Become a fan of Slashdot on Facebook

 


Forgot your password?
Close
typodupeerror
×
United Kingdom Windows Microsoft Operating Systems Privacy Security Software The Military

Britain's Newest Warship Runs Windows XP, Raising Cyber Attack Fears (telegraph.co.uk) 302

Posted by BeauHD from the outdated-operating-systems dept.
Chrisq shares a report from The Telegraph: Fears have been raised that Britain's largest ever warship could be vulnerable to cyber attacks after it emerged it appears to be running the outdated Microsoft Windows XP. A defense source told The telegraph that some of the on-board hardware and software "would have been good in 2004" when the carrier was designed, "but now seems rather antiquated." However, he added that HMS Queen Elizabeth is due to be given a computer refit within a decade. And senior officers said they will have cyber specialists on board to defend the carrier from such attacks.
This discussion has been archived. No new comments can be posted.

Britain's Newest Warship Runs Windows XP, Raising Cyber Attack Fears More

Britain's Newest Warship Runs Windows XP, Raising Cyber Attack Fears

Comments Filter:

  • Makes sense to me (Score:5, Funny)

    by alvinrod ( 889928 ) on Tuesday June 27, 2017 @07:48PM (#54701937)
    It makes sense to me. Where else are they going to get minesweeper?

    • The MoD has lied ! (Score:5, Interesting)

      by Mosquito Bites ( 4975333 ) on Tuesday June 27, 2017 @11:07PM (#54702707)
      This is serious !

      Back in 2015 the MoD declared that this vessel would be 'Windows-XP Free'

       Read the article below if you do not believe ---

      https://www.theregister.co.uk/... [theregister.co.uk]

      • However, he added that HMS Queen Elizabeth is due to be given a computer refit within a decade.

        What's the fuss about? In 2027 this warship will be up-to-date with bleeding edge Windows 10. Oh wait...

        • Re:The MoD has lied ! (Score:4, Funny)

          by stealth_finger ( 1809752 ) on Wednesday June 28, 2017 @04:54AM (#54703505)

          However, he added that HMS Queen Elizabeth is due to be given a computer refit within a decade.

          What's the fuss about? In 2027 this warship will be up-to-date with bleeding edge Windows 10. Oh wait...

          Until it decides to update in the middle of a battle.

        • Re: (Score:2)

          by Meneth ( 872868 )
          If Microsoft's new strategy holds, of releasing update packs instead of new major versions of Windows, then your prediction might very well come true.

        • Re: (Score:3)

          by rtb61 ( 674572 )

          Why bother fussing with anything at all. The vessel has largely served it's purpose, spending 3.5 billion dollars on the military industrial complex. It was designed to be built 'out of date' so a life time of upgrade cycles will be required which will preferably eclipse the 3.5 billion spend, more profits, fuck infrastructure, fuck social services, war, war, war. It matters not one iota how well it works, just how much corporate profit it can generate. The floating version of the F35 Flying Pig, destined t

    • This is what you call a big floating disaster.

  • Cyber specialists (Score:5, Insightful)

    by manu0601 ( 2221348 ) on Tuesday June 27, 2017 @07:49PM (#54701941)

    they will have cyber specialists on board to defend the carrier from such attacks

    They are supposed to defend unsupported proprietary software. The right name is not cyber specialist, but rather priest.

    • Re:Cyber specialists (Score:5, Interesting)

      by NotInHere ( 3654617 ) on Tuesday June 27, 2017 @08:12PM (#54702045)

      This is the most ridiculous part of the whole story. They think that some people at the board of the carrier can fend off attacks. They believe that it can be solved by like a local scale problem, like aircraft attacking the carrier. So they think they can solve it by people on board specialized to protect you, like they probably have someone on board to operate the anti aircraft cannon.

      These attacks aren't local scale though. They are global scale. Vulnerabilities in Windows XP get discovered by someone at the other side of the globe and get used against you. Similarly, a patch to fix a vulnerability in Windows XP can be developed once and then applied locally. And in the case of a total and complete hack during the heat of a battle, even the best team on board won't help them to get the systems back up before the battle finishes.

      • Re:Cyber specialists (Score:4, Insightful)

        by Jamu ( 852752 ) on Tuesday June 27, 2017 @10:12PM (#54702537)
        I'm sure you're mistaken, Michael Fallon, Conservative MP, drunk driver, and graduate in Classics and Ancient History, says they're properly protected.

      • Re:Cyber specialists (Score:5, Funny)

        by deek ( 22697 ) on Tuesday June 27, 2017 @11:09PM (#54702713) Homepage Journal

        They need someone there to change the lightbulb to red, whilst a cyberattack is in progress.

