Slashdot Mirror
Britain's Newest Warship Runs Windows XP, Raising Cyber Attack Fears (telegraph.co.uk)
Chrisq shares a report from The Telegraph: Fears have been raised that Britain's largest ever warship could be vulnerable to cyber attacks after it emerged it appears to be running the outdated Microsoft Windows XP. A defense source told The telegraph that some of the on-board hardware and software "would have been good in 2004" when the carrier was designed, "but now seems rather antiquated." However, he added that HMS Queen Elizabeth is due to be given a computer refit within a decade. And senior officers said they will have cyber specialists on board to defend the carrier from such attacks.
If they ran Linux on the ship it would be Linux from back when the ship was designed, full of potential vulnerabilities just like whatever flavor of XP they're running. With giant systems like this, there is a much higher potential risk when introducing changes to the systems and given the fact that the systems are not connected to the outside world, the reward for keeping software up to date can be very little to none.
I don't always use unix-like operating systems; but when I do, I prefer FreeBSD.
It makes sense when the divide by 0 error in userland takes down the entire ship.
"On 21 September 1997, a division by zero error on board the USS Yorktown (CG-48) Remote Data Base Manager brought down all the machines on the network, causing the ship's propulsion system to fail."
https://en.wikipedia.org/wiki/USS_Yorktown_(CG-48)
They don't just take an off the shelf copy of Windows XP and install it on the ship, companies like BAE systems have agreements with Microsoft over source code access and provide hardened versions to their customers.
Thus, the unsupported and proprietary elements of consumer Windows XP are entirely irrelevant - they both pay for bespoke extended support from Microsoft, and they have source code access themselves.
Whilst there are legitimate questions about using Windows XP for a brand new ship, it's not quite as bad as "OMG they use Windows XP lol" type headlines and comments make out. The reality is that they have support for and source code access to perhaps the single most tried and tested OS in the world. Lines of communication and inputs into the systems are both limited and restricted, and thus any vulnerability discovered against XP in the real world will likely be fixed and patched on a ship well before anyone can find a way of getting the exploit onto the ship's systems.
Tell that to the Iranians.
Their centrifuges were not attached to the Internet. Physical security. But Stuxnet got them anyway.