5 ms·

It wouldn't surprise me if the pandemic had an influence on some of these hacks. E.g. at our company there are some PCs still running Windows 7. For that reason

It wouldn't surprise me if the pandemic had an influence on some of these hacks. E.g. at our company there are some PCs still running Windows 7. For that reason they had no direct internet access, only to the internal network. But since about half the workforce, or at times more, had to work from home, and the licenses of our ERP software are bound to hardware, IT had to connect those PCs to the internet again, so the office workers could access them from home. Of course the whole situation was less than ideal to begin with, but now it's even worse.

dboreham 6y ago
Just to point out this makes no sense: you can have connectivity between host A and host B without also enabling transitive connectivity to the world of hacker-contolled host N.
- dEnigma 6y ago
  I should also mention that it isn't in-house IT, but a separate company, and the whole thing was set up in a rushed effort late on a Friday afternoon the week before the whole working from home business would start (our management slept on it until the last minute), with a lot of other companies requesting the same support from the IT company at the same time. Not that it completely excuses everything, and as you can tell from the Windows 7 PCs it was never the most secure setup, but simply to explain some of the reasons behind the mess.
  - Kalium 6y ago
    This has all the hallmarks of an organization that views IT as a cost center rather than an enabler. Such an organization will tend to resent any spending on IT, so it's unfortunately not a surprise that it has likely scrimped and saved its way into ineffectual IT.
- ethbr0 6y ago
  I believe this is assuming companies have segmented networks and jump hosts. In my experience, most... don't. Enterprise IT at non-tech companies is an absolute #&@_ show. The only rationale I've been able to come with is: if some portion of your company isn't developing / keeping up with tech trends, your IT shop isn't going to be pressured to either.
  - sbarre 6y ago
    Most non-tech companies don't have an IT department, they outsource. Which means they rely on those companies to do the right thing, while not really prioritizing the work (i.e. not giving it much budget), or being able to critically evaluate the quality of the work being done. So none of this is surprising.
  - Godel_unicode 6y ago
    It's also the case that the perception of non-technical companies having garbage IT means they get overlooked by more savy admins in their job-hunt. Very few people want to drag a manufacturer kicking and screaming into modern IT, when it's way easier to get a job with a company that gets it. This year is going to be huge for Google cloud and m365.
    - Kalium 6y ago
      It's also been my experience that non-technical companies sometimes strongly undervalue IT or programming expertise. Few who have a choice ways to take a job at a rate well under market using outdated technologies with an employer who will not value them. I had one of those jobs for a while. It was awful. The worst part was the ridiculous demands (example: all bugs should be fixable in 30 minutes or less) on top of the embarrassingly low pay.
      - buran77 6y ago
        > non-technical companies sometimes strongly undervalue IT or programming expertise Half of this is actually the right way to do it. On one hand undervaluing IT in almost any company these days is a major problem waiting to blow up. IT isn't just an end, it's the means to do everything else. Using computers but ignoring any good IT practice under the excuse that it's not an IT company is like working from an office with asbestos, lead paint, and black mold because you're not a construction company. But on the other hand non-technical companies, meaning ones without a strong IT culture and focus, should undervalue programming expertise. One of the worst things a non-tech company should do is deploy all kinds of custom IT solutions developed internally by their "programmers with expertise". Invariably (and I mean this in the most literal sense possible) they will end up with a patchwork of systems that nobody understands or maintains properly but which underpins all the core services the company needs or delivers.
- Kalium 6y ago
  You're absolutely correct. You can do that! There may be some room to question the general technical expertise and competence of a shop that runs a bunch of Windows 7 systems, though. IT running beyond the limit of their competency may not be capable of doing what you so wisely and rightly point to.
  - reaperducer 6y ago
    There may be some room to question the general technical expertise and competence of a shop that runs a bunch of Windows 7 systems, though Or they may simply not have a choice. My company has a particular automated machine that I have to work with once or twice a month. It is controlled by a computer that runs Windows XP. It can only run Windows XP because the company that made the software went out of business years ago. Because of that, the control computer is not permitted on the public internet. When I interface with it, it's using a dedicated laptop through a VPN to a remote session which then accesses the control machine on a dialup connection. It's slow as heck, but since I only have to do it once or twice a month, I deal. Just before the pandemic, we looked into replacing the circa 1995 automated machine with a new one. Because of the nature of the machine, and the local government regulations about replacing it, the cost would have been little over one million dollars. Not going to happen. Everyone hates it. But that's why my company's IT department, which tries hard to keep up with the times, has a single Windows XP computer in its stable.
    - marshmallow_12 6y ago
      which regs tells you what computers you can buy?
      - reaperducer 6y ago
        which regs tells you what computers you can buy? Not all machines are computers.
      - Kalium 6y ago
        Sometimes medical devices and similar come with a computer as part of a whole certified system. The regulatory framework does not tell you which computer you can buy, precisely, but it does tell you what certifications your system must have to be used for a given purpose. Changing out the part for an unapproved one, obviously, voids the certification.
- ddalex 6y ago
  VPNs ?
lostlogin 6y ago
> there are some PCs still running Windows 7. A humble brag! There are some very elderly machines out there.
dhosek 6y ago
Some? I've never seen anything newer than Windows 7 on a corporate PC. I'm sure they're out there somewhere but none of the companies that I've worked at in the last 9 years has ever had Windows 8 or newer.
- inglor_cz 6y ago
  The last Windows 7 I saw in production was on Wednesday. An attorney with a lot of secrets to protect had them on his notebook. He isn't entirely oblivious about security, has his hard drive encrypted and encrypts some of his calls, but the non-updated system is a disaster waiting to happen.
  - dhosek 6y ago
    I have to use Windows 7 daily at my current job at a bank (connecting via VDI). I forgot to wish the operating system happy tenth birthday a couple weeks ago.
- jcrites 6y ago
  Amazon was on Windows 10 in 2020 (and probably earlier; I don't remember when I upgraded while I was there).