    • Re:Cyber specialists (Score:5, Funny)

      by Gravis Zero ( 934156 ) on Tuesday June 27, 2017 @08:18PM (#54702073)

      The right name is not cyber specialist, but rather priest.

      Oh please, don't be an idiot. The government isn't dumb enough to rely on just some priest. For the money they are paying out, they are going to at least demand a cyber priest. ;)

    • Re:Cyber specialists (Score:4, Insightful)

      by Darinbob ( 1142669 ) on Tuesday June 27, 2017 @09:46PM (#54702427)

      It's outright scary that they would consider using a Windows of any version. Can you see them on Windows 10 and just as they engage with the enemy all the computer screens say "Restarting to Install Advertising Update. Please Do Not Power Off Your Computer."

      • Indeed. It didn't make sense in 2004, because the EOL for Windows XP was known to be far closer than the expected lifetime of the ship. Would they buy guns or an engine for the ship where the vendor announced that they'll stop making compatible spare parts in under a decade? Off-the-shelf consumer software is entirely inappropriate for this kind of deployment. If the vendor won't give you a support contract for 20 years, it's completely inappropriate (after 20 years, you probably want to do a refit, so

    • Re:Cyber specialists (Score:5, Informative)

      by Xest ( 935314 ) on Wednesday June 28, 2017 @01:56AM (#54703103)

      They don't just take an off the shelf copy of Windows XP and install it on the ship, companies like BAE systems have agreements with Microsoft over source code access and provide hardened versions to their customers.

      Thus, the unsupported and proprietary elements of consumer Windows XP are entirely irrelevant - they both pay for bespoke extended support from Microsoft, and they have source code access themselves.

      Whilst there are legitimate questions about using Windows XP for a brand new ship, it's not quite as bad as "OMG they use Windows XP lol" type headlines and comments make out. The reality is that they have support for and source code access to perhaps the single most tried and tested OS in the world. Lines of communication and inputs into the systems are both limited and restricted, and thus any vulnerability discovered against XP in the real world will likely be fixed and patched on a ship well before anyone can find a way of getting the exploit onto the ship's systems.

    • What makes you think it's unsupported? Microsoft still supports XP if you pay for it.

  • And the navigation... (Score:5, Funny)

    by Vylen ( 800165 ) on Tuesday June 27, 2017 @07:56PM (#54701967)

    ... control system is assisted by Clippy.

  • that crash's when you enter zero into the data field for the Remote Data Base Manager

  • Ransomware writers around the world are salivating.

    Seriously who would make such a boneheaded decision?

    • Maybe the sort of bonehead who can't make it all the way through the summary in order to discover the system was provisioned many years ago?

      • You're right. After all, when Windows XP came out Microsoft had a pristine security history from MS-DOS 3 to Windows 98.

        • Re: (Score:2)

          by quenda ( 644621 )

          You're right. After all, when Windows XP came out Microsoft had a pristine security history from MS-DOS 3 to Windows 98.

          That does not really count as XP is based on NT, not DOS as win-98 was. But still, Microsoft.
          Such a choice does not inspire confidence in the technical competence of the decision makers. Are they really using Windows for the combat systems?

        • Well of course, we know those are insecure. But Windows 10 is perfect! It will stay perfect until there's a later release. But wait, they'll never have another Windows version, ever, so it should stay perfect forever!

          You can run your coffee makers on Windows, but if it's mission critical you don't want to go anywhere near Microsoft software.

        • When it was commissioned, Microsoft had publicly stated the EOL for XP was 2009. They pushed it back a few years afterwards when people hated Vista. Designing in an OS that would not be getting security updates by the time the ship was scheduled to launch (even if it hadn't been delayed) was dangerously negligent.

  • HMS Brixit (Score:3, Funny)

    by Anonymous Coward on Tuesday June 27, 2017 @08:04PM (#54702005)

    "And senior officers said they will have cyber specialists on board to defend the carrier from such attacks."

    ALL UNPLUG FULL!

    Answering all unplug full aye!

  • This is crazy (Score:5, Interesting)

    by El Cubano ( 631386 ) on Tuesday June 27, 2017 @08:05PM (#54702011)

    Every military appears subject to the same idiocy. Seriously, you are spending literally billions of USD, GBP, or EUR (I tried to use the actual symbols for GBP and EUR, but I forgot about Slashdot and unicode). You can't spring a few million for a custom built or customized (e.g., based on OS/2, QNX, VXWorks, Linux, etc.) OS that has all the networking and other non-essential components removed? Then you can allow network access via a very tightly controlled and well audited interface.

