7 ms·

I can't help but feel that Microsoft providing these security updates long past XP's stated EOL date will only decrease security in the long run. After all, if

• jimmaswell 9y ago
  Anyone still using XP at this point is obviously not planning to upgrade to a new OS in the first place. I'm certain there are virtually no XP users who would have been swayed to finally upgrade by these specific security patches being withheld.
  • DuskStar 9y ago
    Maybe not from security patches being withheld, but I'd bet that Britain's NHS has done something to improve security following their encounter with WannaCry - and I know my university's hospital system did.
• ch4s3 9y ago
  Imagine if you will a hospital system say, the VA, which owns a number of MRI machines, x-ray equipment, or similar which runs Windows XP. Now imagine that these machines were built by a company that was acquired and dismantled and therefore can no longer provide updates. Now imagine that these machines are connected to the local network behind the firewall, but can not be air gapped... for reasons. These machines work just fine, other than having an old OS. Should they get scrapped?
  • codefined 9y ago
    I'd say yes, especially if they're not getting security updates and are connected to the rest of the network. Honestly, the cost of it getting broken into seems to be significantly higher than the cost of upgrading the systems.
    • noxToken 9y ago
      The problem is getting the funding for such a thing approved when it's not already stipulated in the contract from the start. "Who cares if it's EoL at Microsoft? Is it broken? Will it break when they put it in EoL status? Alright then - leave them be."
    • thehardsphere 9y ago
      > Honestly, the cost of it getting broken into seems to be significantly higher than the cost of upgrading the systems. We don't necessarily know what the costs of "getting broken into" are. It depends on who you are and what the breakin does. It could only cost the time it takes for IT to restore a backup and plug the hole. I mean, yeah, if you suffer a spectacular ransomware attack and are screwed so badly that you must pay the ransom and everyone finds out, that's probably more expensive than updating. But that's not the only threat or even the most likely threat your organization may contend with. We also don't necessarily know what the costs of updating are. If you're just doing boring office stuff, the costs are low and you should just fork over the money to Microsoft and get it over with. If you need to update a bunch of custom drivers for some devices that are important to your business because the device manufacturer went out of business, that could be a vastly expensive software development project that your organization can't afford to do. Certainly that costs a lot more than having Bob in IT rewind the tapes when Russian hackers get ransomware past the firewall.
  • mrweasel 9y ago
    >Should they get scrapped? Of cause not, but the hospital knew that the Windows XP running their multi-million dollar scanners would be end-of-life before the scanner it self. They should have required that the software be placed in escrow for the life time of the scanner, so that other parties could do any needed updates, if the supplier failed to do so. I'm sorry, I get that you can't throw away expensive hardware, just because Microsoft no longer patch that version of Windows required to run the software but: EVERYONE knew that the hardware would be in use beyond end of life date for the operating system. So why isn't that included in contracts and support plans? Do banks and hospitals even care enough to ask how the supplier plans to deal with an EOL operating system?
    • thehardsphere 9y ago
      > They should have required that the software be placed in escrow for the life time of the scanner, so that other parties could do any needed updates, if the supplier failed to do so. People do that?
      • BEN247 9y ago
        I've worked on software for large pharma companies and several of our customers required escrow agreements. In our case it was to protect against us going under rather than just not wanting to do updates any more.
      • ethbro 9y ago
        If you're big enough, you can negotiate any contract you want. And "if company ceases to maintain and release updates to product, we will receive the source code for our use" doesn't sound like too poison of a pill for Sales to push through.
      • EwanToo 9y ago
        All the time, particularly for either very big contracts, or where a large customer is buying from a small supplier who they consider too much of a risk without it
    • thehardsphere 9y ago
  • guimarin 9y ago
    seems like a false choice. why couldn't i understand what functions these machines exactly needed and then put a small linux box between them and the network which monitors all incoming/outgoing traffic and only allows allow-list items to pass on to the ancient XP device.
    • thehardsphere 9y ago
      Here's two guesses: 1. Well, maybe you could do that with your abundance of skill and time, but not everyone running a hospital/bank/other-large-organization has the time or budget to slap together and maintain that kind of amateur hour rope-and-tin cans proxy shit. 2. Not everything people use a computer for happens over a network. Some people write software because they need to communicate directly with hardware devices. You can’t intercept network traffic when there is no network traffic to intercept.
