8 ms·

ATM operators eye Linux as alternative to Windows XP

136 points by gphilip 13y ago

Theodores 13y ago
They should just go straight to Android - nice touchscreen drivers, 3G, that Dalvik thing - what more is needed apart from a few device drivers to spit the money out?
- tluyben2 13y ago
  I must say I really agree on this one; solid coding environment made for touch, energy friendly, small footprint, easy to use, lot of programmers. But... Is there actually a company who does support for it? As I understand that's not Google. I mean they develop on it, but who can I call/contact 24/7 with issues? So someone needs to do that anyway. If I would be into POS systems still they would be Android anyway. Makes all the sense in the world.
  - Zigurd 13y ago
    Yes, there are multiple systems integrators who can create and support embedded Android devices. It's not too complicated to keep up with AOSP if you didn't go overboard with OS mods.
- geekxworld 13y ago
  Clever suggestion! Android seems perfect, almost as if it was made for ATMs. Plus, it is based on Linux, which is extremely secure.
  - ekianjo 13y ago
    > Plus, it is based on Linux, which is extremely secure. Linux the kernel, I would say, to avoid ambiguity. And second, I'm not sure what you refer to when you say "extremely secure" but even Linux had its share of issues recently (GnuTLS library).
    - tsahyt 13y ago
      The beauty about Linux (and a lot of well-maintained open source software) is that security flaws are usually patched rather quickly -- with the possible exception of the disaster that is X, but Wayland is coming along nicely.
      - ekianjo 13y ago
        > patched rather quickly For offline equipments, not sure how likely they would be patched, though.
        gambiting 13y ago
        I don't know why you are getting downvoted - ATMs are never connected to the Internet directly, they connect to the bank either using a built in modem(yes, the dial-up variety) or their own VPN systems. So it's extremely unlikely, if not just impossible for them to be downloading their own software updates, unless they are published by the bank for the machines to download.
        hueving 13y ago
        I didn't downvote, but I'm guessing it's because the majority of vulnerabilities are irrelevant if the thing is not connected to the Internet.
      - e12e 13y ago
        There have been a few bugs that have been patched, but turned out to have been introduce quite a while before they were reported and patched. That doesn't mean they were not found long before they were reported/fixed, though. I agree that free software seems to be very much responsive to disclosed issues though, and while many vendors (perhaps especially Microsoft) have gotten a lot better lately, the image remains (rightly or not) that closed source companies move (too) slow when it comes to patching security issues. (Part of that is quality control, patching one bug tends to introduce/expose more)
    - hueving 13y ago
- Nux 13y ago
  How well does Android fair on x86? (I'm assuming that's what most ATMs use)
  - josteink 13y ago
    Very well. It does better than most version of both Windows and Linux as far as smoothing and responsiveness goes. It runs well on much less resources. It does have some quirks when trying to use it with software designed for swiping in mind and a keyboard and mouse, but that's probably not going to be an issue here. I say Android could be a good choice, and it will also give them a migration path from X86 should they later on want to.
  - gambiting 13y ago
    There is plenty of phones and tablets which run ultra-ultra low voltage of intel x86 CPUs and run Android - they are almost always faster and more energy efficient than their ARM counterparts.
  - deleted 13y ago
    [deleted]
- e12e 13y ago
  I wasn't aware Android had drivers, I thought Linux had drivers, and Android was mostly a userland?
  - gambiting 13y ago
    I think you are misunderstanding something here. Android runs on a modified linux kernel - and that kernel can load drivers like any other. You make a distinction here as if Android was just this thing running on top of the kernel - it's not, the kernel is absolutely essential and part of Android. So yes, following the logic of this, Android absolutely does support drivers.
    - e12e 13y ago
      The kernel is GPL, drivers for "Android+Linux" are also available under Linux -- afaik there isn't an "Android ABI" making the porting of "Android" drivers much of a port at all? [edit: I suppose things might be a little (but only a little wrt drivers) worse than I thought, given eg: http://lwn.net/Articles/481661/ http://lwn.net/Articles/481661/ ]
- zurn 13y ago
  No security updates after next versions ships...
  - kalleboo 13y ago
    Easy! Just run CyanogenMod nightlies on the ATM...
    - kiallmacinnes 13y ago
      Haha yea, that was my first thought when someone suggested android ;) I'm an android fan.. But, I just don't see it for something like ATMs. ATMs need physical buttons for disabled users, so the whole touchscreen thing is a no go. They need experienced, stood the test of time, companies to provide support over the 10-15 year lifetime. They need reliable and auditable source code, so the less code, the better. In other words, they need something that's not android. The Linux kernel makes a lot of sense given these requirements, paired with a bare minimal userspace and graphics stack, they can likely make good on their existing hardware until it either ceases up or simply can't support new standards like Chip+PIN.
      - brokenparser 13y ago
        NanoBSD would be easier to audit than anything Linux based. Once it's booted, you can physically disconnect the write pin of your storage device. If you can manage to dump the contents of it externally to the host, you can then compare checksums to see if anything has been compromised.
