Slashdot Mirror
Some Of The Pentagon's Critical Infrastructure Still Runs Windows 95 And 98 (defenseone.com)
SmartAboutThings writes:
The Pentagon is set to complete its Windows 10 transition by the end of this year, but nearly 75% of its control system devices still run Windows XP or other older versions, including Windows 95 and 98. A Pentagon official now wants the bug bounty program of the top U.S. defense agency expanded to scan for vulnerabilities in its critical infrastructure.
DefenseOne raises the possibility of "building and electrical systems, HVAC equipment and other critical infrastructure laden with internet-connected sensors," with one military program manager saying "A lot of these systems are still Windows 95 or 98, and that's OK -- if they're not connected to the internet." Windows Report notes that though Microsoft no longer supports Windows XP, "the Defense Department is paying Microsoft to continue providing support for the legacy OS."
DefenseOne raises the possibility of "building and electrical systems, HVAC equipment and other critical infrastructure laden with internet-connected sensors," with one military program manager saying "A lot of these systems are still Windows 95 or 98, and that's OK -- if they're not connected to the internet." Windows Report notes that though Microsoft no longer supports Windows XP, "the Defense Department is paying Microsoft to continue providing support for the legacy OS."
You wouldn't beleive the crap that gets implemented. In the last three years I've seen new control systems implemented in windows 2000 pro because that's what the government agency mandated. It's all over the place but fortunately in most cases it's not ever internet connected.
Posting ac of obvious reasons.
They should really upgrade to Vista.
Hopefully they realize that means more than "there's no Ethernet cable connecting this computer to the network", since it sounds like these ancient systems may be connected in various ways to other equipment.
#DeleteChrome
Most likely because it needs to run VB6 scripts to talk to the devices or some .NET flavor, most likely v1 or v2. Bad programmers know only bad languages.
In a lot of cases these companies, especially in the various construction and utilities, will have hired a programmer to make something in the late 90s and that same program now operates their entire fleet of devices. They don't want to spend the money on another programmer or systems design engineer so they still operate on the same hardware, same power supplies, same chipsets, same control and operating systems from that era even though much more faster, efficient and safer systems exist.
Custom electronics and digital signage for your business: www.evcircuits.com
I Know Right!
At least state governments aren't running that crap. They're all on IBM's much more robust OS/2 Warp. You think I'm kidding...I'm not.
"A person is smart. People are dumb, panicky dangerous animals and you know it." - K
At least OS/2 has preemptive multitasking and memory protection. I think.
We're living in a time where we're building critical infrastructure expected to last decades and integrating it with IT equipment with a lifespan of a few years. So the options are to perform major infrastructure upgrades every few years (which is expensive) or run seriously outdated software (possibly dangerous).
Especially if you consider that almost two-thirds of US navy planes can't fly.
Hope this administration can deliver on their [campaign] promise.
you really have to wonder
1 the source would be available so they never have to worry about obsolesence.
2 in runs on all sorts of hardware so they could maintain very nice consistency across many processor/platforms
3 the NSA is working on secure linux, and could certainly help to harden military grade linux
4 to get work done, they could fund open-source efforts. the work would help the military and the country alike.
probaly makes too much sense. much better to have a closed-source, proprietary system that can never, ever be secure.
plus it's more expensive !
Absolute statements are never true
I work in a building where the heating system is controlled by a Windows 95 machine. Big deal. It's not network connected, and runs like a champ. It only changes the configuration of the system, it doesn't run the system minute by minute. If it goes down, we can recreate it easily. Worry about business critical infrastructure, not old hardware that works.
So does that mean the DoD can run Windows XP on Ryzen?
If they're critical, don't connect them to the internet. See, that was easy, wasn't it.
Connecting critical infrastructure to the internet is like putting a top secret next gen nuclear bomb on display in the middle of LA and expecting nobody to try and fuck with it... But I can all the wannabe IT "professionals" out there saying "but a proper firewall and vpn along with continuous monitoring will keep things safe"... no, it won't, you fucking retard... firewalls, vpns, and monitoring systems aren't much better than a rent-a-cop at the mall trying to stop an armed robbery.
