Catch up on stories from the past week (and beyond) at the Slashdot story archive

 


Forgot your password?
Close
typodupeerror
×
The Almighty Buck Microsoft Windows

95% of ATMs Worldwide Are Still Using Windows XP 346

Posted by samzenpus from the if-it-aint-broke dept.
BUL2294 writes "95% of the world's ATM machines are still running Windows XP and banks are already purchasing extended support agreements from Microsoft. (some of the affected ATMs are running XP Embedded, which has a support lifecycle until January, 2016). 'Microsoft is selling custom tech support agreements that extend the life of Windows XP, although the cost can soar quickly—multiplying by a factor of five in the second year, says Korala. JPMorgan is buying a one-year extension and will start converting its machines to Windows 7 in July; about 3,000 of its 19,000 ATMs need enhancements before the process can begin...'"
This discussion has been archived. No new comments can be posted.

95% of ATMs Worldwide Are Still Using Windows XP More

95% of ATMs Worldwide Are Still Using Windows XP

Comments Filter:

  • Relevant XKCD (Score:5, Funny)

    by iYk6 ( 1425255 ) on Thursday January 16, 2014 @09:01PM (#45981517)

    https://xkcd.com/801/ [xkcd.com]

  • Price? (Score:5, Insightful)

    by mriswith ( 797850 ) on Thursday January 16, 2014 @09:02PM (#45981521) Homepage
    The cost of the support agreements, would still be less than the replacement of several thousand ATMs and internal systems. There is a reason why people do this, and it's not just lazyniess..

    • Re:Price? (Score:5, Interesting)

      by icebike ( 68054 ) on Thursday January 16, 2014 @09:41PM (#45981725)

      There is a reason why people do this, and it's not just lazyniess..

      Still, you would have thought they would have learned a few lessons by now.

      JPMorgan is buying a one-year extension and will start converting its machines to Windows 7 in July;

      Anything that can run Windows 7 could run linux.
      Anything that can run embedded Windows 7 would have no problem running linux.
      Or OpenBSD.
      You can replace the entire motherboard and processor with something 10 times as expensive as a Raspberry Pi for $350, and still save money over paying Microsoft extensions for every terminal.

      There will be several companies dragged before congress [nbcnews.com]. There have been multi-billion dollar losses. How many times do you have to let hackers make you their bitches before you cry uncle and at least look at a Linux solution?

      • Re:Price? (Score:5, Insightful)

        by anubi ( 640541 ) on Thursday January 16, 2014 @11:56PM (#45982431) Journal
        This whole affair of what platforms to use puzzles me greatly. I am of the opinion that the selection process has everything to do with politics and little to do with substance.

        I feel a lot of it has to do with a corporate mentality of holding everything blameless with contracts which have to be signed off on before the business will do anything. "Hold Harmless" seems the byword of the day.

        I have tried to use Micrium's uC/OS [micrium.com] products, based mostly on their certifications for mission critical affairs such as aircraft and life support [micrium.com]. For me, this thing is like a "Super Arduino" for embedded applications.

        Business will pay for people to play down everything the "leadership" type does not understand, and personal experience tells me that if I do not recommend Microsoft, I will not get the job. Regardless of my belief and experiences to the contrary. Its been my observation that once one gets high enough in corporate hierarchy, one is forced to play CYA, and the only way to play is find someone else to pin the blame on if things go sour - better yet be able to blame someone big - so the guy who hired them does not take the fall for it.

        There seems to be a trivial amount of effort expended to mitigate the probability of a breach in the first place.

        I am not trying to shill for Micrium - I just like their product and their philosophies of supporting an OS. It is all quite well documented [amazon.com] ( link to the book I use all the time ).

        NetBurners run this code. This had been the most robust system I have ever studied, yet I find few people who are willing to let me implement it - and for now it runs on a machine I have for my own edification.

        My own feeling if anyone wants to hack a bank ATM, go for it. No one's responsible, its just another ledger entry to the bank. If the thing gets too out of hand, the government will make it up to them.