        bradyd 13y ago
        > Once it's booted, you can physically disconnect the write pin of your storage device. Does this mean it requires someone on site to boot the machine? I could see that might not be an issue for ATMs, as they are usually located near banks. It might be an issue for remote locations, though.
        13y ago
- brudgers 13y ago
  Tooling to integrate with a COBOL backend? Bankers and ATM manufacturers ain't morons. They aren't using Windows XP out of ignorance. ATM's have been widely deployed in the US since about 1980 and it's the last version of Windows that runs old 16 bit code directly. It is not as if banks have an aversion to Linux. What they are averse to is risk. Reimplementation requires testing for a level of robustness well to the north of MtGox. Multi-touch pinch to zoom doesn't matter- ATM's require physical buttons for handicap accessibility [by law in the US]. Disrupting banks isn't about ATM's. It's about new financial structures.
  - NameNickHN 13y ago
    > Bankers and ATM manufacturers ain't morons. Moron is perhaps a harsh word but it's been known to the public when Microsoft will stop supporting Windows XP. They had years to prepare. And they are multi billion dollar corporations. How can they have dropped the ball with this?
    - deleted 13y ago
      [deleted]
    - keithpeter 13y ago
      Time taken to certify a more recent version of the OS? Time needed to sort out a 16bit backend? I don't know, I'm just thinking of possible reasons. Same as in the good old NHS in the UK [1] and especially the comment at [2]. [1] http://www.theregister.co.uk/2014/03/20/doh_microsoft_nhs_one_year_xp_deal/ http://www.theregister.co.uk/2014/03/20/doh_microsoft_nhs_on... [2] http://forums.theregister.co.uk/forum/1/2014/03/20/doh_microsoft_nhs_one_year_xp_deal/#c_2139816 http://forums.theregister.co.uk/forum/1/2014/03/20/doh_micro... and http://forums.theregister.co.uk/forum/2/2014/03/20/doh_microsoft_nhs_one_year_xp_deal/#c_2140051 http://forums.theregister.co.uk/forum/2/2014/03/20/doh_micro...
    - deleted 13y ago
      [deleted]
    - test1235 13y ago
      No one's dropped the ball - everyone's ignored it as someone else's problem as it's a maintenance issue, not one for direct profit. Same as for the y2k and and IPv4 problems. Outside of IT, it's probably the same for global warming. There's probably a special/psychological term for this.
- yitchelle 13y ago
  Sounds like a great idea. One question whether Android would need to go through some type of certification for financial applications?
Nux 13y ago
The news should be about anyone serious still running Windows (XP!) in ATMs. Why hasn't everyone switched to Linux or BSD 10 years ago is a wonder. I've seen last year an ATM stuck in a reboot loop of some kind running OS/2. Was the first time in my life I saw this OS and probably the last.
- tluyben2 13y ago
  Even more scary; why do almost all consumer and non-consumer screens like airports, train station, info screens, army rugged laptops, missile guidance systems, most nuclear reactor systems, medical equipment etc run some form of Windows? That's really what I will never get; I hear the excuses from people which I already typed out elsewhere and I know these are bullshit these days. So it must be some kind of MS infiltration tactic? What can they actually offer I wonder besides a 'safe name'? Maybe that's just all there is to it?
  - danieldk 13y ago
    I think support. You have to remember that the first Red Hat Enterprise Linux is from 2002. Back then, the old UNIX vendors were in steady decline, but the freshness of enterprise Linux probably made potential customers weary. Nowadays, things are really different. Red Hat is large and has a solid track record. IBM has shown its support for Linux over an extensive period. SUSE is now in the hands of a huge IT company. Consequently, I don't think there is a good excuse in 2014 not to seriously evaluate Linux. In fact, it should be (and often is) the standard option for embedded devices.
    - brokenparser 13y ago
      > SUSE is now in the hands of a huge IT company Which one are you referring to?
      - deleted 13y ago
        [deleted]
      - danieldk 13y ago
joesb 13y ago
Unless they established new Linux distro, say ATMLinux, where most ATM operators pays to maintain and contribute, it's going to be interesting how it will work. I assume each operator paying to different opensource-shop of their choice is going to be more problematic than all of them paying to only Microsoft.
- thirsteh 13y ago
  or they could just run Red Hat... There isn't really anything special about the Windows builds ATMs run. It's all in the ATM software.
  - joesb 13y ago
    The issues is about support for old version. Will Redhat support the same Linux version 12 years from now? If they don't care about OS support. Then they wouldn't have problem with Windows XP EOL.
- shmerl 13y ago
  They can take Mer and create a kiosk style UI in a very short time. No need for heavy distros lifting.
- e12e 13y ago
  I'm guessing they'll just fork something and keep using the same kernel for "50" years, ignoring security updates. "Install this tgz as base system, add your config". What's the attack surface anyway, the modem drivers? It really, really shouldn't be possible to overflow anything using a "custom" card, or the number pad... (I do sometimes wonder about hostile smart card code for chip and pin, though...).
  - stinos 13y ago
    the same kernel for "50" years, ignoring security updates Well then don't they have the exact same problem as they do now with MS? Or more general: are the update cycles from a typical linux distro that different from Window's? I.e. can you really get security updates for such distro 20 years after it was released? That would mean the only benefit for choosing linux is that there are possibly less securit issues to begin with, while the article seems to claim the problem is all with the update cycle.