If you want things to be secure and safe from your enemies, don't use a PUBLIC network. Period. Better yet, don't connect it to a network that goes offsite at all... once it goes offsite folks can access it if they want... it just depends on how much trouble they want to go through to do it.
since they are not getting forced updates
at some point I was working for a company providing software largely used to defense. it was mid 90s, a time when most of the large shops ran IBM mainframes. by that time mainframe operating system went though many generations, yet some of our government users run fairly ancient versions of OS (and I assume fairly ancient hardware as well). Their logic was "why to upgrade if it's not broken". so we had one mainframe running VM (IBM virtual machine) and every time we had a problem report, we had to bring up one of those old OSes just to recreate the problem. the funny thing was that even to find out which particular OS they ran one had to have a security clearance. I hope since it was over 20 years ago, I can tell as much as that.
Microsoft would have a hard time disallowing DoD access at 20 years old and at least 17-20 out of print.
With the source code fix the bugs, implement a proper firewall and modern FIPS certified encryption systems, call it a day.
People act like just because software/hardware is old, it SHOULD be obsolete. The truth is often the opposite: As long as it does what it is supposed to, reliably and for less than the alternative, it is a good solution.
Furthermore, as clunkily designed as the Win9x series was, it has a *LOT* less attack surface than any of the Windows NT 6.x releases (Vista-10) and has 20 years of enthusiast documentation and patches for its most serious shortcomings. (They have Win9x running on hardware up to Sandy Bridge/K10 or so. Which implies the right maintenance will keep Win9x acceptable for single core 32 bit x86 for as long as anyone needs to run it.)
SW compatibility. The HVAC monitoring SW was probably written 15-20 years ago, and if it ain't broke, don't spend the money to fix it.
Also, a familiar user interface. When you send the HVAC tech out, everyone has a basic grasp of using Win 95/98. The old guys train the new guys, and the cycle perpetuates.
This signature is false.
I see this time and time again in the controls field. Though we may cross over with the IT sector, machine control is a completely different beast. It isn't about swapping out a computer. There are a plethora of closed communications protocols, old SCADA-package-specfic libraries and binaries, and lots of those functions in the script have to be rewritten. It is great when you have a PLC doing the controls and the SCADA package acting as an HMI, because you can develop the new system in parallel to the existing one, but if the PLC does not do a good job of handling the data transfers, you could be in for a world of hurt. The hardware and OS are often out of date within two years, and you are looking at upwards of $15-20K to upgrade a single machine so that it can run and updated OS and SCADA package. Upgrading the PC platform is easy, though, compared to upgrading a PLC. You could potentially have thousands of wires that must be migrated over, and a program that must be re-written to the new platform and meticulously checked for errors by someone that knows what the are doing. You must also bring the system down to perform the upgrade, hence the reason why most of our nuclear systems are still on PLC-5 systems. The hardware is still available, rock-solid and reliable. There is a lot more involved when you start digging into controls than there is when dealing with server and network issues. Once you start opening up that can of worms, you are in it for the long haul, and when you add a significant shortage of people trained as both electricians and IT guys, that makes matters worse.
The Pentagon and DOD are playing with fire. I have few qualms with closed source in the consumer arena, but this is a great example of an entity needing to take total ownership of what is theirs. They say these systems are not connected to the internet (I doubt they are really sure), but if they are on a larger network that is, that may not matter. As much as I love open source, I am not typically the zealot that knee jerks straight to that route. This is a bit different. This is my government. While I am sure that they are running a plethora of Windows only software that they likely feel trapped in, they really need to think much further ahead than Windows 10. They need a department for handling and developing operating systems and software in house. I would say move all desktops to a hard implementation of PCBSD. That is, unless they really need to play 3D video games. I am not talking tomorrow. But if they look at it, and come up with a strategy for conversion including developing their own counterparts for whatever critical software they currently rely on, in five to ten years they could be good to go for rolling out. I am not a fan of big government, but I would support creating something for this, given that they are allotted enough say. China did it. Russia did it. Suddenly election season hacking by foreign entities does not sound so far off.
If anyone replies to this with pessimism, I trust they will rightfully be modded up as Insightful or Informative.
Brought to you by Carl's Junior.
Why does any of this run redmondware in the first place?