    • Re:Price? (Score:5, Insightful)

      by turbidostato ( 878842 ) on Thursday January 16, 2014 @10:21PM (#45981931)

      "The cost of the support agreements, would still be less than the replacement of several thousand ATMs and internal systems."

      It won't. Is this extended support going to avoid XP from being replaced? I bet not. Therefore paying for the extended support *plus* replacing is certainly going to cost more than just replacing.

      "There is a reason why people do this, and it's not just lazyniess.."

      It *is* lazyness.

      The very day they started deploying XP they knew that would come to an end for the very reason they were using a closed-source license-based operating system.

      Paying through the nose now for something they knew it was coming but didn't nothing in time is the very definition of lazyness.

      • 'license-based' has nothing to do with it.
        They don't have to stop using the software, they just won't get free security updates.

        closed-source also has nothing to do with it.
        It it were open source, they'd need to hire staff to do the maintenance.

      • Re: (Score:2)

        by tftp ( 111690 )

        Is this extended support going to avoid XP from being replaced? I bet not. Therefore paying for the extended support *plus* replacing is certainly going to cost more than just replacing.

        That's not the case. XP-based ATMs probably run on a horribly slow SBC that has 512 MB of RAM (why to pay for more if the application does not need it?) The goal of this extension is simply to wait until existing machines reach their scheduled replacement dates. Then they will be scrapped. The new machines will be based

      • Re:Price? (Score:5, Insightful)

        by AmiMoJo ( 196126 ) * on Friday January 17, 2014 @06:13AM (#45984031) Homepage Journal

        Stop and think what using Linux would mean for them for a moment. They would have to pay hardware manufacturers to provide Linux drivers, or write their own. Those ATM NICs are proprietary and use certified encryption, so it's not even just a case of hacking some code together, it needs expensive certification as well.

        They would also have to employ some experts to do OS level support for them. They are not paying Microsoft for security patches, this is an embedded system. They are paying for technical support when they have issues. That cost would probably be close to what they would have to pay some Linux experts, and they wouldn't have any other company to blame when things went wrong.

        I'm not saying Windows is definitely a better solution, but Linux isn't as wonderful as you think either. No matter which one they picked they would have issues, but it an ancient Linux kernel that needs support or an ancient Windows kernel that needs support.

  • The Market? (Score:2, Insightful)

    by Anonymous Coward

    If there is that big of a market why is nobody selling/buying a replacement OS already? Particularly one cheaper than windows.

  • should have gone with a browser... (Score:4, Insightful)

    by johnjones ( 14274 ) on Thursday January 16, 2014 @09:07PM (#45981549) Homepage Journal

    I never understand why ATM's dont use HTML/SVG and then the OS is replaceable as a browser is the interface and a HTTP server security is well understood and network security would be part of a core competency

    thoughts ?

    john jones

    • Maybe they do now, but the ATMs in question are so old they are running a 12 year old OS. Do you happen to remember the state of HTML and web browsers 12 years ago? I'll give you a hint. They certainly didn't support SVG then.

    • Re: (Score:2)

      by DaHat ( 247651 )

      HTML/SVG tend to be sandboxed to some extent... ditto for JavaScript... how do you propose your HTML based ATM interact with the card reader, cash dispenser, receipt printer or deposit slot?

      ATMs are more than just a touch screen with a UI.

      • Re: (Score:3, Funny)

        by dantotheman ( 2887483 )

        Maybe they do now, but the ATMs in question are so old they are running a 12 year old OS. Do you happen to remember the state of HTML and web browsers 12 years ago? I'll give you a hint. They certainly didn't support SVG then.

        HTML/SVG tend to be sandboxed to some extent... ditto for JavaScript... how do you propose your HTML based ATM interact with the card reader, cash dispenser, receipt printer or deposit slot?

        ATMs are more than just a touch screen with a UI.

        ActiveX controls running in IE 7

        shiver...

      • Re: (Score:2)

        by icebike ( 68054 )

        I'd wager there is nothing in the typical ATM that a Rasbperry Pi couldn't handle.