hartror 13y ago
As usual the uptake or not of Linux for this or any other use case will be moderated by quality drivers or the lack thereof.
- thirsteh 13y ago
  This assumes the hardware from one ATM to another varies wildly. This is hardly the case. Thus, driver implementation costs are a very small factor, not the primary one. License restrictions are more likely to make them choose something else, like Sony chose FreeBSD for the Playstation. (Again, no need for drivers for many different configurations.)
- ars 13y ago
  Linux drivers are no longer much a problem, and haven't been for a while. Linux is have trouble shaking off its old reputation though.
  - tluyben2 13y ago
    The question is if anyone has gotten their hands on the few different ATM machines hardware-wise and wrote Linux drivers for them. Basically the market for these, magstripe and EVM cards is very much a Windows market => at least most of the US providers of services, backends, software etc for this all are almost entirely Windows based. And therefor the manufacturers, although it would be easy for them, have not much incentive to deliver proper drivers. I'm not saying it's a big problem per-se, but it might make people nervous anyway. They also need to be complaint and that can take long on new software, so they would need to pull in a provider who already has the compliance in some related areas, probably Redhat has and then try to tape on the extra compliance needed for the new software, drivers and whole combination. All in all, it's all very possible, but I think going public with all of this is unfortunately just a trick to get MS to play. I hope it's not as I have always wondered, as a software engineer who created banners, POS systems and information panels (I don't know the proper English jargon for these; I know the Dutch names, but like the panels you see at events, train stations, airports :) why they are not using Linux for everything anyway; everyone always cries about drivers but those have been a non-issue already 10 years ago. 'They are used to writing software on Windows' has also always been a none issue; these apps are complete, fullscreen apps which are the only thing running next to the kernel and a few drivers on these systems. They are almost always completely custom drawn and, like 2D games, that means the difference between Windows and Linux is not really there and hasn't been for many, many years now. You can run SDL straight on the framebuffer and make a tiny Linux distro with your software/drivers to run on it. We sold Linux POS systems over 10 years ago; built on C & Tcl/TK they were faster, easier, cheaper, and nicer than the Windows versions at that time by a long shot. There is 0 reason why you wouldn't do this, but people are ignorant and unfortunately many of these people are coders; like people are stuck on Linux & Mac, a lot of people are stuck on Windows and lose sight of what is better for the customer (over 10 years ago that would have been stability and price; both much better under Linux) while peddling the 'everything is better under Windows'. I would not expect that from smart devs but he, here we go :)
shmerl 13y ago
Good development which really had to happen earlier. As usual, MS shoot themselves in the foot.
- orf 13y ago
  By marking an ancient OS that everyone should have moved off as obsolete? It is the ATM manufacturers fault for accuing so much technical debt
  - shmerl 13y ago
    By not being able to provide flexible updates the way ATMs need. Custom Linux distros can easily enable that. So it's good they realized that sticking with MS is a bad idea.
    - kevincrane 13y ago
      They did provide flexible updates, for like ~10 (ish) years. They're done doing that now and everyone should be well aware already.
      - shmerl 13y ago
        With Linux no one can pull the plug. Here, they are at MS's mercy. So they learned their mistake the hard way. Naturally, even supported versions of Linux like RedHat's and etc. have an EOL date support wise. But in the worst case if some company is stubborn enough to stay on the old version for whatever reason (which might be valid for them), they can take the code and support it themselves. With Windows it's not possible. So open systems have a clear advantage here.
        orf 13y ago
        Great, let's support companies who like to run financial software on ancient, insecure and decrepit platforms who don't want to invest in pulling their software into the 21st century. Microsoft has offered an embedded version of Windows since 7, and say what you will about Windows but it's backwards compatibility is second to none. If they can't or won't move to a more modern, secure OS (after 10+ years) then I would argue that they shouldn't be trusted to make ATM's
geekxworld 13y ago
Seriously? This is happening now?! ATMs are supposed to be secure, then why the hell are they running one of the most security loop-hole OSes even now? That too Windows XP, which has been deemed as the most unsecure OS in the world!. It's long time for them to switch to Linux!
- masklinn 13y ago
  > ATMs are supposed to be secure, then why the hell are they running one of the most security loop-hole OSes even now? ATMs are not internet-connected and have very restricted inputs, so that's mostly irrelevant[-1]. ATMs use windows because support, licensing[0], institutional knowledge, existing codebases, hardware drivers availability and the like. Due to [0], as other commenters I'd see them migrating to some BSD rather than Linux, much like Sony did. If they ever switch off of Windows XP in the first place. [-1] only mostly, if you can cut through and get hardware access, you can have fun: http://www.extremetech.com/extreme/173701-atms-running-windows-xp-robbed-with-infected-usb-sticks-yes-most-atms-still-run-windows http://www.extremetech.com/extreme/173701-atms-running-windo... then again it seems the vulnerability used here is "boot from USB key" which is orthogonal to the OS used [0] and no possible copyleft headaches
