Slashdot Mirror
95% of ATMs Worldwide Are Still Using Windows XP
BUL2294 writes "95% of the world's ATM machines are still running Windows XP and banks are already purchasing extended support agreements from Microsoft. (some of the affected ATMs are running XP Embedded, which has a support lifecycle until January, 2016). 'Microsoft is selling custom tech support agreements that extend the life of Windows XP, although the cost can soar quickly—multiplying by a factor of five in the second year, says Korala. JPMorgan is buying a one-year extension and will start converting its machines to Windows 7 in July; about 3,000 of its 19,000 ATMs need enhancements before the process can begin...'"
https://xkcd.com/801/
The cost of the support agreements, would still be less than the replacement of several thousand ATMs and internal systems. There is a reason why people do this, and it's not just lazyniess..
If there is that big of a market why is nobody selling/buying a replacement OS already? Particularly one cheaper than windows.
It seems every article that mentions OS/2 makes mention of how entrenched it is in ATMs...
I never understand why ATM's dont use HTML/SVG and then the OS is replaceable as a browser is the interface and a HTTP server security is well understood and network security would be part of a core competency
thoughts ?
john jones
Windows XP is the only operating system stable & secure enough to handle sensitive transactions such as cash dispensing.
My turnips listen for the soft cry of your love
Is a bad choice anyway. Not just a Microsoft bash, but aside from all the security issues, windows is XP is a desktop platform, not a OS to be putting on dedicated devices ( even the so-called embedded version really isn't any more appropriate for this, don't let the marketing folks fool you )
An ATM should be running off a custom embedded OS targeted for this purpose, not a commodity OS.
---- Booth was a patriot ----
"95% of the world's ATM machines are still running Windows XP
Yes, but what about the *automatic* ATM machines? Those are the ones I most am concerned about.
To hell with 7. Please put Windows 8 on the ATMs instead! I already love how ATMs do a wonderful job of selecting the wrong option for me after finally getting the card to take, only to then take me into the Spanish menu, spitting out a receipt, and then not accepting my card again while the line forms behind me! Metro can only enhance this lovely experience! Hell, add a kinect to it so when I flip it a golden salute it recognizes my input and doubles the ATM fee! Gotta keep up with the bank's great customer service these days!
'We are trying to prove ourselves wrong as quickly as possible, because only in that way can we find progress.' RPF
Is the dispensing software is written in Java? Half kidding, and wondering at the same time.
I see more ATMs running Windows 2000 than Windows 95.
I think Windows 98 and OS/2 still have a comparable market share, however.
I had no idea Microsoft had such a large share of the ATM market.
At least they have that to fall back on when this whole "mobile" thing doesn't work out for them.
As someone who has worked with Diebold, they have never have more than 3 programmers and they only use and have ever used Visual Basic. This is why their ATMs (and voting machines) are required to run Windows.
"When life gives you lemons, don't make lemonade. Make life take the lemons back!" -- Cave Johnson
JPMorgan = helpdesk in Philippines & parts of IT subcontract out (at least the field part is) and likely parts office IT as well.
Actually, that doesn't worry me nearly as much as Windows for Warships.
Oliver's law of assumed responsibility: If you're seen fixing it, you will be blamed for breaking it.
https://xkcd.com/801/
http://www.nelson-haha.com/
"Flyin' in just a sweet place,
Never been known to fail..."
[O]verall, OS/2 failed to catch on in the mass market and is little used outside certain niches where IBM traditionally had a stronghold. For example, many bank installations, especially Automated Teller Machines, run OS/2 with a customized user interface.
http://en.wikipedia.org/wiki/OS/2
Doctors destroy health, lawyers destroy justice, universities destroy knowledge, religion destroys spirituality
you never go ATM! ;)
They chose the wrong two.
Actually, that doesn't worry me nearly as much as Windows for Warships.
You jest but the US Navy was (is?) using Windows as the OS for drive-by-wire hovercrafts. One bluescreened and ran out of control in San Franscisco.
~Demonoid Penguin (moderating)
Yes, I am a Windows hating Linux user but the question is serious, not flame bait, why would they chose XP in the first place and why have they not moved to something else in the last decade?
With real cash at stake I would have probably started with a minimal BSD OS and just added the minimal graphics, comms and I/O libraries needed to support the main application. I'm sure others here have their own ideas of the best OS, most excluding Windows?
Various CS students around here target some nearby ATMs to try new hacks/exploits - some even get serious cash out of them...
At least go with something mildly secure that poses a challenge.