        • Re: (Score:2)

          by deKernel ( 65640 )

          Then I would say you have wagered wrong. As I stated above responding some another persons uninformed opinion, the volume of crazy unique hardware in an ATM that you have to support might surprise you.

          • Re: (Score:3)

            by sjames ( 1099 )

            I'll bet the Windows7 install disk doesn't come with drivers for that crazy hardware either. If you're going to have to write the drivers anyway, the crazy hardware doesn't affect your OS choice.

      • HTTP server is local... browser is local !

    • Re: (Score:2)

      by ndykman ( 659315 )

      My eye is twitching from some strange reason.

  • Obvious choice I think (Score:5, Funny)

    by Mateo_LeFou ( 859634 ) on Thursday January 16, 2014 @09:07PM (#45981555) Homepage

    Windows XP is the only operating system stable & secure enough to handle sensitive transactions such as cash dispensing.

    • Brilliant!

    • Re: (Score:3, Insightful)

      by wvmarle ( 1070040 )

      Well, in a way you may be right. WinXP is so old and so well understood now, that pretty much all possible attack vectors are known and can be defended against. Knowing your enemy is important.

      Can't say that much of other OSes, like Linux or Win7. They are not as well known by ATM builders. And that's just the OS, not the software running on it and doing the actual work (interfacing with the user, with the bank, dispensing the money, etc), which would have to be rewritten from scratch (all of it, including

  • Windows.. (Score:5, Insightful)

    by nurb432 ( 527695 ) on Thursday January 16, 2014 @09:08PM (#45981559) Homepage Journal

    Is a bad choice anyway. Not just a Microsoft bash, but aside from all the security issues, windows is XP is a desktop platform, not a OS to be putting on dedicated devices ( even the so-called embedded version really isn't any more appropriate for this, don't let the marketing folks fool you )

    An ATM should be running off a custom embedded OS targeted for this purpose, not a commodity OS.

    • Re:Windows.. (Score:5, Insightful)

      by Em Adespoton ( 792954 ) <slashdotonly.1.adespoton@spamgourmet.com> on Thursday January 16, 2014 @09:15PM (#45981593) Homepage Journal

      An ATM should be running off a custom embedded OS targeted for this purpose, not a commodity OS.

      It is... it's called XP Embedded, as outlined in the summary. And yes, bank machines were a major target during XP Embedded's design phase.

      Of course, it would make MORE sense to use an embedded OS where the banks/ATM manufacturers have full access to the source.

      • Re: (Score:2)

        by alen ( 225700 )

        from what i read bank machines are a major target for a lot of software products being used today

      • Re: (Score:3)

        by Kjella ( 173770 )

        Of course, it would make MORE sense to use an embedded OS where the banks/ATM manufacturers have full access to the source.

        OS/2 had its heyday in the early 90s, ATMs used it way into the 2000s.
        XPe had its heyday in the early 00s, ATMs are using it way into the 2010s.
        Embedded Linux has its heyday now in the early 10s, draw your own conclusions.

        ATM vendors are extremely conservative, they tend to use platforms others already think are obsolete. They'll come along eventually, it's not like the cell phone market where you can flip the market upside down in 2-3 years.

      • Even WinCE is a slow as a wet dog thing that drives up the cost of hardware required if you need any sort of performance. These things are big and slow on limited hardware.
        Short term convenience and a perceived possibility of a reduced time to market won over utility with these things.

      • Re: (Score:2)

        by afidel ( 530433 )

        What makes you think the banks don't have full access to the source of XPe? Major companies, governments, and many academic institutions have access to the Windows source code. Trust me, anyone forking over the millions for an extended support agreement with MS can get access to the source if they need to.

    • Re:Windows.. (Score:5, Insightful)

      by erice ( 13380 ) on Thursday January 16, 2014 @10:47PM (#45982041) Homepage

      Is a bad choice anyway. Not just a Microsoft bash, but aside from all the security issues, windows is XP is a desktop platform, not a OS to be putting on dedicated devices ( even the so-called embedded version really isn't any more appropriate for this, don't let the marketing folks fool you )

      An ATM should be running off a custom embedded OS targeted for this purpose, not a commodity OS.

