Slashdot Mirror
Some Of The Pentagon's Critical Infrastructure Still Runs Windows 95 And 98 (defenseone.com)
SmartAboutThings writes:
The Pentagon is set to complete its Windows 10 transition by the end of this year, but nearly 75% of its control system devices still run Windows XP or other older versions, including Windows 95 and 98. A Pentagon official now wants the bug bounty program of the top U.S. defense agency expanded to scan for vulnerabilities in its critical infrastructure.
DefenseOne raises the possibility of "building and electrical systems, HVAC equipment and other critical infrastructure laden with internet-connected sensors," with one military program manager saying "A lot of these systems are still Windows 95 or 98, and that's OK -- if they're not connected to the internet." Windows Report notes that though Microsoft no longer supports Windows XP, "the Defense Department is paying Microsoft to continue providing support for the legacy OS."
DefenseOne raises the possibility of "building and electrical systems, HVAC equipment and other critical infrastructure laden with internet-connected sensors," with one military program manager saying "A lot of these systems are still Windows 95 or 98, and that's OK -- if they're not connected to the internet." Windows Report notes that though Microsoft no longer supports Windows XP, "the Defense Department is paying Microsoft to continue providing support for the legacy OS."
nt
Fail!
You wouldn't beleive the crap that gets implemented. In the last three years I've seen new control systems implemented in windows 2000 pro because that's what the government agency mandated. It's all over the place but fortunately in most cases it's not ever internet connected.
Posting ac of obvious reasons.
...we still run Windows 3.0 with dialup Internet.
It's been 100 days, is America great again now?
They should really upgrade to Vista.
Still runs MS-DOS. With a memory manager.
Why does any of this run redmondware in the first place?
The only thing it does (badly) is "provide an office desktop", which is... completely besides what you need for running sensors and machinery. So why?
Hopefully they realize that means more than "there's no Ethernet cable connecting this computer to the network", since it sounds like these ancient systems may be connected in various ways to other equipment.
#DeleteChrome
We're living in a time where we're building critical infrastructure expected to last decades and integrating it with IT equipment with a lifespan of a few years. So the options are to perform major infrastructure upgrades every few years (which is expensive) or run seriously outdated software (possibly dangerous).
Especially if you consider that almost two-thirds of US navy planes can't fly.
Hope this administration can deliver on their [campaign] promise.
you really have to wonder
1 the source would be available so they never have to worry about obsolesence.
2 in runs on all sorts of hardware so they could maintain very nice consistency across many processor/platforms
3 the NSA is working on secure linux, and could certainly help to harden military grade linux
4 to get work done, they could fund open-source efforts. the work would help the military and the country alike.
probaly makes too much sense. much better to have a closed-source, proprietary system that can never, ever be secure.
plus it's more expensive !
Absolute statements are never true
I work in a building where the heating system is controlled by a Windows 95 machine. Big deal. It's not network connected, and runs like a champ. It only changes the configuration of the system, it doesn't run the system minute by minute. If it goes down, we can recreate it easily. Worry about business critical infrastructure, not old hardware that works.
So does that mean the DoD can run Windows XP on Ryzen?
If they're critical, don't connect them to the internet. See, that was easy, wasn't it.
Connecting critical infrastructure to the internet is like putting a top secret next gen nuclear bomb on display in the middle of LA and expecting nobody to try and fuck with it... But I can all the wannabe IT "professionals" out there saying "but a proper firewall and vpn along with continuous monitoring will keep things safe"... no, it won't, you fucking retard... firewalls, vpns, and monitoring systems aren't much better than a rent-a-cop at the mall trying to stop an armed robbery.
If you want things to be secure and safe from your enemies, don't use a PUBLIC network. Period. Better yet, don't connect it to a network that goes offsite at all... once it goes offsite folks can access it if they want... it just depends on how much trouble they want to go through to do it.
1s and 0s!
since they are not getting forced updates
at some point I was working for a company providing software largely used to defense. it was mid 90s, a time when most of the large shops ran IBM mainframes. by that time mainframe operating system went though many generations, yet some of our government users run fairly ancient versions of OS (and I assume fairly ancient hardware as well). Their logic was "why to upgrade if it's not broken". so we had one mainframe running VM (IBM virtual machine) and every time we had a problem report, we had to bring up one of those old OSes just to recreate the problem. the funny thing was that even to find out which particular OS they ran one had to have a security clearance. I hope since it was over 20 years ago, I can tell as much as that.
Microsoft would have a hard time disallowing DoD access at 20 years old and at least 17-20 out of print.
With the source code fix the bugs, implement a proper firewall and modern FIPS certified encryption systems, call it a day.
People act like just because software/hardware is old, it SHOULD be obsolete. The truth is often the opposite: As long as it does what it is supposed to, reliably and for less than the alternative, it is a good solution.