- kyberias 13y ago
  Are you seriously suggesting that Windows as an operating system has some serious holes that has made it insecure as an ATM OS? Care to elaborate which those holes have been and how have they been exploited in the ATMs?
  - tsahyt 13y ago
    I came across this yesterday. Not necessarily just exploiting a Windows security hole though. http://media.ccc.de/browse/congress/2013/30C3_-_5476_-_en_-_saal_2_-_201312271600_-_electronic_bank_robberies_-_tw_-_sb.html http://media.ccc.de/browse/congress/2013/30C3_-_5476_-_en_-_...
adamnemecek 13y ago
April 8 is the EOL date for standard XP, XP Embedded (which is what most ATMs run, the article suggests it too) is Jan 2016.
- z92 13y ago
  With less than 2 years to go, they have to look for alternative now.
  - adamnemecek 13y ago
    Indeed. Yet the article claims that April 8 is the EOL date.
- iwwr 13y ago
  What about the possibility that these machines are actually running vanilla XP?
  - adamnemecek 13y ago
    Well this quote from the article suggests otherwise "If I were Microsoft, I would have kept XP embedded alive for a few more years, and charged an escalating support fee" for it, he said."
    - cnvogel 13y ago
      ...but then, this article, as most others on that topic, and the Wikipedia page on ATMs write "Windows XP and Windows XP embedded". So I guess the "Windows XP, non-embedded" market share is significant.
- ZenoArrow 13y ago
  Part of this is confusing for me. Standard XP support ends on April 8th, so no more bug/security fixes. However, I imagine most of the bug/security fixes for Embedded XP will more than likely still apply to Standard XP. What is there to stop people continuing on Standard XP with Embedded XP fixes?
frik 13y ago
I saw a Windows 95 blue screen on an Siemens Nixdorf ATM with a CRT monitor two years ago. The operators (Germany, Austria) say they are not connected to the "internet". I wonder if they use a separate telephone-line-network or just use VPN/firewall.
- ExpiredLink 13y ago
  They have their own network, no "internet".
  - thirsteh 13y ago
    Barnaby Jack showed how much that isolation is worth at DEF CON a few years ago: https://www.youtube.com/watch?v=htDMu7USsZQ https://www.youtube.com/watch?v=htDMu7USsZQ
cnvogel 13y ago
The main factor here is probably not the technology of Windows XP (which certainly is up-to-par for the problem at hand), but the possibilities of vendors to absolutely custom-tailor a computer OS, stripped down to the bare minimum of running the ATM, and, if necessary provide all the service needed, down to the kernel. And currently it's pretty easy to do this, with build-scripts and infrastructure in place. Maybe even using a tailored Android? But then I somehow doubt that the industry would take that opportunity: I've seem my share of "embedded" devices (signage, control-room-displays) where the vendor just slapped their proprietary .exe in Autostart and left the Vendor supplied Win-XP + Nagware + never-updated-virus-scanner + ... intact. Why? Because people in industry are lazy (they should be, maximizing their ROI, doing as little own work), and so going the same route, but with an 8 year old Ubuntu will not gain anything.
- hrjet 13y ago
  The main factor here seems to be hardware cost of upgrading to a newer version of Windows. Since Linux can run on older hardware, it is a cost-effective solution (in spite of the cost of developing a new solution). Also, I didn't get your remark about "8 year old Ubuntu". Why not a newer QT based Ubuntu?
  - Tuna-Fish 13y ago
    Embedded systems are typically not upgraded. There are still plenty of PoS terminals, ATMs etc out there that still run OS/2.
    - Zigurd 13y ago
      Whether that's a serious problem depends on how connected they are. If they run only a application-specific set of services on an isolated network, that's not a problem. but if you propose to sell POS terminals in an Internet SaaS model, you can't leave them unpatched.
- mcv 13y ago
  It's always amazed me that they used Windows. Why would an ATM ever need a full blown OS like that? The requirements are totally different from a desktop PC.
dn2k 13y ago
they just skipped a decade...
nacos 13y ago
Some banks would have liked to migrate a long time ago but some ATMs vendors are not very cooperative : their XFS [1] interfaces were not compatible with new versions of Windows .... That's the problem when you are stuck with a locked down plateform. http://en.wikipedia.org/wiki/CEN/XFS http://en.wikipedia.org/wiki/CEN/XFS
- frik 13y ago
  the wikipeda links to the official website, though the page is gone Sharepoint error message): http://www.cen.eu/cenorm/sectors/sectors/isss/activity/bankingsoftware.asp http://www.cen.eu/cenorm/sectors/sectors/isss/activity/banki... What's the new page? their CEN website is a bit confusing
NDizzle 13y ago
I still know of one ATM (Bank of the West - Walnut Creek) whose ATM runs Microsoft Network OS 2.01. (or maybe 2.1?) I think that's OS/2 - it looks like DOS with tcp/ip. The copyright on the screen states 1992.
aaronchriscohen 13y ago
it's more customizable, more secure, and free. really hard decision.
_greim_ 13y ago
So are ATM machines monolithic devices where you have to scrap the entire thing if you want to upgrade the OS? Or do you open a door in the side, remove the old computer and hook up a new one, and as long as you have the drivers that same cash dispensing and receipt printing hardware will continue working?