    The main reason, I think, for this conundrum is that there are two competing objectives: 1) extremely rigorous system engineering processes with the attendant configuration control; 2) use more COTS and fewer custom components. For instance, those decisions were definitely made over a decade ago and any change to them would require tons of paperwork, additional certification, and also add to the cost and delay the schedule. It's no wonder they just stuck with what was already approved.

    That said, I simply cannot believe that one or more of the big defense firms (e.g., BAE, Lockheed-Martin, Boeing) has not come up with something better than slapping Windows on it.

    Now, I know (or rather, I truly hope) that things like navigation, fire control, and other critical ship functions are not dependent on any Windows (or other consumer OS). However, I know that some years ago the US Navy had a "Windows-power ship" end up dead in the water and had to have it towed back to port. That was the result of a divide by zero bug in some piece of software but Windows did not handle it gracefully, if I recall correctly.

    Either way, they will be lucky if they don't end up with some very serious problems along the way. It seems like it is just not possible to keep ransomware out of any decently sized network. And I can imagine a major world power's flag ship being a tempting target.

    • $ € £ What's the issue?

    • Re: (Score:2)

      by AHuxley ( 892839 )
      All the people at the port are trusted and totally and fully vetted. The crew is totally trusted by default.
      The buddy system always ensures nobody can use their own computer from home they took with them.

      What could another nation or faith group do?
      Sign up an unexpected person to go for ship education, become a sailor and then rise up the ranks for years?
      One spy on a ship? The buddy system would totally prevent that. Two spies on average would not get to work alone together given the crew size so
      • The spy doesn't need to bring their own computer, they just need to find an exposed USB port and plug in a malicious device smaller than a thumbnail to an device on the ship network. Want to bet that there are exposed USB ports for routine maintenance?

  • As opposed to... (Score:5, Insightful)

    by xlsior ( 524145 ) on Tuesday June 27, 2017 @08:05PM (#54702015)
    ... Windows for Warships? (Seriously, that exists) Anyway: despite windows XP's age Microsoft will still actively support it for organizations willing to send them a boatload of money, and the rates only go up the more time passes. But when you're talking about the operating costs of a large warship, the cost for continued xp support is only a rounding error in the total.

    • ... Windows for Warships?

      (Seriously, that exists)

      Anyway: despite windows XP's age Microsoft will still actively support it for organizations willing to send them a boatload of money, and the rates only go up the more time passes. But when you're talking about the operating costs of a large warship, the cost for continued xp support is only a rounding error in the total.

      I LOL'd We have an aircraft carrier running NT.
      "The data contained a zero where it shouldn't have, and when the software attempted to divide by zero, a buffer overrun occurred – crashing the entire network and causing the ship to lose control of its propulsion
      system. https://www.wired.com/1998/07/... [wired.com]

  • That's depressing, it's such old news (Score:4, Interesting)

    by Anonymous Coward on Tuesday June 27, 2017 @08:09PM (#54702025)

    The last time I recall the Navy being concerned about running Windows was maybe 15 years ago. The LinuxBIOS project attracted a lot of attention from some Navy guys because of its rapid reboot capability.

    At LANL, LinuxBIOS researchers could reboot a small (1K diskless compute nodes connected via Myrinet) scientific computing cluster in 3 seconds, ready for work. So, theoretically, one could change from a Linux cluster to a Windows cluster, but no one ever wanted to.

    Whatever became of that technology?

  • Is there even a word for this level of stupidity? (Score:5, Insightful)

    by JustNiz ( 692889 ) on Tuesday June 27, 2017 @08:09PM (#54702029)

    The die-cision to use anything from Microsoft in a mission-critical environment, let alone a 16+ year old OS with a giant list of known exploits goes so far beyond amazingly stupid I can't even find the words.

    • Is there even a word for this level of stupidity? The die-cision to use anything from Microsoft in a mission-critical environment, let alone a 16+ year old OS with a giant list of known exploits...

      I believe the word you're looking for is "congressional". ;)

    • The die-cision to use anything from Microsoft in a mission-critical environment, let alone a 16+ year old OS with a giant list of known exploits goes so far beyond amazingly stupid I can't even find the words.

      Can you name a single known exploit that applies to this ships XP systems as deployed?

      • Re: (Score:2)

        by JustNiz ( 692889 )

        Just fucking google it. There are large numbers of unpatched XP exploits. Microsoft themselves even admit the entire OS is fundamentally insecure and will never be fixed. They even said the same thing about Win 7 as soon as they wanted you to buy Win 8.

        • Re: (Score:2)

          by JustNiz ( 692889 )

          Here's a start:
          https://www.cvedetails.com/vul... [cvedetails.com]

        • Just fucking google it. There are large numbers of unpatched XP exploits. Microsoft themselves even admit the entire OS is fundamentally insecure and will never be fixed. They even said the same thing about Win 7 as soon as they wanted you to buy Win 8.