      • guimarin 9y ago
        1. Seems like a business opportunity. 2. I believe we're talking about network accessible devices here. Otherwise why would parent make comment about air-gapping infeasible?
        • thehardsphere 9y ago
          1. Not really. I mean, at some point, if you're going to do it properly, it'll cost money. Unless you can reliably do this for less than or equal to what the hospital is willing to pay, there's no business. "Less than or equal to" is probably not going to be enough money to fix the problem if they already decided not to just try this "just put a linux machine in front" idea. 2. The parent mentioned networking, but networking is not the only threat vector that must be accounted for. Malware can spread through removable media, and most organizations outside of the military or federal government simply don't have the sort of security policies in place to prevent that. So the unpatched vulnerabilities people are talking about can still be exploited even without the network stack doing anything.
  • swiley 9y ago
    If there where a requirement by the hospital that they have access to the source for everything this would just be a matter of hiring a consultant.
    • eli 9y ago
      Isn't it the case that some organizations do have negotiated access to the Windows source code?
      • swiley 9y ago
        Maybe, it's also true that 100% of Linux users legally have access to the Linux source code.
      • kasparsklavins 9y ago
        Governments sure. For vetting purposes supposedly. Private organisations/companies? Less likely. Would they even have the ability to do a build from the source code?
        • an27 9y ago
          "Supposedly" Thanks for that one, I didn't put those together before.
        • eli 9y ago
          Yeah, there's definitely a program for private organizations https://www.microsoft.com/en-us/sharedsource/ https://www.microsoft.com/en-us/sharedsource/
    • joosters 9y ago
      'Just hiring a consultant' to rewrite the software for medical equipment, really? For all our sakes, please never go into the medical industry.
  • SomeStupidPoint 9y ago
    Absolutely. It's the only way that large institutions will come to properly value the security trade-offs of their decision to buy closed-source, proprietary systems. Why should the VA get to externalize part of their purchasing decision on to Microsoft?
    • ch4s3 9y ago
      What do you want health systems to do here? They can only buy FDA approved devices. If there aren't any that run linux that are approved, then they can't buy or use them. Want to change that? Go write a bunch of drivers and DICOM related software for CentOS, then start a device company, then build a device, then wait 10 years for it to get approved, then sell it. And while you're doing all of that, remember to stay ahead of the competition and not run out of cash. These devices run embedded Windows because they all always have. There's almost no competitive advantage in changing OS vendors in the space, because it doesn't differentiate the product. Even if a device ran CentOS or whatever, you wouldn't be able to update it significantly without going back to the FDA.
      • SomeStupidPoint 9y ago
        > What do you want health systems to do here? Lobby to change the market instead of externalizing costs; pool money to change the market instead of externalizing costs; etc. I'm sick of people defending poor long-term decisions by saying they're short-term efficient. The providers aren't helpless entities these things are just happening to: they chose to go down a route that was expensive long-term, but cheap short-term and now are asking to not have to face the consequences of that. I can guarantee that every single institution facing this concern received a technical report pointing out exactly this issue -- and chose to ignore it so a manager could have a bigger bonus. Instead of addressing the problem, they're asking to be let off the hook of their poor decision making and laying the groundwork for the same mistake. Continually bailing out such poor decision making isn't prudent. Why would they ever change if there's no consequence? This isn't a long-term strategy we can afford to support, so we're obligated to let it blow up in their face.
        • 9y ago
  • eli 9y ago
    And add to that the machines are very expensive and there are laws that make it very difficult/illegal to make unapproved modifications to this equipment.
    • HeyLaughingBoy 9y ago
      This is pretty much the answer. The medical device was validated with a certain version of the OS and any special configuration placed on it. If you change the OS/configuration setup in anyway, you (the manufacturer) have to analyze it for impact and potentially re-validate it. The user cannot make this change This would be a violation of FDA regulation. Now, the hospital can say that they're going to stop using your equipment until you "fix" it --- many such products are leased, not purchased and they may use the lack of security to break the lease. But that presumes they can get a replacement that works as well, train personnel in it, update the supply chain, storage, incoming inspection, etc. for this new product and any supplies it needs... It's not as simple as running down to MicroCenter and installing a copy of Windows 10!