136 points by gphilip 13y ago

They should just go straight to Android - nice touchscreen drivers, 3G, that Dalvik thing - what more is needed apart from a few device drivers to spit the money out?

tluyben2 13y ago
I must say I really agree on this one; solid coding environment made for touch, energy friendly, small footprint, easy to use, lot of programmers. But... Is there actually a company who does support for it? As I understand that's not Google. I mean they develop on it, but who can I call/contact 24/7 with issues? So someone needs to do that anyway. If I would be into POS systems still they would be Android anyway. Makes all the sense in the world.
- Zigurd 13y ago
  Yes, there are multiple systems integrators who can create and support embedded Android devices. It's not too complicated to keep up with AOSP if you didn't go overboard with OS mods.
geekxworld 13y ago
Clever suggestion! Android seems perfect, almost as if it was made for ATMs. Plus, it is based on Linux, which is extremely secure.
- ekianjo 13y ago
  > Plus, it is based on Linux, which is extremely secure. Linux the kernel, I would say, to avoid ambiguity. And second, I'm not sure what you refer to when you say "extremely secure" but even Linux had its share of issues recently (GnuTLS library).
  - tsahyt 13y ago
    The beauty about Linux (and a lot of well-maintained open source software) is that security flaws are usually patched rather quickly -- with the possible exception of the disaster that is X, but Wayland is coming along nicely.
    - ekianjo 13y ago
      > patched rather quickly For offline equipments, not sure how likely they would be patched, though.
      - gambiting 13y ago
        I don't know why you are getting downvoted - ATMs are never connected to the Internet directly, they connect to the bank either using a built in modem(yes, the dial-up variety) or their own VPN systems. So it's extremely unlikely, if not just impossible for them to be downloading their own software updates, unless they are published by the bank for the machines to download.
        hueving 13y ago
        I didn't downvote, but I'm guessing it's because the majority of vulnerabilities are irrelevant if the thing is not connected to the Internet.
    - e12e 13y ago
      There have been a few bugs that have been patched, but turned out to have been introduce quite a while before they were reported and patched. That doesn't mean they were not found long before they were reported/fixed, though. I agree that free software seems to be very much responsive to disclosed issues though, and while many vendors (perhaps especially Microsoft) have gotten a lot better lately, the image remains (rightly or not) that closed source companies move (too) slow when it comes to patching security issues. (Part of that is quality control, patching one bug tends to introduce/expose more)
  - hueving 13y ago
Nux 13y ago
How well does Android fair on x86? (I'm assuming that's what most ATMs use)
- josteink 13y ago
  Very well. It does better than most version of both Windows and Linux as far as smoothing and responsiveness goes. It runs well on much less resources. It does have some quirks when trying to use it with software designed for swiping in mind and a keyboard and mouse, but that's probably not going to be an issue here. I say Android could be a good choice, and it will also give them a migration path from X86 should they later on want to.
- gambiting 13y ago
  There is plenty of phones and tablets which run ultra-ultra low voltage of intel x86 CPUs and run Android - they are almost always faster and more energy efficient than their ARM counterparts.
- deleted 13y ago
  [deleted]
e12e 13y ago
I wasn't aware Android had drivers, I thought Linux had drivers, and Android was mostly a userland?
- gambiting 13y ago
  I think you are misunderstanding something here. Android runs on a modified linux kernel - and that kernel can load drivers like any other. You make a distinction here as if Android was just this thing running on top of the kernel - it's not, the kernel is absolutely essential and part of Android. So yes, following the logic of this, Android absolutely does support drivers.
  - e12e 13y ago
    The kernel is GPL, drivers for "Android+Linux" are also available under Linux -- afaik there isn't an "Android ABI" making the porting of "Android" drivers much of a port at all? [edit: I suppose things might be a little (but only a little wrt drivers) worse than I thought, given eg: http://lwn.net/Articles/481661/ http://lwn.net/Articles/481661/ ]
zurn 13y ago
No security updates after next versions ships...
- kalleboo 13y ago
  Easy! Just run CyanogenMod nightlies on the ATM...
  - kiallmacinnes 13y ago
    Haha yea, that was my first thought when someone suggested android ;) I'm an android fan.. But, I just don't see it for something like ATMs. ATMs need physical buttons for disabled users, so the whole touchscreen thing is a no go. They need experienced, stood the test of time, companies to provide support over the 10-15 year lifetime. They need reliable and auditable source code, so the less code, the better. In other words, they need something that's not android. The Linux kernel makes a lot of sense given these requirements, paired with a bare minimal userspace and graphics stack, they can likely make good on their existing hardware until it either ceases up or simply can't support new standards like Chip+PIN.
    - brokenparser 13y ago
      NanoBSD would be easier to audit than anything Linux based. Once it's booted, you can physically disconnect the write pin of your storage device. If you can manage to dump the contents of it externally to the host, you can then compare checksums to see if anything has been compromised.
      - bradyd 13y ago
        > Once it's booted, you can physically disconnect the write pin of your storage device. Does this mean it requires someone on site to boot the machine? I could see that might not be an issue for ATMs, as they are usually located near banks. It might be an issue for remote locations, though.
        13y ago
brudgers 13y ago
Tooling to integrate with a COBOL backend? Bankers and ATM manufacturers ain't morons. They aren't using Windows XP out of ignorance. ATM's have been widely deployed in the US since about 1980 and it's the last version of Windows that runs old 16 bit code directly. It is not as if banks have an aversion to Linux. What they are averse to is risk. Reimplementation requires testing for a level of robustness well to the north of MtGox. Multi-touch pinch to zoom doesn't matter- ATM's require physical buttons for handicap accessibility [by law in the US]. Disrupting banks isn't about ATM's. It's about new financial structures.
- NameNickHN 13y ago
  > Bankers and ATM manufacturers ain't morons. Moron is perhaps a harsh word but it's been known to the public when Microsoft will stop supporting Windows XP. They had years to prepare. And they are multi billion dollar corporations. How can they have dropped the ball with this?
  - deleted 13y ago
    [deleted]
  - keithpeter 13y ago
    Time taken to certify a more recent version of the OS? Time needed to sort out a 16bit backend? I don't know, I'm just thinking of possible reasons. Same as in the good old NHS in the UK [1] and especially the comment at [2]. [1] http://www.theregister.co.uk/2014/03/20/doh_microsoft_nhs_one_year_xp_deal/ http://www.theregister.co.uk/2014/03/20/doh_microsoft_nhs_on... [2] http://forums.theregister.co.uk/forum/1/2014/03/20/doh_microsoft_nhs_one_year_xp_deal/#c_2139816 http://forums.theregister.co.uk/forum/1/2014/03/20/doh_micro... and http://forums.theregister.co.uk/forum/2/2014/03/20/doh_microsoft_nhs_one_year_xp_deal/#c_2140051 http://forums.theregister.co.uk/forum/2/2014/03/20/doh_micro...
  - deleted 13y ago
    [deleted]
  - test1235 13y ago
    No one's dropped the ball - everyone's ignored it as someone else's problem as it's a maintenance issue, not one for direct profit. Same as for the y2k and and IPv4 problems. Outside of IT, it's probably the same for global warming. There's probably a special/psychological term for this.
yitchelle 13y ago
Sounds like a great idea. One question whether Android would need to go through some type of certification for financial applications?

