Print

Please login or register.
1 Hour 1 Day 1 Week 1 Month Forever
Login with username, password and session length

[Entwood]

I develop software for some kit that still runs Windows 2000. 

The fact is that some things (normally very expensive things) have a longer life cycle than the operating system they use to interact with the user. Successive Windows versions seem designed to deliberately break things that worked in previous versions, so upgrading is not usually an option.

None of this is a problem, except that there is a fascination with connecting everything to the internet these days.

If you have something that needs to run an unsupported cheap, nasty consumer OS, for god's sake, take a tube of epoxy to the ethernet and USB ports.

The problem is that much of the medical equipment needs to be connected to a network to be of any practical use as the data it is collecting needs to be shared, saved in patients notes etc.

But that network does NOT need internet access, it just needs access to its own network ... do the employees REALLY need to use google, BBC, personal email servers etc etc etc whilst "supposed" to be working ??

Yes, as information needs to be shared over multiple networks. During treatments where I have a rare eye condition the doctors have resorted, twice in my presence to an Internet expert database to find out more and also for emailing a London hospital for a second opinion. Where I had some US research papers on the condition the neurologist I was seeing over an MRI scan, the detailed images which were online, looked up the papers I had found and bookmarked them for his own background reading. This is the real world where the Internet is a vast database of expert knowledge (as well as much populist trash) and a wide area communication system.

Not disputing any of that .. but the MRI scanner does NOT need to be linked to the internet, so can run win XP quite safely in a secure environment. The consultant who DOES need access to the internet uses a separate system with win 10 updated as he is NOT using any specialist software, just a browser and email. All to do with access control, risk management and attention to detail .. just what an IT manager is actually paid to do

[Migv6 le Frog Fan]

Just heard a report  on LBC which said this was supposed to be prevented by an expensive upgrade in 2009, but Gormless refused to spens the money, so it was cancelled. Sounds about right. 

[Rods2]

So it seems this is yet another example of the USA security services trying to take advantage of a "weapon" that they can use but ends up being turned against us all.  If the NSA had not intervened then Microsoft would have been able to take far more effective action to stop this attack, and probably those to come:

http://www.bbc.co.uk/news/technology-39905509

 

I say bring in the young army of IT experts; those aged between 5 and 25, who will fight these attacks very quickly!

So NSA / GCHQ should as these sort of exploits are what keep us safe, where since traitor Snowden terrorists extensively use encryption. The use of such vulnerabilities allows them access, with court orders, to their IT systems to subvert their activities. Perfect systems + encryptions means they can plan and execute their evil deeds with our intelligence and security services blinded.

[Rods2]

I develop software for some kit that still runs Windows 2000. 

The fact is that some things (normally very expensive things) have a longer life cycle than the operating system they use to interact with the user. Successive Windows versions seem designed to deliberately break things that worked in previous versions, so upgrading is not usually an option.

None of this is a problem, except that there is a fascination with connecting everything to the internet these days.

If you have something that needs to run an unsupported cheap, nasty consumer OS, for god's sake, take a tube of epoxy to the ethernet and USB ports.

The problem is that much of the medical equipment needs to be connected to a network to be of any practical use as the data it is collecting needs to be shared, saved in patients notes etc.

But that network does NOT need internet access, it just needs access to its own network ... do the employees REALLY need to use google, BBC, personal email servers etc etc etc whilst "supposed" to be working ??

Yes, as information needs to be shared over multiple networks. During treatments where I have a rare eye condition the doctors have resorted, twice in my presence to an Internet expert database to find out more and also for emailing a London hospital for a second opinion. Where I had some US research papers on the condition the neurologist I was seeing over an MRI scan, the detailed images which were online, looked up the papers I had found and bookmarked them for his own background reading. This is the real world where the Internet is a vast database of expert knowledge (as well as much populist trash) and a wide area communication system.

Not disputing any of that .. but the MRI scanner does NOT need to be linked to the internet, so can run win XP quite safely in a secure environment. The consultant who DOES need access to the internet uses a separate system with win 10 updated as he is NOT using any specialist software, just a browser and email. All to do with access control, risk management and attention to detail .. just what an IT manager is actually paid to do

Like everything else in the real world, where does the cost-benefit analysis draw the line?

[Lizzie Zoom]

So it seems this is yet another example of the USA security services trying to take advantage of a "weapon" that they can use but ends up being turned against us all.  If the NSA had not intervened then Microsoft would have been able to take far more effective action to stop this attack, and probably those to come:

http://www.bbc.co.uk/news/technology-39905509

 

I say bring in the young army of IT experts; those aged between 5 and 25, who will fight these attacks very quickly!