      Who is going to write, maintain, and keep secure this custom OS?

      The trouble with custom embedded OS's is that, in spite of the best intentions to limit their scope, they almost always need more features than can be written from scratch by a small team and be obviously secure. So they port code from more commodity OS's. Due to limited resources, the code in the embedded OS tends to fall behind. The porting effort can introduce bugs too that are non-obvious to the guy doing the port because he doesn't fully understand what he is porting.

    • Not just ATMs.... (Score:4, Interesting)

      by ub3r n3u7r4l1st ( 1388939 ) on Thursday January 16, 2014 @11:57PM (#45982439)

      Went to a hospital a week ago that was newly opened late last year. All workstations are the Lenovo all-in-ones with the Windows 8 sticker on it. Guess what operating system they are running on now .... Windows XP Professional (at least that's what the screen saver said.)

      I saw an IV infusion pump being rebooted by a nurse. I hear the famous chine of Windows XP shutting down.

  • yes, but... (Score:5, Funny)

    by Anonymous Coward on Thursday January 16, 2014 @09:14PM (#45981589)

    "95% of the world's ATM machines are still running Windows XP

    Yes, but what about the *automatic* ATM machines? Those are the ones I most am concerned about.

  • Go to 8 (Score:5, Funny)

    by cosm ( 1072588 ) <thecosm3@gma i l .com> on Thursday January 16, 2014 @09:15PM (#45981595)
    To hell with 7. Please put Windows 8 on the ATMs instead! I already love how ATMs do a wonderful job of selecting the wrong option for me after finally getting the card to take, only to then take me into the Spanish menu, spitting out a receipt, and then not accepting my card again while the line forms behind me! Metro can only enhance this lovely experience! Hell, add a kinect to it so when I flip it a golden salute it recognizes my input and doubles the ATM fee! Gotta keep up with the bank's great customer service these days!

  • Let's go one better... (Score:3)

    by djbckr ( 673156 ) on Thursday January 16, 2014 @09:16PM (#45981597)
    Is the dispensing software is written in Java? Half kidding, and wondering at the same time.

    • Re:Let's go one better... (Score:4, Informative)

      by Anonymous Coward on Thursday January 16, 2014 @09:40PM (#45981723)
      I worked for an ATM software development shop called Phoenix Interactive. The software we wrote was mostly C++, with some C mixed in to deal with updating the main software. The main ATM manufacturers (Diebold, Wincor, NCR) all only create Windows drivers (or did, 10 years ago when I worked there). The OS is locked down hard, while you may see the occasional blue screen, even if you had a keyboard plugged in you would not be able to stop the software from running or move it to the background without triggering a restart and a tamper alert back to the bank. Windows can be locked down just as well as Linux, it's just a royal pain in the ass to do so.

  • I throw this out there often (Score:5, Interesting)

    by TheRealMindChild ( 743925 ) on Thursday January 16, 2014 @09:20PM (#45981623) Homepage Journal
    As someone who has worked with Diebold, they have never have more than 3 programmers and they only use and have ever used Visual Basic. This is why their ATMs (and voting machines) are required to run Windows.
  • They chose the wrong two.
  • Yes, I am a Windows hating Linux user but the question is serious, not flame bait, why would they chose XP in the first place and why have they not moved to something else in the last decade?

    With real cash at stake I would have probably started with a minimal BSD OS and just added the minimal graphics, comms and I/O libraries needed to support the main application. I'm sure others here have their own ideas of the best OS, most excluding Windows?

    • Easy.