Nux 13y ago

The news should be about anyone serious still running Windows (XP!) in ATMs. Why hasn't everyone switched to Linux or BSD 10 years ago is a wonder. I've seen last year an ATM stuck in a reboot loop of some kind running OS/2. Was the first time in my life I saw this OS and probably the last.

tluyben2 13y ago
Even more scary; why do almost all consumer and non-consumer screens like airports, train station, info screens, army rugged laptops, missile guidance systems, most nuclear reactor systems, medical equipment etc run some form of Windows? That's really what I will never get; I hear the excuses from people which I already typed out elsewhere and I know these are bullshit these days. So it must be some kind of MS infiltration tactic? What can they actually offer I wonder besides a 'safe name'? Maybe that's just all there is to it?
- danieldk 13y ago
  I think support. You have to remember that the first Red Hat Enterprise Linux is from 2002. Back then, the old UNIX vendors were in steady decline, but the freshness of enterprise Linux probably made potential customers weary. Nowadays, things are really different. Red Hat is large and has a solid track record. IBM has shown its support for Linux over an extensive period. SUSE is now in the hands of a huge IT company. Consequently, I don't think there is a good excuse in 2014 not to seriously evaluate Linux. In fact, it should be (and often is) the standard option for embedded devices.
  - brokenparser 13y ago
    > SUSE is now in the hands of a huge IT company Which one are you referring to?
    - deleted 13y ago
      [deleted]
    - danieldk 13y ago

joesb 13y ago

Unless they established new Linux distro, say ATMLinux, where most ATM operators pays to maintain and contribute, it's going to be interesting how it will work. I assume each operator paying to different opensource-shop of their choice is going to be more problematic than all of them paying to only Microsoft.

thirsteh 13y ago
or they could just run Red Hat... There isn't really anything special about the Windows builds ATMs run. It's all in the ATM software.
- joesb 13y ago
  The issues is about support for old version. Will Redhat support the same Linux version 12 years from now? If they don't care about OS support. Then they wouldn't have problem with Windows XP EOL.
shmerl 13y ago
They can take Mer and create a kiosk style UI in a very short time. No need for heavy distros lifting.
e12e 13y ago
I'm guessing they'll just fork something and keep using the same kernel for "50" years, ignoring security updates. "Install this tgz as base system, add your config". What's the attack surface anyway, the modem drivers? It really, really shouldn't be possible to overflow anything using a "custom" card, or the number pad... (I do sometimes wonder about hostile smart card code for chip and pin, though...).
- stinos 13y ago
  the same kernel for "50" years, ignoring security updates Well then don't they have the exact same problem as they do now with MS? Or more general: are the update cycles from a typical linux distro that different from Window's? I.e. can you really get security updates for such distro 20 years after it was released? That would mean the only benefit for choosing linux is that there are possibly less securit issues to begin with, while the article seems to claim the problem is all with the update cycle.