Ahhh....that meme is so tired. You do realize that wasn't a 'Windows' issue, but rather a crappily created application issue. IIRC, an input that allowed a zero (or null) value when it shouldn't have.
Or are you trying to assert that crappy applications can only be written for the Windows platform?
I recall seeing the insides of one ATM in that era. It ran on a PDP-11/05.
Meaning they do not have to be smart, efficient, or customer oriented. No matter how badly they screw up Congress will be there to rescue them.
putting the 'B' in LGBTQ+
About two years ago I was a field tech and would get service calls to JPMS. Most of the time it was just to move fax machines around or to make a jack live. Sometimes it was to try to get a PC to boot. There is SO much legacy cruft in the boot image of a JPMS desktop that it can take three boots just to get the damn thing stable. Some of the boot code even flashes by "DOS TCP/IP 1.0" as it goes by. They have decades of cruft to dig through to get those things anywhere modern. I have pity for the admins trying to roll this out, I really do.
On the other hand that damn image is used by hotshot investment brokers to transact multi-million dollar trades everyday. That image is a lot of their "secret sauce" that they use to make a shit load of cash. It's a tool that has made them trillions. I can see why they don't want to fuck with it. They would gladly have me hang around for a day at a few hundred dollars an hour (not that I was seeing 20% of that) just to make sure the hotshot could do his job. The hotshot's downtime cost them thousands of dollars an hour. Imagine having to roll out an image to 1000 hotshot desktops and have it fail for even a day.
That's a lot of incentive to keep the boat from rocking, whatever the cost.
Remember that a lot of that legacy code is interfacing with mainframes that are running code before the advent of PCs.
-- I have a private email server in my basement.
Or are you trying to assert that crappy applications can only be written for the Windows platform?
The kind of people who pick a crappy operating system to run their applications also tend to write crappy applications.
All that being said, the XP ATMs are perfectly safe. They are behind some rather crazy firewalls.
Nope.
http://www.extremetech.com/extreme/173701-atms-running-windows-xp-robbed-with-infected-usb-sticks-yes-most-atms-still-run-windows
And another successful attack vector using Plotus http://www.atmmarketplace.com/article/221087/Mexican-ATMs-fall-prey-to-new-cyberattack
Successful malware attacks (both gaining access to the local cash and screen scraping and keystroke recording of customer information) through ATMs have been going on since 2008 and Diebold would most certainly be well aware of this, even if they are choosing not to bring it to your attention.
Yeah, there must be, oh, thousands of ATMs out there.
2.2 million.
Average amount of time a new ATM machine is installed --- 5 minutes ATM Machine Statistics [2012]
Automated teller machines (ATMs) (per 100,000 adults) [2009]
US 173
Canada 205
Actually, that doesn't worry me nearly as much as Windows for Warships.
The USS Yorktown (CG-48) was decommissioned in 2004.
Life goes on.
Windows 7 EOL will start LOL.
That's what you get for waiting until the last minute. Many corps won't see it as a 8 year old OS but a 3 year and will throw hissy fits like the XP ones are now
http://saveie6.com/
Comment removed based on user account deletion
I believe MSMQ is used in banking a lot, and I wouldn't be surprised if it is used in ATMs, due to its robustness. AFAIK, there is no *NIX port for it.
Even WinCE is a slow as a wet dog thing that drives up the cost of hardware required if you need any sort of performance. These things are big and slow on limited hardware.
Short term convenience and a perceived possibility of a reduced time to market won over utility with these things.
Blame IBM for killing off OS/2. I worked for one of the major banks and years after OS/2 died they were still running it because the main teller software ran on OS/2 and the company that created it rufused to port it to anything else.
The govenment monitors the banking banks and if someone came up with Linix ATM software that could pass govenment regulations and a ease migration path you'd probably see a mass move from XP to Linux. Because the banks what one does most the other do.
JPMorgan is buying a one-year extension and will start converting its machines to Windows 7 in July; about 3,000 of its 19,000 ATMs need enhancements before the process can begin...
Um... Start converting 4 months after XP goes EOL? Did they *just* find out about the deadline? And why can't they start upgrading the other 16,000 systems? I'm pretty sure XP and 7 systems can be operated together...got one of each in my office - for testing.
It must have been something you assimilated. . . .
Went to a hospital a week ago that was newly opened late last year. All workstations are the Lenovo all-in-ones with the Windows 8 sticker on it. Guess what operating system they are running on now .... Windows XP Professional (at least that's what the screen saver said.)
I saw an IV infusion pump being rebooted by a nurse. I hear the famous chine of Windows XP shutting down.