dboreham 6y ago

Just to point out this makes no sense: you can have connectivity between host A and host B without also enabling transitive connectivity to the world of hacker-contolled host N.

dEnigma 6y ago
I should also mention that it isn't in-house IT, but a separate company, and the whole thing was set up in a rushed effort late on a Friday afternoon the week before the whole working from home business would start (our management slept on it until the last minute), with a lot of other companies requesting the same support from the IT company at the same time. Not that it completely excuses everything, and as you can tell from the Windows 7 PCs it was never the most secure setup, but simply to explain some of the reasons behind the mess.
- Kalium 6y ago
  This has all the hallmarks of an organization that views IT as a cost center rather than an enabler. Such an organization will tend to resent any spending on IT, so it's unfortunately not a surprise that it has likely scrimped and saved its way into ineffectual IT.
ethbr0 6y ago
I believe this is assuming companies have segmented networks and jump hosts. In my experience, most... don't. Enterprise IT at non-tech companies is an absolute #&@_ show. The only rationale I've been able to come with is: if some portion of your company isn't developing / keeping up with tech trends, your IT shop isn't going to be pressured to either.
- sbarre 6y ago
  Most non-tech companies don't have an IT department, they outsource. Which means they rely on those companies to do the right thing, while not really prioritizing the work (i.e. not giving it much budget), or being able to critically evaluate the quality of the work being done. So none of this is surprising.
- Godel_unicode 6y ago
  It's also the case that the perception of non-technical companies having garbage IT means they get overlooked by more savy admins in their job-hunt. Very few people want to drag a manufacturer kicking and screaming into modern IT, when it's way easier to get a job with a company that gets it. This year is going to be huge for Google cloud and m365.
  - Kalium 6y ago
    It's also been my experience that non-technical companies sometimes strongly undervalue IT or programming expertise. Few who have a choice ways to take a job at a rate well under market using outdated technologies with an employer who will not value them. I had one of those jobs for a while. It was awful. The worst part was the ridiculous demands (example: all bugs should be fixable in 30 minutes or less) on top of the embarrassingly low pay.
    - buran77 6y ago
      > non-technical companies sometimes strongly undervalue IT or programming expertise Half of this is actually the right way to do it. On one hand undervaluing IT in almost any company these days is a major problem waiting to blow up. IT isn't just an end, it's the means to do everything else. Using computers but ignoring any good IT practice under the excuse that it's not an IT company is like working from an office with asbestos, lead paint, and black mold because you're not a construction company. But on the other hand non-technical companies, meaning ones without a strong IT culture and focus, should undervalue programming expertise. One of the worst things a non-tech company should do is deploy all kinds of custom IT solutions developed internally by their "programmers with expertise". Invariably (and I mean this in the most literal sense possible) they will end up with a patchwork of systems that nobody understands or maintains properly but which underpins all the core services the company needs or delivers.
Kalium 6y ago
You're absolutely correct. You can do that! There may be some room to question the general technical expertise and competence of a shop that runs a bunch of Windows 7 systems, though. IT running beyond the limit of their competency may not be capable of doing what you so wisely and rightly point to.
- reaperducer 6y ago
  There may be some room to question the general technical expertise and competence of a shop that runs a bunch of Windows 7 systems, though Or they may simply not have a choice. My company has a particular automated machine that I have to work with once or twice a month. It is controlled by a computer that runs Windows XP. It can only run Windows XP because the company that made the software went out of business years ago. Because of that, the control computer is not permitted on the public internet. When I interface with it, it's using a dedicated laptop through a VPN to a remote session which then accesses the control machine on a dialup connection. It's slow as heck, but since I only have to do it once or twice a month, I deal. Just before the pandemic, we looked into replacing the circa 1995 automated machine with a new one. Because of the nature of the machine, and the local government regulations about replacing it, the cost would have been little over one million dollars. Not going to happen. Everyone hates it. But that's why my company's IT department, which tries hard to keep up with the times, has a single Windows XP computer in its stable.
  - marshmallow_12 6y ago
    which regs tells you what computers you can buy?
    - reaperducer 6y ago
      which regs tells you what computers you can buy? Not all machines are computers.
    - Kalium 6y ago
      Sometimes medical devices and similar come with a computer as part of a whole certified system. The regulatory framework does not tell you which computer you can buy, precisely, but it does tell you what certifications your system must have to be used for a given purpose. Changing out the part for an unapproved one, obviously, voids the certification.
ddalex 6y ago
VPNs ?

lostlogin 6y ago

> there are some PCs still running Windows 7. A humble brag! There are some very elderly machines out there.

dhosek 6y ago

Some? I've never seen anything newer than Windows 7 on a corporate PC. I'm sure they're out there somewhere but none of the companies that I've worked at in the last 9 years has ever had Windows 8 or newer.

inglor_cz 6y ago
The last Windows 7 I saw in production was on Wednesday. An attorney with a lot of secrets to protect had them on his notebook. He isn't entirely oblivious about security, has his hard drive encrypted and encrypts some of his calls, but the non-updated system is a disaster waiting to happen.
- dhosek 6y ago
  I have to use Windows 7 daily at my current job at a bank (connecting via VDI). I forgot to wish the operating system happy tenth birthday a couple weeks ago.
jcrites 6y ago
Amazon was on Windows 10 in 2020 (and probably earlier; I don't remember when I upgraded while I was there).