Furthermore, as clunkily designed as the Win9x series was, it has a *LOT* less attack surface than any of the Windows NT 6.x releases (Vista-10) and has 20 years of enthusiast documentation and patches for its most serious shortcomings. (They have Win9x running on hardware up to Sandy Bridge/K10 or so. Which implies the right maintenance will keep Win9x acceptable for single core 32 bit x86 for as long as anyone needs to run it.)
HA ! I've seen windows 3.1 been used in a cheese processing plant that I worked in running sql database software.
I see this time and time again in the controls field. Though we may cross over with the IT sector, machine control is a completely different beast. It isn't about swapping out a computer. There are a plethora of closed communications protocols, old SCADA-package-specfic libraries and binaries, and lots of those functions in the script have to be rewritten. It is great when you have a PLC doing the controls and the SCADA package acting as an HMI, because you can develop the new system in parallel to the existing one, but if the PLC does not do a good job of handling the data transfers, you could be in for a world of hurt. The hardware and OS are often out of date within two years, and you are looking at upwards of $15-20K to upgrade a single machine so that it can run and updated OS and SCADA package. Upgrading the PC platform is easy, though, compared to upgrading a PLC. You could potentially have thousands of wires that must be migrated over, and a program that must be re-written to the new platform and meticulously checked for errors by someone that knows what the are doing. You must also bring the system down to perform the upgrade, hence the reason why most of our nuclear systems are still on PLC-5 systems. The hardware is still available, rock-solid and reliable. There is a lot more involved when you start digging into controls than there is when dealing with server and network issues. Once you start opening up that can of worms, you are in it for the long haul, and when you add a significant shortage of people trained as both electricians and IT guys, that makes matters worse.
The Pentagon and DOD are playing with fire. I have few qualms with closed source in the consumer arena, but this is a great example of an entity needing to take total ownership of what is theirs. They say these systems are not connected to the internet (I doubt they are really sure), but if they are on a larger network that is, that may not matter. As much as I love open source, I am not typically the zealot that knee jerks straight to that route. This is a bit different. This is my government. While I am sure that they are running a plethora of Windows only software that they likely feel trapped in, they really need to think much further ahead than Windows 10. They need a department for handling and developing operating systems and software in house. I would say move all desktops to a hard implementation of PCBSD. That is, unless they really need to play 3D video games. I am not talking tomorrow. But if they look at it, and come up with a strategy for conversion including developing their own counterparts for whatever critical software they currently rely on, in five to ten years they could be good to go for rolling out. I am not a fan of big government, but I would support creating something for this, given that they are allotted enough say. China did it. Russia did it. Suddenly election season hacking by foreign entities does not sound so far off.
If anyone replies to this with pessimism, I trust they will rightfully be modded up as Insightful or Informative.
Brought to you by Carl's Junior.
It worked when it was new, and it works just the same today. Unless the circumstances has changed, requiring new features like improved security etc. you don't have to upgrade just for the sake of upgrading. Only potential pitfall with really old stuff is not having expertise and replacement hardware that support it. But that is hardly the case here.
my first girlfriend too.
...to get from drawing board to deployment. Many of these systems don't need to handle whatever the latest consumer hardware and software can handle: they just need to do what they were required to do when the system was designed.
It's all about everyone wanting bells and whistles.
Back in my time the PLC's were programmed by paper tape, if you wanted to have it last longer you used a Mylar tape.
You could store it on a shelf, it was waterproof, difficult to hack.
With Mylar paper tape you can positively verify the program and the data by looking at the holes, it doesn't degrade over time. It's kind of hard to hack a roll of paper tape remotely.
I believe in the past missile guidance was done by PROMS loaded by a paper tape. Write the PROM blow the fuse and it was never going to be overwritten.
What in the hell is the military doing using this known piece of spyware?
As long as it:
1. Works
2. Is air gapped
3. Has a reliable source of spare parts
Who gives a flying f*ck? Not everything has to be running the latest software/hardware and everything DEFINATELY doesn't have to be "web enabled". Just have a plan in place to upgrade it once you know you can't source replacement parts for the equipment and call it a day.
Agreed. If it works, why change it?
Code doesn't age, like wine or people. Code always does what it always did.
Why is ANY critical infrastructure being run by ANY Windows product? Not good.
Kids are doomed to learn they should listen to the wise old guys a little.
1 - Open Source
2 - non proprietary api's, libraries, hardware
3 - generic may not be the fastest, but you can replace & up grade it ( you don't really need the last 1% or it would have been done in hardware & assembly )
4 - standard interfaces with capacity growth for the future
5 - modular design so subsystems can be replaced and debugged
6 - good error messages
7 - testing and validation built it from day one
8 - documentation & training for the users, designers, programmers, hardware
9 - upgrade plans for the next 4 hardware/software cycles (decreasing details for 1 to 4)
10 - metrics of the running system - with the known bottlenecks described in detail ( capacity tested to failure points )
11 - a design history on who,when & why choices and changes were made
12 - clear design goals, not just a shall & shall not list and buzzword feature list
(the more features a system has on it's wish list, the more likely it is to fail to meet goals)
companies, languages, hardware & people are changing all the time some for the better, some for the worst.
eventually all of them go defunct.
if your going to build it
your going to test it
then run it
monitor it's activity
fix your mistakes
upgrade it
fix it when something else breaks it
change hardware
justify the costs of running, maintainence, upgrade & replacement
usually running the system a lot longer than the original plan ever thought
Most of what phone/PC companies are doing, has been done on bigger & more expensive software/hardware for years, learn from others mistakes
Peoples needs haven't changed, just their expectations...
