Slashdot Mirror
Britain's Newest Warship Runs Windows XP, Raising Cyber Attack Fears (telegraph.co.uk)
Chrisq shares a report from The Telegraph: Fears have been raised that Britain's largest ever warship could be vulnerable to cyber attacks after it emerged it appears to be running the outdated Microsoft Windows XP. A defense source told The telegraph that some of the on-board hardware and software "would have been good in 2004" when the carrier was designed, "but now seems rather antiquated." However, he added that HMS Queen Elizabeth is due to be given a computer refit within a decade. And senior officers said they will have cyber specialists on board to defend the carrier from such attacks.
Every military appears subject to the same idiocy. Seriously, you are spending literally billions of USD, GBP, or EUR (I tried to use the actual symbols for GBP and EUR, but I forgot about Slashdot and unicode). You can't spring a few million for a custom built or customized (e.g., based on OS/2, QNX, VXWorks, Linux, etc.) OS that has all the networking and other non-essential components removed? Then you can allow network access via a very tightly controlled and well audited interface.
The main reason, I think, for this conundrum is that there are two competing objectives: 1) extremely rigorous system engineering processes with the attendant configuration control; 2) use more COTS and fewer custom components. For instance, those decisions were definitely made over a decade ago and any change to them would require tons of paperwork, additional certification, and also add to the cost and delay the schedule. It's no wonder they just stuck with what was already approved.
That said, I simply cannot believe that one or more of the big defense firms (e.g., BAE, Lockheed-Martin, Boeing) has not come up with something better than slapping Windows on it.
Now, I know (or rather, I truly hope) that things like navigation, fire control, and other critical ship functions are not dependent on any Windows (or other consumer OS). However, I know that some years ago the US Navy had a "Windows-power ship" end up dead in the water and had to have it towed back to port. That was the result of a divide by zero bug in some piece of software but Windows did not handle it gracefully, if I recall correctly.
Either way, they will be lucky if they don't end up with some very serious problems along the way. It seems like it is just not possible to keep ransomware out of any decently sized network. And I can imagine a major world power's flag ship being a tempting target.
The last time I recall the Navy being concerned about running Windows was maybe 15 years ago. The LinuxBIOS project attracted a lot of attention from some Navy guys because of its rapid reboot capability.
At LANL, LinuxBIOS researchers could reboot a small (1K diskless compute nodes connected via Myrinet) scientific computing cluster in 3 seconds, ready for work. So, theoretically, one could change from a Linux cluster to a Windows cluster, but no one ever wanted to.
Whatever became of that technology?
This is the most ridiculous part of the whole story. They think that some people at the board of the carrier can fend off attacks. They believe that it can be solved by like a local scale problem, like aircraft attacking the carrier. So they think they can solve it by people on board specialized to protect you, like they probably have someone on board to operate the anti aircraft cannon.
These attacks aren't local scale though. They are global scale. Vulnerabilities in Windows XP get discovered by someone at the other side of the globe and get used against you. Similarly, a patch to fix a vulnerability in Windows XP can be developed once and then applied locally. And in the case of a total and complete hack during the heat of a battle, even the best team on board won't help them to get the systems back up before the battle finishes.
The Register in 2009
According to the Ministry of Defence (MoD), HMS Montrose has now entered a planned docking and refit period during which BAE Systems plc will replace her original DNA(1) gear with DNA(2), said to be "based on the system being fitted to the Royal Navy's powerful new Type 45 Destroyers". This means it will be based on fairly everyday hardware running legacy Windows OSes - people who have worked on these programmes inform us that both Win2k and XP will be in use across the fleet.
Anons need not reply. Questions end with a question mark.
The systems are very likely DoD (or at least) connected for remote maintenance. There will be a minimum of 3 encryption black boxes before satellite uplink.
Switching OS is nice. But the US government pays for Windows XP support and updates.
I'm far more concerned about software which actually requires XP. The entire ship should be running NSA Secure Host Baseline (https://github.com/iadgov/secure-host-baseline).
This is serious !
Back in 2015 the MoD declared that this vessel would be 'Windows-XP Free'
Read the article below if you do not believe ---
https://www.theregister.co.uk/...