Because DoD runs software projects the same way the British Army fought the Battle of the Somme. If you want to throw 200 programmers at a project, the only way to recruit that many bodies in a hurry is to go with Windows.
It worked when it was new, and it works just the same today. Unless the circumstances has changed, requiring new features like improved security etc. you don't have to upgrade just for the sake of upgrading. Only potential pitfall with really old stuff is not having expertise and replacement hardware that support it. But that is hardly the case here.
Because in the 90's, Microsoft was everywhere, so every vendor for every embedded system component out there produced development kits and compilers and programming toolkits that would run on the machines their customers had handy. Which in the 90's meant Windows. I'll give you an example: Allen Bradley makes embedded controllers for industrial machinery. The controller itself runs VxWorks or RT Linux or QNX or some other real operating system. The develoment environment is Windows only, and a lot of third-party add-ons like graphical toolkits to make touch panel controls and the like are Windows only.
So my nice and high-tech and Linux-only system for doing the process control has to have a WinXP machine in there so that I can use my ten year old Allen Bradley controller which I can buy for 20k instead of developing from-scratch myself for 100-200k. Yeah. Real life imposes constraints.
I'm sure you have experience porting stuff from the early .NET or VB6 era.
Entire enterprises have been written on the back of Excel scripts, Word integrations and Access databases. VB6 is/was a step up on that and can contain entire ERP's. .NET has improved but the ancestors of current iterations (anything pre-3.5 IMHO) were horrible to use and had many kludges, most of those kludges are the reasons why there is STILL no backwards or Mono compatibility for many components.
Custom electronics and digital signage for your business: www.evcircuits.com
Mostly because the military doesn't need or want the latest fad. They need reliability. They have more than sufficient problems executing their missions without constantly changing interfaces and such "features" as automatic software updates made at a time convenient to the vendor.
Also, much military hardware is custom stuff built for a single purpose. The CPUs and OSes (if any) would be selected initially to have sufficient capability for their job, and usually not much more. If they do what's needed, what point would there be in upgrading? And why would you risk it? If you do it routinely, you'll probably make mistakes with serious consequences.
The last military contract I worked on -- a number of decades ago -- was a system that ran on a computer built to military standards using discrete transistors -- none of those fancy IC things. It was nowhere near as powerful as the PC-XTs in our office. But it would run equally poorly in the Arctic in January or the Middle East in July. And the computer would probably survive being inadvertently dropped off a truck by some high school dropout then run over by the next two vehicles in the convoy.
Frankly, the notion of having my life and safety depend on an NT based OS from Microsoft would not make me feel vary secure. Unix, compiled with only what is needed, would be better. But only if the system underwent a LOT of rigorous testing prior to deployment and wasn't upgraded unless the change were absolutely necessary.
There's a lot of truth in Arthur Clarke's short story "Superiority" http://www.mayofamily.com/RLM/... Folks who haven't read it, should.
You can't see ANYTHING from a car, You've got to get out of the goddamned contraption and walk...Edward Abbey
Who is we? :P
Ant(Dude) @ Quality Foraged Links (AQFL.net) & The Ant Farm (antfarm.ma.cx / antfarm.home.dhs.org).
Seems an opportunity for Linux developers to write for older controllers, no?
user@host$ diff
I'm not surprised that there's still some VB6 apps doing important work out there. Just as I'm not surprised to see features added to ancient RPG programs or web services being created to wrap a bunch of FoxPro modules. Old doesn't mean bad; if it has worked until now, why throw it away.
In 10 years those apps will probably still run, but the countless NodeJs packages and ruby gems and whatnot that are currently hosted on github will be gone.
lucm, indeed.
Because that was the best, and in fact more or less only, option at the time, and once it's set up there's no incentive to upgrade or replace it because it's an afterthought to the thing it's actually used with. For example there's a... device that costs about $25M each which is managed through a web server running on Widows NT 4. And it's NT 4, and will continue to be NT 4, for exactly the reason given in the first sentence.
OS/2 nostalgia is like JFK nostalgia; it's more about an idealized version of what could have been than fond memories of what it actually was.