hartror 13y ago

As usual the uptake or not of Linux for this or any other use case will be moderated by quality drivers or the lack thereof.

thirsteh 13y ago
This assumes the hardware from one ATM to another varies wildly. This is hardly the case. Thus, driver implementation costs are a very small factor, not the primary one. License restrictions are more likely to make them choose something else, like Sony chose FreeBSD for the Playstation. (Again, no need for drivers for many different configurations.)
ars 13y ago
Linux drivers are no longer much a problem, and haven't been for a while. Linux is have trouble shaking off its old reputation though.
- tluyben2 13y ago
  The question is if anyone has gotten their hands on the few different ATM machines hardware-wise and wrote Linux drivers for them. Basically the market for these, magstripe and EVM cards is very much a Windows market => at least most of the US providers of services, backends, software etc for this all are almost entirely Windows based. And therefor the manufacturers, although it would be easy for them, have not much incentive to deliver proper drivers. I'm not saying it's a big problem per-se, but it might make people nervous anyway. They also need to be complaint and that can take long on new software, so they would need to pull in a provider who already has the compliance in some related areas, probably Redhat has and then try to tape on the extra compliance needed for the new software, drivers and whole combination. All in all, it's all very possible, but I think going public with all of this is unfortunately just a trick to get MS to play. I hope it's not as I have always wondered, as a software engineer who created banners, POS systems and information panels (I don't know the proper English jargon for these; I know the Dutch names, but like the panels you see at events, train stations, airports :) why they are not using Linux for everything anyway; everyone always cries about drivers but those have been a non-issue already 10 years ago. 'They are used to writing software on Windows' has also always been a none issue; these apps are complete, fullscreen apps which are the only thing running next to the kernel and a few drivers on these systems. They are almost always completely custom drawn and, like 2D games, that means the difference between Windows and Linux is not really there and hasn't been for many, many years now. You can run SDL straight on the framebuffer and make a tiny Linux distro with your software/drivers to run on it. We sold Linux POS systems over 10 years ago; built on C & Tcl/TK they were faster, easier, cheaper, and nicer than the Windows versions at that time by a long shot. There is 0 reason why you wouldn't do this, but people are ignorant and unfortunately many of these people are coders; like people are stuck on Linux & Mac, a lot of people are stuck on Windows and lose sight of what is better for the customer (over 10 years ago that would have been stability and price; both much better under Linux) while peddling the 'everything is better under Windows'. I would not expect that from smart devs but he, here we go :)

shmerl 13y ago

Good development which really had to happen earlier. As usual, MS shoot themselves in the foot.

orf 13y ago
By marking an ancient OS that everyone should have moved off as obsolete? It is the ATM manufacturers fault for accuing so much technical debt
- shmerl 13y ago
  By not being able to provide flexible updates the way ATMs need. Custom Linux distros can easily enable that. So it's good they realized that sticking with MS is a bad idea.
  - kevincrane 13y ago
    They did provide flexible updates, for like ~10 (ish) years. They're done doing that now and everyone should be well aware already.
    - shmerl 13y ago
      With Linux no one can pull the plug. Here, they are at MS's mercy. So they learned their mistake the hard way. Naturally, even supported versions of Linux like RedHat's and etc. have an EOL date support wise. But in the worst case if some company is stubborn enough to stay on the old version for whatever reason (which might be valid for them), they can take the code and support it themselves. With Windows it's not possible. So open systems have a clear advantage here.
      - orf 13y ago
        Great, let's support companies who like to run financial software on ancient, insecure and decrepit platforms who don't want to invest in pulling their software into the 21st century. Microsoft has offered an embedded version of Windows since 7, and say what you will about Windows but it's backwards compatibility is second to none. If they can't or won't move to a more modern, secure OS (after 10+ years) then I would argue that they shouldn't be trusted to make ATM's

geekxworld 13y ago

Seriously? This is happening now?! ATMs are supposed to be secure, then why the hell are they running one of the most security loop-hole OSes even now? That too Windows XP, which has been deemed as the most unsecure OS in the world!. It's long time for them to switch to Linux!

masklinn 13y ago
> ATMs are supposed to be secure, then why the hell are they running one of the most security loop-hole OSes even now? ATMs are not internet-connected and have very restricted inputs, so that's mostly irrelevant[-1]. ATMs use windows because support, licensing[0], institutional knowledge, existing codebases, hardware drivers availability and the like. Due to [0], as other commenters I'd see them migrating to some BSD rather than Linux, much like Sony did. If they ever switch off of Windows XP in the first place. [-1] only mostly, if you can cut through and get hardware access, you can have fun: http://www.extremetech.com/extreme/173701-atms-running-windows-xp-robbed-with-infected-usb-sticks-yes-most-atms-still-run-windows http://www.extremetech.com/extreme/173701-atms-running-windo... then again it seems the vulnerability used here is "boot from USB key" which is orthogonal to the OS used [0] and no possible copyleft headaches
kyberias 13y ago
Are you seriously suggesting that Windows as an operating system has some serious holes that has made it insecure as an ATM OS? Care to elaborate which those holes have been and how have they been exploited in the ATMs?
- tsahyt 13y ago
  I came across this yesterday. Not necessarily just exploiting a Windows security hole though. http://media.ccc.de/browse/congress/2013/30C3_-_5476_-_en_-_saal_2_-_201312271600_-_electronic_bank_robberies_-_tw_-_sb.html http://media.ccc.de/browse/congress/2013/30C3_-_5476_-_en_-_...