      Visual Basic 6 support for those all so awesome apps that can down an economy hired by Indians from Craigslist

    • Re:Why XP? (Score:5, Informative)

      by tftp ( 111690 ) on Friday January 17, 2014 @12:08AM (#45982475) Homepage

      why would they chose XP in the first place

      XP was a very good choice compared to Linux as it was 12 years old. Cost of Windows ($50 per copy?) was entirely immaterial. The important things were maturity, support, features, and toolchain. Linux in the year 2000 was light on those. Where in Linux's Event Viewer is the Security Log? How many objects can be audited in Linux? In NT - a lot, and it all was available immediately. In the toolchain department even today autotools give you a horrifying experience compared to MSVC.

      Developers of ATM took the most complete foundation for their work (the OS) and then added what was custom. If they started with Linux, or BSD, or DOS, they'd have to add far more - and the more you write yourself the more you have to maintain. If they started with Linux that would be kernel 2.0.x - and today we are on 3.x, with gigabytes of patches applied to libc and other essential components of the system. It would be extremely difficult to upgrade and maintain.

      and why have they not moved to something else in the last decade?

      Who is going to pay money for fixing what isn't broken? It's not broken even today, that's why they want to keep the machines running. It's pretty expensive to send engineers to tens of thousands of ATMs to upgrade them, since doing it remotely might be too scary. The hardware also probably went through ten revisions, so each ATM runs its own set of drivers that were customized to the hardware that is installed. Your upgrade task would require you to support all that old hardware - and that is a dead end job. Better to just keep the thing running until it falls apart, and then replace it.

  • JP Morgan (Score:4, Interesting)

    by Nethead ( 1563 ) <joe@nethead.com> on Thursday January 16, 2014 @10:45PM (#45982025) Homepage Journal

    About two years ago I was a field tech and would get service calls to JPMS. Most of the time it was just to move fax machines around or to make a jack live. Sometimes it was to try to get a PC to boot. There is SO much legacy cruft in the boot image of a JPMS desktop that it can take three boots just to get the damn thing stable. Some of the boot code even flashes by "DOS TCP/IP 1.0" as it goes by. They have decades of cruft to dig through to get those things anywhere modern. I have pity for the admins trying to roll this out, I really do.

    On the other hand that damn image is used by hotshot investment brokers to transact multi-million dollar trades everyday. That image is a lot of their "secret sauce" that they use to make a shit load of cash. It's a tool that has made them trillions. I can see why they don't want to fuck with it. They would gladly have me hang around for a day at a few hundred dollars an hour (not that I was seeing 20% of that) just to make sure the hotshot could do his job. The hotshot's downtime cost them thousands of dollars an hour. Imagine having to roll out an image to 1000 hotshot desktops and have it fail for even a day.

    That's a lot of incentive to keep the boat from rocking, whatever the cost.

    Remember that a lot of that legacy code is interfacing with mainframes that are running code before the advent of PCs.

  • Windows 7 EOL will start LOL.

    That's what you get for waiting until the last minute. Many corps won't see it as a 8 year old OS but a 3 year and will throw hissy fits like the XP ones are now

    • Re: (Score:2)

      by afidel ( 530433 )

      Windows 7 embedded is supported through July 27, 2025, that's one reason these kind of applications have flocked to MS, they offer longer support than even IBM for a given OS release.

  • I believe MSMQ is used in banking a lot, and I wouldn't be surprised if it is used in ATMs, due to its robustness. AFAIK, there is no *NIX port for it.

  • Blame IBM for killing off OS/2. I worked for one of the major banks and years after OS/2 died they were still running it because the main teller software ran on OS/2 and the company that created it rufused to port it to anything else.

    The govenment monitors the banking banks and if someone came up with Linix ATM software that could pass govenment regulations and a ease migration path you'd probably see a mass move from XP to Linux. Because the banks what one does most the other do.

  • JPMorgan is buying a one-year extension and will start converting its machines to Windows 7 in July; about 3,000 of its 19,000 ATMs need enhancements before the process can begin...

    Um... Start converting 4 months after XP goes EOL? Did they *just* find out about the deadline? And why can't they start upgrading the other 16,000 systems? I'm pretty sure XP and 7 systems can be operated together...got one of each in my office - for testing.

Slashdot Top Deals

"What man has done, man can aspire to do." -- Jerry Pournelle, about space flight

Close