Slashdot Mirror
Britain's Newest Warship Runs Windows XP, Raising Cyber Attack Fears (telegraph.co.uk)
Chrisq shares a report from The Telegraph: Fears have been raised that Britain's largest ever warship could be vulnerable to cyber attacks after it emerged it appears to be running the outdated Microsoft Windows XP. A defense source told The telegraph that some of the on-board hardware and software "would have been good in 2004" when the carrier was designed, "but now seems rather antiquated." However, he added that HMS Queen Elizabeth is due to be given a computer refit within a decade. And senior officers said they will have cyber specialists on board to defend the carrier from such attacks.
It makes sense to me. Where else are they going to get minesweeper?
they will have cyber specialists on board to defend the carrier from such attacks
They are supposed to defend unsupported proprietary software. The right name is not cyber specialist, but rather priest.
Yes, the Royal Marines like their meat fresh.
I am armed because I am free. I am free because I am armed.
... control system is assisted by Clippy.
"And senior officers said they will have cyber specialists on board to defend the carrier from such attacks."
ALL UNPLUG FULL!
Answering all unplug full aye!
Every military appears subject to the same idiocy. Seriously, you are spending literally billions of USD, GBP, or EUR (I tried to use the actual symbols for GBP and EUR, but I forgot about Slashdot and unicode). You can't spring a few million for a custom built or customized (e.g., based on OS/2, QNX, VXWorks, Linux, etc.) OS that has all the networking and other non-essential components removed? Then you can allow network access via a very tightly controlled and well audited interface.
The main reason, I think, for this conundrum is that there are two competing objectives: 1) extremely rigorous system engineering processes with the attendant configuration control; 2) use more COTS and fewer custom components. For instance, those decisions were definitely made over a decade ago and any change to them would require tons of paperwork, additional certification, and also add to the cost and delay the schedule. It's no wonder they just stuck with what was already approved.
That said, I simply cannot believe that one or more of the big defense firms (e.g., BAE, Lockheed-Martin, Boeing) has not come up with something better than slapping Windows on it.
Now, I know (or rather, I truly hope) that things like navigation, fire control, and other critical ship functions are not dependent on any Windows (or other consumer OS). However, I know that some years ago the US Navy had a "Windows-power ship" end up dead in the water and had to have it towed back to port. That was the result of a divide by zero bug in some piece of software but Windows did not handle it gracefully, if I recall correctly.
Either way, they will be lucky if they don't end up with some very serious problems along the way. It seems like it is just not possible to keep ransomware out of any decently sized network. And I can imagine a major world power's flag ship being a tempting target.
... Windows for Warships? (Seriously, that exists) Anyway: despite windows XP's age Microsoft will still actively support it for organizations willing to send them a boatload of money, and the rates only go up the more time passes. But when you're talking about the operating costs of a large warship, the cost for continued xp support is only a rounding error in the total.
The last time I recall the Navy being concerned about running Windows was maybe 15 years ago. The LinuxBIOS project attracted a lot of attention from some Navy guys because of its rapid reboot capability.
At LANL, LinuxBIOS researchers could reboot a small (1K diskless compute nodes connected via Myrinet) scientific computing cluster in 3 seconds, ready for work. So, theoretically, one could change from a Linux cluster to a Windows cluster, but no one ever wanted to.
Whatever became of that technology?
The die-cision to use anything from Microsoft in a mission-critical environment, let alone a 16+ year old OS with a giant list of known exploits goes so far beyond amazingly stupid I can't even find the words.
Is there even a word for this level of stupidity? The die-cision to use anything from Microsoft in a mission-critical environment, let alone a 16+ year old OS with a giant list of known exploits...
I believe the word you're looking for is "congressional". ;)
Anons need not reply. Questions end with a question mark.
You're right. After all, when Windows XP came out Microsoft had a pristine security history from MS-DOS 3 to Windows 98.
#DeleteFacebook
... has managed to develop their own QNX based base operating system to ensure safety & security. They've also been doing it for a couple decades.
It seems insane that the Royal Navy & BAE systems couldn't figure this out themselves. This has the smell of a kickback based sales agreement to me. Almost any other operating system is a better choice simply because they are smaller attack targets than any version of Windows.
The Register in 2009
According to the Ministry of Defence (MoD), HMS Montrose has now entered a planned docking and refit period during which BAE Systems plc will replace her original DNA(1) gear with DNA(2), said to be "based on the system being fitted to the Royal Navy's powerful new Type 45 Destroyers". This means it will be based on fairly everyday hardware running legacy Windows OSes - people who have worked on these programmes inform us that both Win2k and XP will be in use across the fleet.
Anons need not reply. Questions end with a question mark.
It looks like you are trying to turn the surface of the earth into glass. Would you like help?
If they ran Linux on the ship it would be Linux from back when the ship was designed, full of potential vulnerabilities just like whatever flavor of XP they're running. With giant systems like this, there is a much higher potential risk when introducing changes to the systems and given the fact that the systems are not connected to the outside world, the reward for keeping software up to date can be very little to none.
I don't always use unix-like operating systems; but when I do, I prefer FreeBSD.
It makes sense when the divide by 0 error in userland takes down the entire ship.
"On 21 September 1997, a division by zero error on board the USS Yorktown (CG-48) Remote Data Base Manager brought down all the machines on the network, causing the ship's propulsion system to fail."
https://en.wikipedia.org/wiki/USS_Yorktown_(CG-48)
The last thing you want to see in naval warfare:
Your cruise misses have been encrypted. Do not bother trying to decrypt your cruise missles as they can only be decrypted by us. Send ${YOOGE_BITCOIN_MONIES} to our friendly decryption service to decrypt your cruise missles.
This is serious !
Back in 2015 the MoD declared that this vessel would be 'Windows-XP Free'
Read the article below if you do not believe ---
https://www.theregister.co.uk/...
"Warship sunk by fat Russian boy on the couch of his mother's basement."
The U.S. Navy develops Tor and the Airforce, as well as several other agencies use LPS to log into places. You'd think the UK navy would be smart enough to not use Window$ anything. But, this is coming from a country that wants backdoors in everything. One country's bug is another country's feature, I guess.
Boar does not mean wild pig. It means male pig with his balls intact. (/syntaxrant)
A lot of people keep calling this stupid, but it's actually pretty simple. The design started back in 2004. When you're working a rigid project like this, things get locked in once approved, like design and technology. If you postponed even whenever a new Windows came out, you'd have to go back, have a new CONOPS, new requirements, and start all over again and the project would never finish. Yes you'd get to reuse a lot of the previous architecture, but just think about it. If you're running the program, and software people tell you they're going to just use a new OS, you have a whole host of new things to think about.
And in the government, hardware tends to drive software, so software is constantly trying to keep to the same milestones. And believe me, once you've tested, NOBODY wants to think about switching OS and libraries now. Throw in a few of the typical delays that come in the government, (funding/changing of the guard, etc...) and this all makes sense.
So stupid? That's not really the issue here. It's choosing between a rigid process, that can't afford to do things quickly and is very risk averse...or finishing quickly. The most common mitigation to this issue is to include an update later, with newer Windows and some regression testing. You can't really win with the public these days anyway...imagine if they pushed it out quickly and the report instead said that there was a malfunction because it was a rush job. These days, you're damned if you do (spend a lot of money but this is what we get) and damned if you don't (rush job leads to malfunction leads to public embarrassment).