Microsoft issued a patch that prevented this attack working over 2 months ago. All the machines affected have simply not been updated regularly. Microsoft told the world years back they were no longer supporting Win XP .. yet numerous, nay, thousands, of computers still run it ... so whose fault is it really ?? 

If you don't update it is your fault, not the company providing the updates. Anyone with half an interest in IT will tell you that the hackers are one step ahead of the latest systems ... and about 200 miles ahead of outdated software like XP .....

So, if the NHS network managers had done their job PROPERLY .......   

EDIT ...  Interesting reading . 

https://blogs.technet.microsoft.com/msrc/2017/05/12/customer-guidance-for-wannacrypt-attacks/?utm_source=t.co&utm_medium=referral

As one of the globe's richest companies with over $100bn in the bank, they could afford to maintain these older embedded systems but to keep the money profit-making engine turned up to 11 and shareholders happy, they must continue to create new income streams by making new incompatible systems and make old systems obsolete to force you to update, so the cash keeps rolling in.

The good news is that Microsoft is steadily losing ground to Linux with the smartphone/tablet market already lost and the majority of web servers using Linux. The desktop/laptop market is shrinking and I suspect that this trend will continue.

I found this out just last week when I went to Vodafone to renew my contract. No Nokia/Window phones are now offered by Vodafone. I have had Nokia, then Windows for ever, but the manager explained Windows and Apple are in decline and it is all down to the other main players like Samsung. Since Gates and Job left the scene those companies have lost their direction.

How things in IT change so quickly!

[Migv6 le Frog Fan]

NHS has confirmed it was offered details of a patch last month which could have prevented the attack, but they failed to act on it.
Will heads roll ? Will they f....

[TD]

But that network does NOT need internet access, it just needs access to its own network ... do the employees REALLY need to use google, BBC, personal email servers etc etc etc whilst "supposed" to be working ??

Exactly. 

As soon as you put Windows on something, users will assume it's for social networking, watching YouTube videos, etc. not, in this case, making ill people better. The answer is that windows was not an appropriate choice for a device with a long life cycle, but it was the cheap one at the time and plenty fell into that hole.

The choices are there, really. Use something with a smaller attack surface than windows, lock down what users can do to the bare minimum needed to get their jobs done and ignore their moaning, or invest in porting everything to the latest, fully supported Windows. Even then, though you're in trouble if your users are stupid.

When I goto my surgery for a check up with the diabetic nurse, Ive seen her google certain tablets to find out side effects/if they can be prescribed with other tablets/etc....and this is on the same pc that's running the surgery software.....not sure of the OS tho....but I bet it isn't the latest with the latest patches installed . I guess this is what happens when you have nurses qualified to write prescriptions but
not the experience of a doctor and a doctors surgery that has a couple of doctors and about 8 nurses....everything where possible gets
left to the nurses.

[Kevin Wood]

When I goto my surgery for a check up with the diabetic nurse, Ive seen her google certain tablets to find out side effects/if they can be prescribed with other tablets/etc....and this is on the same pc that's running the surgery software.....not sure of the OS tho....but I bet it isn't the latest with the latest patches installed . I guess this is what happens when you have nurses qualified to write prescriptions but
not the experience of a doctor and a doctors surgery that has a couple of doctors and about 8 nurses....everything where possible gets
left to the nurses.

Yes, and it's not an unreasonable thing for them to do, so, if any software they are using is holding the system back from being updated then the whole system is unfit for purpose. It's no use waving hands in the air and blaming hackers. Unpatched systems with internet access get hacked, just as unlocked bikes parked at the station get nicked. That's the way the world works, except that, outside IT, we seem to be able to adapt to how the world works.

[zirk]

I found this out just last week when I went to Vodafone to renew my contract. No Nokia/Window phones are now offered by Vodafone. I have had Nokia, then Windows for ever, but the manager explained Windows and Apple are in decline and it is all down to the other main players like Samsung. Since Gates and Job left the scene those companies have lost their direction.

How things in IT change so quickly!

Windows phones are a dead duck now Lizzie, Microsoft kept threating about a possible new Surface Phone, but it probably wont happen or be any good for non Business use.

In a nut shell, Nokia are now free from MS, so all there new phones will be Android based, there current Nokia 6 in 64gb form is actually a nice spec'ed phone for the price, just under 250 quid with the Nokia 3 and 5 being budget versions. Any time now Nokia are launching the Nokia 8/9 which will be there revival Flagship models to compete with the likes of iPhone and Samsung models, surprised, or maybe not, that Vodafone never told you this.

[Auto Addict]

I've just upgraded to DOS 6.1

[Rods2]

I've just upgraded to DOS 6.1

You won't get me moving to such new-fangled Operating Systems, I will stick with CP/M.