IBM has created some very advanced stuff for the enterprise, but they don't have a good track record when it comes down to consumer-grade or user-friendly software. Maybe the reason is because they enter the corporate world through the board room and golf greens, forcing their product down the chain of command instead of making things actual users can enjoy.
Windows didn't kill OS/2. "Something not OS/2" killed OS/2; if there hadn't been Windows it would have been something else, like BeOS.
lucm, indeed.
Staff skills and outsourcing that saw and opening. The US needed networks quickly and smart new contractors saw an opening to make decades of profit. The US could move from secure networks to "desktop" computers at a low new cost thanks to the skills only found in the "private" sector. Tax payers would get savings. Funding could flow to new mil projects rather than 1970's networks and very expensive existing contractors.
The words private sector, budget issues and easy ongoing staff training got the US leadership interested and very complex support deals got done.
The US is now flooded with networks and systems from that decade that still have to be looked after.
The contractors understood what they had sold the US gov. The US gov has to keep paying for support as expected.
The contractors knew they had support deals for decades. The US gov got sold on the savings when buying desktop computers.
The selling point was cheap new CPU's and that new staff using US gov and mil networks understood the same computers from home and educational use.
No need for Ada skills or the security of Unix on a very secure base that would never be networked with the outside world.
Every user was security cleared and the base had a big strong fence around it. New desktop computers for deep inside the secure base. Support deals ensured long term profits for contractors.
Staff could get working rather than need months of support to try and learn complex old systems.
Contractors could offer an endless upgrade supply of cheap "tested" and "supported" hardware as needed. No wait for a bespoke computer network to be designed and installed per base.
Domestic spying is now "Benign Information Gathering"
I think they come included in the next release of systemd.
Confucius say, "Find worm in apple - bad. Find half a worm - worse."
Agreed. If it works, why change it?
Code doesn't age, like wine or people. Code always does what it always did.
There were probably electric motors in some of the equipment in that cheese processing plant from the Windows 3.1 era.
Where did you get the idea they were running software with heartbleed in the kernel?
I'm not surprised that there's still some VB6 apps doing important work out there. Just as I'm not surprised to see features added to ancient RPG programs or web services being created to wrap a bunch of FoxPro modules. Old doesn't mean bad; if it has worked until now, why throw it away.
In 10 years those apps will probably still run, but the countless NodeJs packages and ruby gems and whatnot that are currently hosted on github will be gone.
I will like to amend that in stating that there will probably be some NodeJS packages and Ruby gems that will be running important pieces of software 10 years from now. Like there was countless VB6 software 10 years back.
Probably better than how the EU is doing. Gotta love how the Europeans think they are so awesome, when their unemployment rates suck so bad.
Life was hell, then I discovered Linux...
The run old systems mainly because the tech companies are not tied into the corruption of the war industrial complex as strongly as the arms and munitions manufacturers, those companies who through major corruptive efforts can force through unnecessary purchases. Basically M$ can not force through upgrades as routine but that was before Windows 10, now it seems M$ lobbyists have broken through and will be able to force routine across the board upgrades. Good, bad, indifferent, secure, insecure, buggy, unreliable, all of it matters not one iota, lots of profit and the right political connections and billions upon billions will be handed over. The F35 Flying Pig is proof of that, it is all about the benjamins when it comes to US Defence spending.
Chaos - everything, everywhere, everywhen
Why is ANY critical infrastructure being run by ANY Windows product? Not good.
.NET 1.1 and 2 apps run fine on .NET 3.5. I know because we've just had the pleasure of moving a few away from a 2003 server to a 2012 R2 server. 3.5 is still supported until 2023 if not longer on 2012 R2 (not sure whether it's on 2016).
This is a good answer to the previous poster. People use "Redmondware" because software written in 2002 will still work and is still supported in 2017.
The last military contract I worked on -- a number of decades ago -- was a system that ran on a computer built to military standards using discrete transistors -- none of those fancy IC things. It was nowhere near as powerful as the PC-XTs in our office. But it would run equally poorly in the Arctic in January or the Middle East in July. And the computer would probably survive being inadvertently dropped off a truck by some high school dropout then run over by the next two vehicles in the convoy.
Sure, but for the price of maintaining an antique, you could probably put a more modern computer in every pocket...
