectified in the purchase contract. Have you heard the expression "captive market"? It's not like they can buy equivalent software from a company that guarantees upgrades.
  - davidf18 9y ago
    > "As it is, are there specific examples of software used by firms and government that are not updated to current versions of Windows?" Sounds like a hypothetical. What applications software is being purchased for which there is no equivalent and only a captive market?
- acqq 9y ago
  Even common hardware devices as plain notebooks don't run properly with the "newer" OS. I have one notebook for which the drivers break with anything above Windows 7. I have another which can't be upgraded over Windows 8.1. For both Microsoft's "Get Windows 10" claimed they "will work" with Windows 10 (there were ads running on both which do the "check" before). I've tried the upgrade for both. The Windows 7 one has problems with the WiFi card -- reason: Intel never made newer drivers, the old aren't actually compatible with the newer systems. The Windows 8.1 one has problems with the touchpad: reason: the newer drivers are broken for that model. It also has some display issues on the Windows 10. The WiFi card, the touchpad and the display effectively aren't replaceable. But the computers, apart from not running the newer OS, work without a flaw. If I as a consumer with only a few computers have such problems, I can't see how you don't understand that the whole companies can have immense number of computers that work perfectly with their current OS and would simply break with the newer one. They would not upgrade, but they would install the security updates. But guess what, Microsoft doesn't want to give the security updates to everybody who has Windows XP. Only after this failure they "exceptionally" did it. So Microsoft is absolutely responsible. They can say "we'd prefer to motivate people to buy new" but they are still morally responsible for not releasing updates when there are so many actively used systems.

kevindqc 9y ago

I don't think it's that easy though. For example, if your CT scan software was made for Windows XP and you randomly update to Windows 10, then if you have any problems, the company making the software can blame you for not using Windows XP and you're on your own, since that's what the software has been tested/accredited for? That's what I read somewhere, not sure how accurate it is. I imagine the ideal solution would be to have a clause in the contract with the software company that they have to test and re-validate their software on new versions of windows and updates in a timely fashion so that the computers running the software can be updated? That would probably increase costs though

davidf18 9y ago
It is a terrible business and business arrangement (eg, the original contracts to purchase said software or equipment that uses software) that doesn't insist that the purchased software/machine run on manufacturer (in this case Microsoft) approved OSs. If the manufacturer says upgrade, then upgrade. When you purchase software and equipment, this should be part of any standard contract.
- cmurf 9y ago
  People in the know have been complaining about this for many years, and it's corporate bean counters that collude with a sclerotic corporate IT mentality to be conservative in all things including software. And the reality is, the overwhelming majority of IT people have no training or background in risk assessment, they are not computer security people. But the bean counters, always optimizing, without good information let alone perfect information, have assessed risk incorrectly. And now there's a wildfire in progress, and basically being incompetent at the task they were handed, are all surprised. Many other people who have considered this eventuality are not surprised.
  - davidf18 9y ago
    > "And the reality is, the overwhelming majority of IT people have no training or background in risk assessment,..." But in this case, as in the case of credit card hacks of Target and Home Depot, it was simply a matter of following manufacturers maintenance instructions and upgrading the OS version from an unsupported version to a supported version. As many have pointed out, in the case of Windows 10, the upgrades had been free at no charge from Microsoft.

Silhouette 9y ago

The reason the attack happened to including British National Health Service hospitals was because they didn't follow manufacturer's instructions (in this case Microsoft) and upgrade their Windows XP software to Windows 10. And what happens if some of the software or equipment used with that system is not compatible with Windows 10? I can make a very secure house if I give it solid, metre-thick concrete walls, ceiling and floor, but it won't be very useful as a house without things like doors and windows. You're far too quick to excuse Microsoft for what was, ultimately, a defect in the original product.