We want Jarvis, HAL, T-800 (with asimov laws), Cherry 2000, etc
We are lazy
We need something to do, even George Jetson pushed the button a few times a day
We like new & interesting
We have limited budget
Make love, not war...
I need a drink, nap and a little snuggle...
Here's a nickle kid, go buy your self a new GNU computer,,,,,
Holy sweet mother of God!
Hackers + Windows + Trump + Nukes?! What could possibly go wrong? WarGames-like accidental annihilation?
There are stigs (basically lock-down instructions), and it's got fips-140 certified crypto.
We have had problems integrating with the CAC system though.
Windows 2000 and up all have lots of background services running - Windows 10 is the worst for this; The number of unnecessary services that you can't disable in Windows 10 is staggering and actually gives it a much bigger attack surface than Windows 9x, which has almost no background services!
The only reason more recent version of windows have been more 'secure' is they have firewalls built into them - If you take that away I bet they'd be compromised far faster than Win9x.
Stick Win9x behind a firewall or just don't connect it to the 'net and it'll be just as secure and stable but require far far less CPU power, RAM, HDD space etc. to do its job, and being on older hardware you don't have to worry about background hacks like EFI hypervisors or IPMI that can bypass OS security completely..
Yet more proof that "military intelligence" is an oxymoron. It seems that a large fraction of the Pentagon's human infrastructure runs on stupidity. But, that is hardly news.
To be fair, Linux has many of these same problems, in particular, because newer versions break compatability with old hardware, which forces old versions of the OS to be used on the old hardware. For instance, this happened with X11 when they removed XAA which broke support for a vast array of older video cards. This disregard for backward compatability keeps people using old security hole filled versions of software. Many warned against removing XAA, but the lead developers basically dont give a damn about users. The lets "remove old cruft and destroy backwards compatability" people should also be ignored, since you end up creating compatability problems that keeps people using older insecure versions.
With 20+ years of testing, all the bugs are ironed out and I am confident military is able to to act in a crisis. I don't want America to lose a battle because all of the soldier's rifles are installing Windows 10 updates at inconvinient time.
I work for a number of agencies off and on over the years. Every one of them on a quarterly basis have to tell the big wigs (that's a technical term) how many of fill in the blanks there are. The agency I'm at right now they still have a blank for Windows 95, NT, etc. This one has all zeros up to 2008. That's been the situation for years.
One thing I keep hearing is IT is really expensive. Hardware, san and everyone to keep it running. SAN storage they want you to plan on a 3 year life believe it or not. When you factor in things like video surveillance systems that run on old Windows crap, some physical entry systems are Windows, building control, etc.
Of course the big lie out there is the Cloud can save them from all this expense. I think they're finding out the Cloud isn't cheaper.
Now Microsoft will know everything that's happening inside the gov't. Nothing like adopting forced spyware to keep things safe!
Never mind stuff that isn't reported because it is running in a VM.
Was having a pickle of a time trying to remotely troubleshoot wtf was going on with a client. They were trying to access a corporate application remotely, using a VPN though the corporate firewalls and network, using Citrix (more less a virtual desktop), and their print and network locations within the application were having trouble. They were running "Windows 7"... However after a lot of digging (bc the client doesn't really know), I found that they run everything off a NAS, and were actually running the application off a Windows XP VM on Windows 7, using ancient unsupported Citrix drivers... Anyway got them going again without making them change too much (though I recommended that they do soon)... Just a lot of networks and virtualized environments to crosstalk for what should be a moderately simple operation. It was a "your kidding me right" type of initial conversation... (There was a lot of "why are you doing this" in my conversation)
Though I have seen plenty of purpose built ancient hardware and or software, but it usually isn't connected to any network so who cares. Usually to support some piece of hardware or software that is old but too expensive to replace right away. Seen plotters, specialty printers, large format scanners etc... There used to be one huge scanner (gone now) that ran of an old Windows 95 box I believe, and it worked great, however the problem with with it not being attached to the network was that transferring the huge images it produced was more than a bit of a chore. Heck I have an old laptop (it's not that old) to support one application, because that is all it will run on... Did analysis on the cost of replacement of some old software once, was (a lot) cheaper just to buy all the users specific built laptops than to re-engineer...
And the financial markets are still using COBOL...so what?
Just another day in Paradise