New Economic Perspectives
On a physically secure machine (ATMs with heavy gauge steel armor on all sides) that's not connected to the internet.... who cares if it's running an old OS? They could run DOS and Win 3.11 for that matter without a problem.
Didn't Windows For Rocketships cause the Challenger explosion?
Since some people don't want to leave XP and still want support, M$ should just charge very high prices to those users. Banks and other companies are rich. They can afford it. M$ would have another way/source to be rich! ;)
Ant(Dude) @ Quality Foraged Links (AQFL.net) & The Ant Farm (antfarm.ma.cx / antfarm.home.dhs.org).
The fact that they are upgrading to 7 just goes to show what a complete piece of crap Windows 8 is.
ATMs don't have to worry about viruses n' such generally because users can't get at them. You can only use their custom interface, you can't surf the web with them. There also isn't USB access (or rather shouldn't be, I'm not saying there has never been a stupidly designed one). So a lot of the threats you'd face on a normal desktop don't apply.
Plus there's the unequal relationship with the bank, in that an ATM trusts it completely. They don't actually process your account, they just send data back to the bank, via special purpose built encryption cards. It hands off what you want to do to the bank, which then tells it what it can do. It doesn't deal with data security in a normal sense.
So what the OS on an ATM does is present a user interface to the users, and communicate to the hardware (the encryption device, the cash dispenser, that kind of thing). Hence their concern is something that is easy to develop a UI for, and supports the devices in the system. Not something that is hardened against security issues since that really isn't a problem in the way it is used.
Why does this matter? Surely the ATM machines are not in the public internet, or the regular internal network of the bank? Surely they are firewalled from each others too, so compromising one can't compromise the others?
They're embedded systems, in isolated environment. Once they work, why do they need OS support (other than updates to software when protocols and company logos change)? And if they do need OS support now, it'd be better to just change the network infrastructure so that they no longer need it.
I guess an ATM machine has not a browser, or a WWW connection, or useless services listening on some ports, neither a real keyboard to inteact with it, so a designer should be a super-moron to be able to catch a malware on such a machine.
Thus utterly stupid lies to seek attention.
I don't know what's wrong with you but please leave us out of it.
... an ATM would be one of the few places where Windows 8 would probably be a good choice. Just have a touch screen that lets you flick through a few limited options represented by large square icons (or whatever they're called) instead of pressing buttons.
A great niche application for the venerable old girl.
Yes and add namedropper putting false words into the mouth of an authority you are appealing to if you want some precision.
Meanwhile I gave you your example of a very large risk averse company to counter your utter rubbish and got nothing back but insults. Certainly no "factual argument" - just pretend ones from made up misquotes. Don't bother to try to claim credit for what others wrote in something you linked to either. Why should I bother to read it after you were trying to pull the divide by zero trick?
Not being born yesterday I can see damning with faint praise for the weasel trick it is.
So no reply about Haliburton's last decade with linux? How about I raise you IBM?
Care to backtrack now that you have been caught out again or are you just going to ignore it again?
Basically, since the year 2000, they’ve gotten pretty good at these kind of planned crises
Apparently not. If they had, the crisis would have been avoided all together. They would have upgraded by now.
Would Apple get 30% of all withdrawls?
I work for one of the major ATM vendors in the world and replacing Windows with Linux has become one of the top priorities across the whole portfolio (which is now a lot of other things than just ATMs). The reason are obviously the costs associated with Windows licenses. And why are the ATMs and other hardware still running Windows? Old and *very* messy codebase that is hard to port to Linux. But it's getting there.
Out and around.
Small numbers, of course - but there does seem to be the occasional old privately owned terminal in a convenience store...
I work in the financial industry and I can assure you that mainframes are still in the loop, processing trades and generating reports, particularly commission reports for the brokers, but also breaks, and other reports that reference and affect millions of dollars in transactions, possibly billions of dollars.
Not only are mainframes part of the process, but the COBOL code does indeed go back into the 80's (I've seen comments in source that go back to at least 1983 -- and that's when they performed the first change to the code) -- some programs and jobs go even further back than that.
Mainframes are still being used because they get the job done and there's a huge investment in home-grown software that would require a significant expenditure to replace.
If telephones are outlawed, then only outlaws will have telephones.
Every OS has an EOL.
Most medical equipment Ive seen, even this year, still looks to be running XP. Everything from the front office computers, in room terminals to testing equipment like xray machine and imaging devices. Many retail stores still use XP on all their POS hardware, some smaller devices run xp embedded. Last time I bought tabs for my car, their system was running XP as well.