10 ms·

I will not blame MS from moving on. If people don't want to upgrade, that's their problem. I am a little concerned, however, that so many POS systems still use

I will not blame MS from moving on. If people don't want to upgrade, that's their problem. I am a little concerned, however, that so many POS systems still use XP. I just saw one yesterday at the hardware store I went to. When will they upgrade? I don't know how much this will hurt MS with its core users. XP is largely kept alive by users in the East, not the West, and by businesses. The businesses will either pay for additional security or upgrade, and many of the users in Eastern countries don't pay for XP as it is, so what exactly is MS risking here? MS needs to move on. There is no money in continuing to support a 13-year-old OS. You could argue that MS should make available paid support and security updates, but even OSes like Redhat aren't kept going for 13 years. I just don't get the outrage here.

Shish2k 13y ago
> I just saw one yesterday at the hardware store I went to. When will they upgrade? When the cost of staying is greater than the cost of moving. For many embedded scenarios, the cost of staying is generally small (just occasional maintenance) and the cost of moving is huge (probably a whole new set of hardware).
- pixl97 13y ago
  Pretty much this. One of my clients has a set of 7 or so touchscreen POS systems at a restaurant. They are all older XP embedded machines and the software they run has no upgrade path to a newer OS. It will take somewhere around $20k to put in new computers and do the initial inventory setup.
  - jessaustin 13y ago
    Whether this work is done now or not, if the restaurant stays in business it must be done eventually. ISTM that embedded-MS-that-is-never-upgraded is only one possible model for this sort of system. Have your clients expressed an interest in acquiring something more maintainable?
    - pixl97 13y ago
      Yes, they know very well that they have to replace the system at some point. But it doesn't make sense for them to do this at this point. They have plenty of spare parts for the system at this time. The system has a very small attack surface from outside threats. And the current system is very stable and low maintenance. They do have a good idea of what they would go to if they needed to upgrade tomorrow. It's just currently a no sale, supporting a new system will cost more at this time then the old system.
      - jessaustin 13y ago
        ...what they would go to if they needed to upgrade tomorrow. Can you say if that system would be any more maintainable than the current one, especially e.g. 7-8 years after installation? Do these restaurants update e.g. prices or sales tax rates without outside help? Could they radically change their menu if they needed to do so? Are there forests of sticky notes sprouting from the sides of the machines reminding users how to make the system do what they want? How long does it take for new waitstaff to use the POS without supervision? Is the current setup PCI-compliant, and will it still be a couple of months from now?
        pixl97 13y ago
        You seem to think their current system is hard to use or in any way broken. No, it works very well, it is easy to use, it is easy to train on, easy to change menu's and taxability. It is very extensible. Management has around a decade experience with it.
RKearney 13y ago
Things like POS terminals and ATMs usually use Windows XP Embedded (if they're on XP at all). XP Embedded is still under support until July 12, 2016. However, even if these systems are, for whatever reason, running a consumer version of XP which is slated to end extended support on April 8, 2014, they are most likely not connected to the internet and therefore safe from external threats. That's just the best case scenario anyway. As we saw with the Target breach, they obviously did not have the required network segmentation in place. Any PCI compliant company is going to have their POS terminals running on an isolated network. This is hardly a reason to justify not upgrading though.
cwyers 13y ago
I wouldn't worry much about POS systems, they have a very small attack surface, given their limited exposure to the Internet.
- ceejayoz 13y ago
  Target found that "very small attack surface" isn't the same as "secure".
  - pixl97 13y ago
    From what I've read on Krebs site, I don't think Target understands what 'very small attack surface means'.
  - cwyers 13y ago
    Target was hacked because they were flagrantly ignoring basic security procedures, like "making your POS systems available on the same network you use for everything else." [1] Blaming the Target break-in on the OS security is like having unprotected sex in the back of a Buick, and blaming GM for the STD you contracted because it would've happened if the car hadn't had such a roomy backseat. [1] http://www.computerworld.com/s/article/9246074/Target_breach_happened_because_of_a_basic_network_segmentation_error http://www.computerworld.com/s/article/9246074/Target_breach...
- jdonnici 13y ago
  In "Kingpin" by Kevin Poulsen [1], one of the key players made a lot of money by hacking into POS systems at "mom & pop" locations (restaurants, dry cleaners, etc). Their surface area was "just enough" - they're online in order to run credit cards and early versions of the POS software kept the card details in local files. Once he was into their system, he had access to thousands of cards... when the cards were used fraudulently, it was very difficult to know how it'd been stolen because it was via lots of small breaches that never made the news. Appropriately for this post... the POS software vendors eventually rushed to be compliant with new security standards (PCI?) and not store those details locally. But the store owners were reluctant to upgrade because the new software versions had an upgrade fee or, even when the upgrade was free, they'd have to pay thousands to their local consultant to actually perform the upgrade. [1] - http://amzn.com/0307588696 http://amzn.com/0307588696 ... Twitter-sized review: Pretty good book and it read like a technology novel at times. Will definitely get you re-thinking where/when your cards are used.
RexRollman 13y ago
I totally agree with you. At some point, it is no longer Microsoft's problem. (Heck, just look at how long OS/2 held on in POS systems after being taken off the market.)
gurkendoktor 13y ago
> If people don't want to upgrade, that's their problem. But running a company is not about doing the right thing, and Microsoft is not in a good diplomatic position to force an update on people after Vista and Windows 8 have been publicity disasters. I won't blame MS whatever they do, but if I were them, I would try to fix the Windows 8 mess first before risking negative headlines.
mike-cardwell 13y ago
"I don't know how much this will hurt MS with its core users" It will hurt everyone with an Internet connection. MS has filled the World with machines which are full of security holes and which only they can patch, and they've made a mint doing it. I would say it's their responsibility (ethically, not legally) to patch those machines until they stop being a massive threat to the stability of the Internet. I realise that this wont happen though.