davidf18 9y ago
> "And what happens if some of the software or equipment used with that system is not compatible with Windows 10?" It is irresponsible for a firm or government (as opposed to an individual) to purchase software without a contract that ensures that it will be upgraded to current versions of the OS. > "You're far too quick to excuse Microsoft for what was, ultimately, a defect in the original product." What defect are you referring to exactly? That Microsoft years ago couldn't predict every way that cybersecurity attacks happened to their OS? Or that users of versions of Microsoft software still under support contracts (including firms and governments) did not run software update tools for a patch released in mid-March? It is simply unrealistic for a firm to anticipate all forms of cybersecurity attacks. Later versions of OSs include not only different architectures to fix cybersecurity flaws but take into account changes in the Intel hardware that help to combat cybersecurity attacks.
- Silhouette 9y ago
  It is irresponsible for a firm or government (as opposed to an individual) to purchase software without a contract that ensures that it will be upgraded to current versions of the OS. We're talking about things like medical equipment, often in regulated fields. There may be no such contract available, and even if there is, upgrading to a totally new OS may or may not be acceptable. The idea that you should throw out millions of pounds of high-tech medical scanner every few years because a hundred buck OS that it was supplied with couldn't be kept secure is laughable. What defect are you referring to exactly? They supplied an OS that was not secure. The rest is just rationalisation and apologies. It is simply unrealistic for a firm to anticipate all forms of cybersecurity attacks. It is also unrealistic to expect organisations concerned with literally saving lives not to buy equipment unless they have a plan in place to deal with updating the software on or used with that equipment in arbitrary ways with arbitrary consequences whenever anyone responsible for any part of its software sneezes. The need for stability, reliability and longevity is precisely why so much in this kind of sector is regulated in the first place. Perhaps the problem here was that such systems should never have been built on such an insecure platform and then connected to a network, but that too is on the device manufacturer and not the hospital. There are basic standards of fitness for purpose that are reasonably expected with such devices, even without more specific regulation. Particularly in this sort of field, those devices should then be supported for their entire working lives, not some arbitrarily shortened version of their working lives dictated by one software development organisation.

ajross 9y ago

> The reason the attack happened ... A reason. Real events have lots of root and proximate causes. MS could also have avoided writing the bug, or discovered it themselves with better auditing. NHS could have disabled SMB on systems that don't use it, or otherwise firewalled it. And, of course, the NSA could have disclosed the bug when they found it instead of hoarding it. Or better protected their tools from theft. Or the Shadow Brokers could have better audited their disclosure to avoid spilling active hacks into the public. Almost all of these things were required to get to where we are, and all of them are "simple and expected" from at least someone's perspective. Lots of blame to go around, basically.

deleted 9y ago
[deleted]
davidf18 9y ago
> "A reason. Real events have lots of root and proximate causes. MS could also have avoided writing the bug, or discovered it themselves with better auditing. NHS could have disabled SMB on systems that don't use it, or otherwise firewalled it." No machines are built perfectly from the start and there are changes made over the capital equipment's life be it airframes, jet engines, or computer systems. When purchasing capital equipment or buildings, bridges, etc, part of the responsibility of the firm is to follow the manufacturer's or builder's instructions and including maintenance upgrades. In the case of Microsoft, they gave warnings for years that the Windows XP software would not continue to be maintained. The issue was not Microsoft, but NHS (and other governments, firms) decisions not to budget for and perform maintenance for the capital equipment that they purchased.
bwanab 9y ago
I agree this should be upvoted more than ten times. It's staggering to me that so many recent revelations have shown that in their efforts to protect us, the 3 letter agencies have allowed vulnerabilities to exist on our machines -- and considered them assets -- without warning us.

cmurf 9y ago

There's plenty of blame to go around, if you want to play blame games. The "free market" has no mechanism for 3rd parties to affect the decision making process. Microsoft has its policies, well known to the buyers, and the buyers accepted this as well as their own policy to delay recommended upgrades. A completely neutral person, a patient, is put at risk through no fault of their own, had absolutely no say in either transaction (either the original point of sale of the OS, or the policy to not keep software up to date) is injured. This person arguably has an injury claim against Microsoft (their bug, their policy to stop updating software without disabling it thereby permitting the broad weaponization of their software). And they have an injury claim against each medical service institution who refused service because their systems were fully or partially non-functional due to their negligent choice to run old software; to not have their own user space programs on a constant "everygreen" cycle so that, without any gaps, it's possible to run their mission critical software on a currently supported and secure OS. Basically, these injured 3rd parties have to sue or legislate. Either way it requires a sovereign to intervene in the market. And what role and blame do millions of non-business end users running outdated software, and their computer was part of a web enabling such prolific spreading of malware? Do they get sued or billed their incremental share? What if it's $1000 per person running Windows XP? And now that they have liability, maybe they can all sue Microsoft because Microsoft permits them to run outdated software? This shit really needs to be engineered better, and really where we're at is, we're monkeys playing with computers and reveling in our own self-importance, when in reality we still sometimes suck. And this is an (yet another) example of how primitive we are still.