[Lizzie Zoom]

I found this out just last week when I went to Vodafone to renew my contract. No Nokia/Window phones are now offered by Vodafone. I have had Nokia, then Windows for ever, but the manager explained Windows and Apple are in decline and it is all down to the other main players like Samsung. Since Gates and Job left the scene those companies have lost their direction.

How things in IT change so quickly!

Windows phones are a dead duck now Lizzie, Microsoft kept threating about a possible new Surface Phone, but it probably wont happen or be any good for non Business use.

In a nut shell, Nokia are now free from MS, so all there new phones will be Android based, there current Nokia 6 in 64gb form is actually a nice spec'ed phone for the price, just under 250 quid with the Nokia 3 and 5 being budget versions. Any time now Nokia are launching the Nokia 8/9 which will be there revival Flagship models to compete with the likes of iPhone and Samsung models, surprised, or maybe not, that Vodafone never told you this.

Thanks zirk

No, all Vodafone said was something about an old phone of theirs being relaunched, but with a new operating system; the number, 6310 or was it 3110 (??) seemed very familiar, as a phone I once had years back. I love Nokia, and currently have a Nokia (Windows) Lumia 930, which is almost brand new after I made a warranty claim for the same phone. I will be hoping the new ones are available when I need it

[zirk]

I found this out just last week when I went to Vodafone to renew my contract. No Nokia/Window phones are now offered by Vodafone. I have had Nokia, then Windows for ever, but the manager explained Windows and Apple are in decline and it is all down to the other main players like Samsung. Since Gates and Job left the scene those companies have lost their direction.

How things in IT change so quickly!

Windows phones are a dead duck now Lizzie, Microsoft kept threating about a possible new Surface Phone, but it probably wont happen or be any good for non Business use.

In a nut shell, Nokia are now free from MS, so all there new phones will be Android based, there current Nokia 6 in 64gb form is actually a nice spec'ed phone for the price, just under 250 quid with the Nokia 3 and 5 being budget versions. Any time now Nokia are launching the Nokia 8/9 which will be there revival Flagship models to compete with the likes of iPhone and Samsung models, surprised, or maybe not, that Vodafone never told you this.

Thanks zirk

No, all Vodafone said was something about an old phone of theirs being relaunched, but with a new operating system; the number, 6310 or was it 3110 (??) seemed very familiar, as a phone I once had years back. I love Nokia, and currently have a Nokia (Windows) Lumia 930, which is almost brand new after I made a warranty claim for the same phone. I will be hoping the new ones are available when I need it

Yes they're also re launching the 3310, but this time with a Colour Screen, about 50 quid Sim Free. No 3 or 4G Connectivity, but it doses make phone calls. Also has a low res 2mp Camera for taking those early 2001 style pictures, and if your Music or Film lover it has, wait for it, ......   a 16Mb internal memory, yes Mb.

[TheBoy]

I develop software for some kit that still runs Windows 2000. 

The fact is that some things (normally very expensive things) have a longer life cycle than the operating system they use to interact with the user. Successive Windows versions seem designed to deliberately break things that worked in previous versions, so upgrading is not usually an option.

None of this is a problem, except that there is a fascination with connecting everything to the internet these days.

If you have something that needs to run an unsupported cheap, nasty consumer OS, for god's sake, take a tube of epoxy to the ethernet and USB ports.

The problem is that much of the medical equipment needs to be connected to a network to be of any practical use as the data it is collecting needs to be shared, saved in patients notes etc.

But that network does NOT need internet access, it just needs access to its own network ... do the employees REALLY need to use google, BBC, personal email servers etc etc etc whilst "supposed" to be working ??

The specialist stuff isn't internet accessible, but is networked for things like electronically storing X-rays etc.

GPs and general purpose PCs do need internet. However, despite media 'dangle berries', these "normal" machines are generally W7, thus supported.

This particular malware needed a human idiot to infect. And the NHS has no shortage. It wasn't the technology that was really the issue in this case.  But that doesn't make a good story.


This attack was actually aimed at telcos, with NHS being collateral damage. Telefonica and O2 took a bit of a hit, bit in an election build up, only NHS will get reported by U.K. Media

[aaronjb]

This particular malware needed a human idiot to infect.

Only for the first infection within a properly firewalled enterprise, though.. after that, if unpatched, it could spread all by itself via the hole described by MS017-010. And I am willing to bet the NHS has a lot of unpatched machines, even if their patch programme is up to date..

Heck, in a well controlled environment (ours) a survey of 4000 "machines" (includes VMs) found ~600 unpatched; my own VM was one of them, because it gets fired up so rarely..

And a quick look on something like shodan.io will find 1.5 million servers with port 445 exposed to the internet (for the uninitiated, that's the port required for infection if you are unpatched). A port that, as you know, has precisely no purpose being exposed to the internet.

.. tl;dr: It's not just the users that are idiots