Shish2k 13y ago

> I just saw one yesterday at the hardware store I went to. When will they upgrade? When the cost of staying is greater than the cost of moving. For many embedded scenarios, the cost of staying is generally small (just occasional maintenance) and the cost of moving is huge (probably a whole new set of hardware).

pixl97 13y ago
Pretty much this. One of my clients has a set of 7 or so touchscreen POS systems at a restaurant. They are all older XP embedded machines and the software they run has no upgrade path to a newer OS. It will take somewhere around $20k to put in new computers and do the initial inventory setup.
- jessaustin 13y ago
  Whether this work is done now or not, if the restaurant stays in business it must be done eventually. ISTM that embedded-MS-that-is-never-upgraded is only one possible model for this sort of system. Have your clients expressed an interest in acquiring something more maintainable?
  - pixl97 13y ago
    Yes, they know very well that they have to replace the system at some point. But it doesn't make sense for them to do this at this point. They have plenty of spare parts for the system at this time. The system has a very small attack surface from outside threats. And the current system is very stable and low maintenance. They do have a good idea of what they would go to if they needed to upgrade tomorrow. It's just currently a no sale, supporting a new system will cost more at this time then the old system.
    - jessaustin 13y ago
      ...what they would go to if they needed to upgrade tomorrow. Can you say if that system would be any more maintainable than the current one, especially e.g. 7-8 years after installation? Do these restaurants update e.g. prices or sales tax rates without outside help? Could they radically change their menu if they needed to do so? Are there forests of sticky notes sprouting from the sides of the machines reminding users how to make the system do what they want? How long does it take for new waitstaff to use the POS without supervision? Is the current setup PCI-compliant, and will it still be a couple of months from now?
      - pixl97 13y ago
        You seem to think their current system is hard to use or in any way broken. No, it works very well, it is easy to use, it is easy to train on, easy to change menu's and taxability. It is very extensible. Management has around a decade experience with it.

RKearney 13y ago

Things like POS terminals and ATMs usually use Windows XP Embedded (if they're on XP at all). XP Embedded is still under support until July 12, 2016. However, even if these systems are, for whatever reason, running a consumer version of XP which is slated to end extended support on April 8, 2014, they are most likely not connected to the internet and therefore safe from external threats. That's just the best case scenario anyway. As we saw with the Target breach, they obviously did not have the required network segmentation in place. Any PCI compliant company is going to have their POS terminals running on an isolated network. This is hardly a reason to justify not upgrading though.

cwyers 13y ago

I wouldn't worry much about POS systems, they have a very small attack surface, given their limited exposure to the Internet.

ceejayoz 13y ago
Target found that "very small attack surface" isn't the same as "secure".
- pixl97 13y ago
  From what I've read on Krebs site, I don't think Target understands what 'very small attack surface means'.
- cwyers 13y ago
  Target was hacked because they were flagrantly ignoring basic security procedures, like "making your POS systems available on the same network you use for everything else." [1] Blaming the Target break-in on the OS security is like having unprotected sex in the back of a Buick, and blaming GM for the STD you contracted because it would've happened if the car hadn't had such a roomy backseat. [1] http://www.computerworld.com/s/article/9246074/Target_breach_happened_because_of_a_basic_network_segmentation_error http://www.computerworld.com/s/article/9246074/Target_breach...
jdonnici 13y ago
In "Kingpin" by Kevin Poulsen [1], one of the key players made a lot of money by hacking into POS systems at "mom & pop" locations (restaurants, dry cleaners, etc). Their surface area was "just enough" - they're online in order to run credit cards and early versions of the POS software kept the card details in local files. Once he was into their system, he had access to thousands of cards... when the cards were used fraudulently, it was very difficult to know how it'd been stolen because it was via lots of small breaches that never made the news. Appropriately for this post... the POS software vendors eventually rushed to be compliant with new security standards (PCI?) and not store those details locally. But the store owners were reluctant to upgrade because the new software versions had an upgrade fee or, even when the upgrade was free, they'd have to pay thousands to their local consultant to actually perform the upgrade. [1] - http://amzn.com/0307588696 http://amzn.com/0307588696 ... Twitter-sized review: Pretty good book and it read like a technology novel at times. Will definitely get you re-thinking where/when your cards are used.

RexRollman 13y ago

I totally agree with you. At some point, it is no longer Microsoft's problem. (Heck, just look at how long OS/2 held on in POS systems after being taken off the market.)

gurkendoktor 13y ago

> If people don't want to upgrade, that's their problem. But running a company is not about doing the right thing, and Microsoft is not in a good diplomatic position to force an update on people after Vista and Windows 8 have been publicity disasters. I won't blame MS whatever they do, but if I were them, I would try to fix the Windows 8 mess first before risking negative headlines.

mike-cardwell 13y ago

"I don't know how much this will hurt MS with its core users" It will hurt everyone with an Internet connection. MS has filled the World with machines which are full of security holes and which only they can patch, and they've made a mint doing it. I would say it's their responsibility (ethically, not legally) to patch those machines until they stop being a massive threat to the stability of the Internet. I realise that this wont happen though.