davidf18 9y ago
> There's plenty of blame to go around, if you want to play blame games. The "free market" has no mechanism for 3rd parties to affect the decision making process. Microsoft has its policies, well known to the buyers, and the buyers accepted this as well as their own policy to delay recommended upgrades." Nobody forced people to purchase Microsoft software. There are other vendors (Apple, Linux based systems). But if they choose to purchase the software, they need to follow the vendors maintenance instructions if they want properly operating equipment. Does United Airlines ignore the maintenance instructions of Boeing or Airbus? If they even thought about it, the FAA would be all over them. In the case of hospitals in the US and the UK there are accrediting agencies. In the US it is The Joint Commission. In the UK it is Care Quality Commission. If the people running hospitals are irresponsible and choose not to follow manufacturers instructions for maintenace for any capital equipment, then the accrediting agencies should refused accreditation.

digi_owl 9y ago

Best i recall, the NHS had signed an extended maintenance contract for XP. But it had recently been dropped because some beancounter had decided they could not afford it. In the end it may well be a big validation of the FSF message, as then the NHS (or anyone really) could hire someone to maintain the software beyond the existence of the original company. This much like how i can find someone to repair something for me that physically broke, because the tools and such are widely available and known (or even attempt to do so myself).

davidf18 9y ago
According to an NHS blog post about the matter, the NHS corporate (or whatever) had been warning hospitals, etc. that Microsoft was discontinuing maintenance of XP and to upgrade. They purchased an additional year of coverage giving hospitals yet another year to upgrade to a supported version of Windows. Many ignored the one year time they had as well as the earlier warnings.

PakG1 9y ago

While that's true, there is a flip side that there were likely a lot of custom-made or proprietary systems that only worked on XP. Even worse, there were likely various medical hardware that only had drivers for XP. So upgrading from XP is not necessarily an easy project, and definitely not cheap. It's likely a huge project that would be like doing a complete circulatory system transplant, not a simple isolated heart transplant.

davidf18 9y ago
As far as I recall, one should generally be able to use a Win XP in a VM running say, on a Win 10 OS. Fixing by writing drivers may not be cheap for the vendor of the software, but they should do it. You simply can't get around the fact that each new version of the OS is more secure than previous versions.
- PakG1 9y ago
  Yeah, but let's not punish customers for choosing a vendor that sucks more than they already get punished. Bad decisions have their own consequences, that should be punishment enough. Also, who knows how many good vendors are out there for medical equipment. I'm not an expert, but I only hear horror stories, which may or may not just be because only the horror stories are worth telling others.
  - davidf18 9y ago
    Healthcare is a mission critical business and they need to be responsible when purchasing capital equipment including of course, software. If it doesn't operate properly for example, in the US there could not only be patient harm or disclosure of their private information, the firm could be liable for malpractice or HIPAA (law regarding health record security) the later two can have financial consequences as well as direct patient health consequences. Running on an unsupported and even if supported, not updated, software, invites failure and nobody can feel that their health records are secure. Airplane maintenance for a Boeing or Airbus is very expensive, but you have to do it. The same may be true of devices and software in healthcare. Still need to do it right. I don't see the alternative. Do you?

korethr 9y ago

One thing that comes to mind is that while dropping XP might be the manufacturer's recommendation for the OS, it's not the only manufacturer's recommendation in play here. Only geeks like us and the ones in IT departments care about the OS. Most of the rest of people don't care about the OS -- they care about the applications and devices they can use with it. The OS only matters to the degree it enables or hinders that. So when it comes to the computers used by hospitals and doctos and the like, OS manufacturer instructions are lower down on the priority list, below the manufacturer instructions for the applications and medical devices they use. And if $MedicalRecordsApp or $MedicalEquipmentController is only certified by the manufacturer to run properly under Windows XP, then you can bet that the hospitals and doctors offices are going to continue to run Windows XP.