      • King-Aaron 9y ago
        From my experience (~5 years working as a PCA in a cardiovascular imaging and catheterisation lab), upgrades to large imaging equipment and such is scheduled throughout the year according to the lease plan, and these companies (i.e. Siemens) work together with the OS providers and know full well when operating systems are scheduled to be upgraded. However you're exactly right, it's got to be left specifically to the Siemens tech who comes out to work on the machine. (Bit of a moot point in agreement, but thought I'd share my 2c)
  • mjevans 9y ago
    Those machines should NEVER have shipped with a closed source OS (that wasn't the responsibility of the manufacture) in the first place. The fault lies entirely with the manufacturer for not providing a system fit for use/sale.
    • discreditable 9y ago
      Using an open-source OS isn't a panacea. If $vendor ships a dynamically linked binary tied to a libc version that shipped in Ubuntu Warty Warthog, your upgrade path is just as broken.
      • an27 9y ago
        C programmers are a lot cheaper than capable reverse engineers, though.
      • mjevans 9y ago
        If that's done then there's at least still the option of trying a more recent version of the library, and if THAT breaks paying someone to write a compatibility wrapper for it. It would still cost money, but at least there's a legal path forward. Better still would be having a device that operates on some commodity connectivity using standard protocols (APIs/etc) which can be soft-gaped by a firewall / guard that only lets well formed (or at least expressly authorized) requests in. The open source OSes do go extremely out of their way to provide and keep userland APIs stable, in many cases modern hardware that would be completely unsupported in XP or some other proprietary OS, and again, if something that used to be depended on somehow falls out of support you're at least actually free to pay someone to add in the support you need.
      • eeZah7Ux 9y ago
        Thousands of consulting companies would be happy to provide repositories with security fixes and long term support services.
      • thingification 9y ago
        This is (at least partially) true, but it strikes me as whataboutery? Yes, open source vendors can fail to follow good open source/free software principles just as closed-course vendors can, and yes "medical equipment is now mostly open source" is not the end of all progress.
  • alkonaut 9y ago
    This keeps being repeated. But it doesn't excuse it. Either a machine is kept secure/up to date or it's not connected to the internet. If a hospital feels it can't just disconnect the unsafe machines, well then air gap the whole treatment network. Perhaps there exists an easier middle ground solution such as somehow putting a safe proxy machine in between the unsafe machine and the internet using a very simple controlled communication to the unsafe machine? Should they be scrapped? Maybe not. But not just left as they are either. Most importantly: don't BUY that next MRI if it's approved only for a certain OS version and it's a general purpose OS such as Windows, and it will be connected to the internet. If you DO buy it - calculate with writing it off within the support window for the OS. That will show its true cost. Further, equipment using general purpose OS'es should stop being approved for one version and automatically qualify for newer versions. Alternatively the approval should not be valid beyond the support window unless the machine is air gapped.
    • qb45 9y ago
      > Either a machine is kept secure/up to date or it's not connected to the internet. If a hospital feels it can't just disconnect the unsafe machines, well then air gap the whole treatment network. I wonder if it would be feasible to protect them with some dedicated firewall/proxy boxes or plug-in modules which could be cheaply updated (compared to the cost of updating and revalidating the whole machine), supplied by multiple vendors, etc.
  • cblock811 9y ago
    Those machines are still the responsibility of the hospital and it's their obligation to update them so that the safety and security of their patients is upheld. Inconvenient things happen and companies are expected to adapt to those situations and respond rather than say "it's not our fault", especially in something as critical as medicine.
    • eropple 9y ago
      In many cases, the hospital updating the system puts the system out of compliance and the device can be unlawful to operate. They can (sometimes) put in intermediary proxies and the like, but that's not a cheap process.
  • tajen 9y ago
    Do you actually want to be x-rayed by a machine running "just fine" on WinXP and not ever air gapped?
• thingification 9y ago
  Is it possible this means it was a mistake to buy those systems, because they are not based on open source software? One objection is that these systems may have been the only ones on offer that met requirements. I think one has to consider collective effects, though: were people prepared to 'irrationally' say "I'm still not buying it, because it's not open source", we would end up with open source MRI machines. Of course that's unlikely to happen at present simply because there is NOT a consensus that open source software is important or even a good thing in this context -- but this argument addresses THIS objection. That kind of stance happens in some situations, and not currently in this one. I don't think that's an immutable state of affairs. Also, I don't think it's because of the high direct costs of saying "no": refusing to pay kidnappers also has a high direct cost and an analogous collective benefit (I'm not aiming for a hyperbolic moral comparison there, I just picked that because, as an extreme case, it makes the point clear).