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
To be fair, Linux has many of these same problems, in particular, because newer versions break compatability with old hardware, which forces old versions of the OS to be used on the old hardware. For instance, this happened with X11 when they removed XAA which broke support for a vast array of older video cards. This disregard for backward compatability keeps people using old security hole filled versions of software. Many warned against removing XAA, but the lead developers basically dont give a damn about users. The lets "remove old cruft and destroy backwards compatability" people should also be ignored, since you end up creating compatability problems that keeps people using older insecure versions.
Much of what you say is naive because old versions of Windows or Linux are full of known security vulnerabilities. So, Windows 2000 may boot, so you say it works. But it is full of security holes that were patched ages ago in newer versions. So while it does work, its not the work/doesnt work binary test that is really the determiner for suitability, its the security holes that do not keep the software from working but are there silently waiting. Linux has advantages with being open source but dont fool yourself that you can run old versions of Linux and be safe, like Windows, you have to apply security patches.
With 20+ years of testing, all the bugs are ironed out and I am confident military is able to to act in a crisis. I don't want America to lose a battle because all of the soldier's rifles are installing Windows 10 updates at inconvinient time.
Everybody has problems with the CAC system. It's a POS. They really should move on. I think it it was made by Wonder systems. It it works, it's a wonder.
I work for a number of agencies off and on over the years. Every one of them on a quarterly basis have to tell the big wigs (that's a technical term) how many of fill in the blanks there are. The agency I'm at right now they still have a blank for Windows 95, NT, etc. This one has all zeros up to 2008. That's been the situation for years.
One thing I keep hearing is IT is really expensive. Hardware, san and everyone to keep it running. SAN storage they want you to plan on a 3 year life believe it or not. When you factor in things like video surveillance systems that run on old Windows crap, some physical entry systems are Windows, building control, etc.
Of course the big lie out there is the Cloud can save them from all this expense. I think they're finding out the Cloud isn't cheaper.
If you're lucky and/or your program is well written or simple enough. There is plenty of stuff that doesn't run and the reason people still run Redmondware from 2002.
Custom electronics and digital signage for your business: www.evcircuits.com
Never mind stuff that isn't reported because it is running in a VM.
Was having a pickle of a time trying to remotely troubleshoot wtf was going on with a client. They were trying to access a corporate application remotely, using a VPN though the corporate firewalls and network, using Citrix (more less a virtual desktop), and their print and network locations within the application were having trouble. They were running "Windows 7"... However after a lot of digging (bc the client doesn't really know), I found that they run everything off a NAS, and were actually running the application off a Windows XP VM on Windows 7, using ancient unsupported Citrix drivers... Anyway got them going again without making them change too much (though I recommended that they do soon)... Just a lot of networks and virtualized environments to crosstalk for what should be a moderately simple operation. It was a "your kidding me right" type of initial conversation... (There was a lot of "why are you doing this" in my conversation)
Though I have seen plenty of purpose built ancient hardware and or software, but it usually isn't connected to any network so who cares. Usually to support some piece of hardware or software that is old but too expensive to replace right away. Seen plotters, specialty printers, large format scanners etc... There used to be one huge scanner (gone now) that ran of an old Windows 95 box I believe, and it worked great, however the problem with with it not being attached to the network was that transferring the huge images it produced was more than a bit of a chore. Heck I have an old laptop (it's not that old) to support one application, because that is all it will run on... Did analysis on the cost of replacement of some old software once, was (a lot) cheaper just to buy all the users specific built laptops than to re-engineer...
Because most govt. contracts require the use of COTS products, and until recently, there was very little chance of any kind of open source. They want COTS because of the low cost to purchase, w/o consideration of the TCO. As a contractor, we often end up spending tons of time configuring COTS to do things hey weren't designed to do originally, and it often ends up costing the govt. more. But don't get me started, I could talk govt. contracting issues all day.
Just another day in Paradise
And the financial markets are still using COBOL...so what?
Just another day in Paradise
If it works, don't fuck with it.
If its not connected to the internet, glue up the USB ports, cut the floppy controller cable, and don't worry about it.
Birds are not dinosaur descendants;birds are dinosaurs, for all useful meanings of "birds", "are" and "dinosaurs"