davidf18 9y ago
> "One thing that comes to mind is that while dropping XP might be the manufacturer's recommendation for the OS, it's not the only manufacturer's recommendation in play here. Only geeks like us and the ones in IT departments care about the OS." The OS is simply a part of a piece of capital equipment. Like any other form of capital equipment (think trucks that need their oil, brakes, and tires replaced) the computer is also a piece of capital equipment that must be maintained. The fact that it is not maintained is a function of poor management that should be replaced with management that is more responsible. Nobody would settle for a truck not having brake jobs and tires replaced. That same standard should apply to any form of capital equipment. In this case, MS said that the OS was no longer supported. End of Story. Responsible boards need to start hiring CEOs that understand that it is important to maintain capital equipment.
- korethr 9y ago
  The piece of capital equipment as far as a hospital or doctor's office is concerned is the medical application software or the MRI machine, not so much the OS, IMO. If Cessna says the only powerplant that your Cessna 172H is certified to use is the Continental O-300, then that's what you run. Continental doesn't make the O-300 or parts for it anymore? Too bad, you fly with an O-300, or you don't fly. Guess it's time to turn to the secondary market for parts and support for that engine. Get a newer airplane with a newer, better engine that's still being supported by the manufacturer? Hmm, the presently-owned 172H is paid off, still flies and still makes money. Buying a brand new 172S requires taking out a new mortgage and isn't going to make any more money than the 172H does. Seems like we're going to keep the 172H for the time being. I don't disagree with you that capital assets should be maintained. However, the companies running these older applications that require older OSes aren't the only ones at fault here. The manufacturers of the medical devices and software themselves are just as much to blame. This situation didn't come about solely because CEOs were being slackers about maintaining capital assets.

glax 9y ago

What about windows 7 and 8.1 ? They were also hacked.The uncertain nature of windows 10 update and the bad press about the telemetry issues was also the reason for the IT Departments to stay clear of it. Why would someone ignore a free windows upgrade ?

davidf18 9y ago
It is always best policy in my opinion, to upgrade to the next OS version after the first (point) release. Each new version of the OS (eg, Win 10 over 8.1) has additional security measures not in the previous version. I use Mac primarily and I always do fresh install at the .1 update (eg, 10.12.1 and not 10.12). I run Win 10 on my Parallels VM.
- glax 9y ago
  Yes i also the same point, why would any one want to miss the free upgrade. The whole update hijack and privacy concerns kept some people away. Organization running bulk of window's xp and 7, for sheer cost cutting purposes. But still the whole thing affected all, if some people weren't hesitant to migrate to the newer update , they would have been saved.
  - davidf18 9y ago
    > "Organization running bulk of window's xp and 7, for sheer cost cutting purposes." I agree with this observation. I believe this also was the reason that Target and Home Depot did not follow manufacturers (Microsoft) recommendations to upgrade point of sale terminals from the (now) unsupported Windows XP embedded to a later version of the OS still supported. Because they disregarded the advice, millions of people had their credit cards hacked. At least the CEO of Target got sacked as a result.

drzaiusapelord 9y ago

>The only people to blame are those that don't follow manufacturers instructions. And even then if you absolutely can't upgrade that XP machine running an MRI then there are best practices to segregate and isolate it from the network properly. I'm getting a little sick of the people with an anti-whatever axe to grind pretending this was some big sophisticated attack that only nation states can do. This patch was released months ago, there's no excuse not to have it. It was just one of the hundreds of Windows exploits found per year. If admins aren't upgrading their equipment or segregating them properly then that's on them. Note, there was no NSA leak for Conficker, codered, heartbleed, slammer, etc. This stuff will not stop unless admins and management take security more seriously. No admin, myself included, had any issues this weekend. It was completely avoidable.

davidf18 9y ago
Similarly, all of the brouhaha about Clinton campaign chairman John Podesta getting his gmail account hacked. He was in a very sensitive position and he should have had 2-factor authentication turned on. Gmail has great support for that. If you look through Wikileaks, only after the email hack does he get the recommendation to turn on the 2FA which presumably happens.

danesparza 9y ago

"The only people to blame are those that don't follow manufacturers instructions." I disagree. I think it was the folks that thought it was OK to encrypt files and hold them for ransom in the first place.

davidf18 9y ago
Banks have vaults to store money and other valuables. Theft is going to happen even with great policemen. People who don't follow manufacturers instructions (especially when they are told the software is no longer supported and yet they fail to upgrade to a supported OS) are culpable. To run on unsupported software or not to run security updates on supported software is like banks without vaults. Just unrealistic in either case.

silentguy 9y ago

It is tough to discern whether the instruction from Microsoft is to safeguard customers or to increase their marketshare.

davidf18 9y ago
Windows XP was released in 2001. Just exactly how long should a company supported outdated software? Since XP there have been the following releases. (1) Windows Vista (2) Windows 7 (3) Windows 8 (4) Windows 8.1 (5) Windows 10. Actually, it is the best policy to upgrade to the latest version of the OS, for security reasons if for no other reason.