adamnemecek 13y ago

April 8 is the EOL date for standard XP, XP Embedded (which is what most ATMs run, the article suggests it too) is Jan 2016.

z92 13y ago
With less than 2 years to go, they have to look for alternative now.
- adamnemecek 13y ago
  Indeed. Yet the article claims that April 8 is the EOL date.
iwwr 13y ago
What about the possibility that these machines are actually running vanilla XP?
- adamnemecek 13y ago
  Well this quote from the article suggests otherwise "If I were Microsoft, I would have kept XP embedded alive for a few more years, and charged an escalating support fee" for it, he said."
  - cnvogel 13y ago
    ...but then, this article, as most others on that topic, and the Wikipedia page on ATMs write "Windows XP and Windows XP embedded". So I guess the "Windows XP, non-embedded" market share is significant.
ZenoArrow 13y ago
Part of this is confusing for me. Standard XP support ends on April 8th, so no more bug/security fixes. However, I imagine most of the bug/security fixes for Embedded XP will more than likely still apply to Standard XP. What is there to stop people continuing on Standard XP with Embedded XP fixes?

frik 13y ago

I saw a Windows 95 blue screen on an Siemens Nixdorf ATM with a CRT monitor two years ago. The operators (Germany, Austria) say they are not connected to the "internet". I wonder if they use a separate telephone-line-network or just use VPN/firewall.

ExpiredLink 13y ago
They have their own network, no "internet".
- thirsteh 13y ago
  Barnaby Jack showed how much that isolation is worth at DEF CON a few years ago: https://www.youtube.com/watch?v=htDMu7USsZQ https://www.youtube.com/watch?v=htDMu7USsZQ

cnvogel 13y ago

The main factor here is probably not the technology of Windows XP (which certainly is up-to-par for the problem at hand), but the possibilities of vendors to absolutely custom-tailor a computer OS, stripped down to the bare minimum of running the ATM, and, if necessary provide all the service needed, down to the kernel. And currently it's pretty easy to do this, with build-scripts and infrastructure in place. Maybe even using a tailored Android? But then I somehow doubt that the industry would take that opportunity: I've seem my share of "embedded" devices (signage, control-room-displays) where the vendor just slapped their proprietary .exe in Autostart and left the Vendor supplied Win-XP + Nagware + never-updated-virus-scanner + ... intact. Why? Because people in industry are lazy (they should be, maximizing their ROI, doing as little own work), and so going the same route, but with an 8 year old Ubuntu will not gain anything.

hrjet 13y ago
The main factor here seems to be hardware cost of upgrading to a newer version of Windows. Since Linux can run on older hardware, it is a cost-effective solution (in spite of the cost of developing a new solution). Also, I didn't get your remark about "8 year old Ubuntu". Why not a newer QT based Ubuntu?
- Tuna-Fish 13y ago
  Embedded systems are typically not upgraded. There are still plenty of PoS terminals, ATMs etc out there that still run OS/2.
  - Zigurd 13y ago
    Whether that's a serious problem depends on how connected they are. If they run only a application-specific set of services on an isolated network, that's not a problem. but if you propose to sell POS terminals in an Internet SaaS model, you can't leave them unpatched.
mcv 13y ago
It's always amazed me that they used Windows. Why would an ATM ever need a full blown OS like that? The requirements are totally different from a desktop PC.

dn2k 13y ago

they just skipped a decade...

nacos 13y ago

Some banks would have liked to migrate a long time ago but some ATMs vendors are not very cooperative : their XFS [1] interfaces were not compatible with new versions of Windows .... That's the problem when you are stuck with a locked down plateform. http://en.wikipedia.org/wiki/CEN/XFS http://en.wikipedia.org/wiki/CEN/XFS

frik 13y ago
the wikipeda links to the official website, though the page is gone Sharepoint error message): http://www.cen.eu/cenorm/sectors/sectors/isss/activity/bankingsoftware.asp http://www.cen.eu/cenorm/sectors/sectors/isss/activity/banki... What's the new page? their CEN website is a bit confusing

NDizzle 13y ago

I still know of one ATM (Bank of the West - Walnut Creek) whose ATM runs Microsoft Network OS 2.01. (or maybe 2.1?) I think that's OS/2 - it looks like DOS with tcp/ip. The copyright on the screen states 1992.

aaronchriscohen 13y ago

it's more customizable, more secure, and free. really hard decision.

_greim_ 13y ago

So are ATM machines monolithic devices where you have to scrap the entire thing if you want to upgrade the OS? Or do you open a door in the side, remove the old computer and hook up a new one, and as long as you have the drivers that same cash dispensing and receipt printing hardware will continue working?