          The existence of exploits is different from question of which exploits are applicable to XP systems as actually deployed on this ship.

        • I googled, could not find a single exploit that applied to the isolated systems of warship. perhaps you can point at some?

    • Re: (Score:2)

      by AHuxley ( 892839 )
      Think of it from a UK mil perspective.
      They have to find people to use the computer GUI. Make a bespoke UK OS? Thats a lot of new computer tasks to learn and teach to average people new to the navy.
      Trying to keep people in the navy is not helped by some strange, new, expensive, complex new UK mil OS.
      No need to teach the users how to write code in something like a new Ada to do GUI things.
      That keeps teaching costs lower and makes teaching methods for new crews more easy. Just like a really big hom

  • Anyone over there watch the IT crowd?

    Moss: "What kind of operating system does it use?"

    Bomb squad: "Vista!"

    Moss: "We're going to die!"

  • ... has managed to develop their own QNX based base operating system to ensure safety & security. They've also been doing it for a couple decades.

    It seems insane that the Royal Navy & BAE systems couldn't figure this out themselves. This has the smell of a kickback based sales agreement to me. Almost any other operating system is a better choice simply because they are smaller attack targets than any version of Windows.

    • It seems insane that the Royal Navy & BAE systems couldn't figure this out themselves. This has the smell of a kickback based sales agreement to me. Almost any other operating system is a better choice simply because they are smaller attack targets than any version of Windows.

      When your adversaries are other nations security by obscurity is especially inoperative.

      • Re: (Score:2)

        by dbIII ( 701233 )

        It seems insane that the Royal Navy & BAE systems couldn't figure this out themselves. This has the smell of a kickback based sales agreement to me. Almost any other operating system is a better choice simply because they are smaller attack targets than any version of Windows.

        When your adversaries are other nations security by obscurity is especially inoperative.

        Security by installing a system designed to be secure is the idea - there are many. Even MS had one with WinCE that is far more up to date than WinXP.

  • That's not all. (Score:5, Interesting)

    by Gravis Zero ( 934156 ) on Tuesday June 27, 2017 @08:41PM (#54702171)

    The Register in 2009 [theregister.co.uk]

    According to the Ministry of Defence (MoD), HMS Montrose has now entered a planned docking and refit period during which BAE Systems plc will replace her original DNA(1) gear with DNA(2), said to be "based on the system being fitted to the Royal Navy's powerful new Type 45 Destroyers". This means it will be based on fairly everyday hardware running legacy Windows OSes - people who have worked on these programmes inform us that both Win2k and XP will be in use across the fleet.

  • The U.S. nuclear fleet still runs on Microsoft Bob.

  • I'd love to see the on boar systems they mention.
  • this hit fark a good 12 hours ago.

    That said, I don't get the thinking here. WinXP is old, outdated, and insecure. If you don't want Win10 or whatever you've got linux, along with several modern RTOS's. Hell, rolling your own is probably better than WinXP.

    If you've got a CNC machine, or bioassay device, or whatever, it's fine. As long as the internet can't find it. Soon as the $bad_guys find it, game over.
  • Just imagine if this was on one of their submarines and someone opened a Window while they were submerged. Talk about a crash dive.

    Mind you, this is from the same country that bought you flammable warships during the Falklands war.

  • The last thing you want to see in naval warfare:

    Your cruise misses have been encrypted. Do not bother trying to decrypt your cruise missles as they can only be decrypted by us. Send ${YOOGE_BITCOIN_MONIES} to our friendly decryption service to decrypt your cruise missles.

  • "senior officers said they will have cyber specialists on board to defend the carrier from such attacks" translates to "they have the original installation floppies standing by".

  • Can't wait for the headlines (Score:5, Funny)

    by nospam007 ( 722110 ) * on Wednesday June 28, 2017 @01:49AM (#54703099)

    "Warship sunk by fat Russian boy on the couch of his mother's basement."

    • "Warship sunk by fat Russian boy on the couch of his mother's basement."

      You forgot to end it with, "Sad!"

  • The Register reported in 2015 that "Britain's new Queen Elizabeth-class aircraft carriers will be Windows XP-free zones". Later in the article,

    The MoD can confirm that Windows XP will not be used by any onboard system when the ship becomes operational,” the spokesman added. “This also applies to HMS Prince of Wales.

    Article is here: https://www.theregister.co.uk/... [theregister.co.uk]

  • The fact it's connect to the INTERNET is the height of stupidity. If it wasn't it would matter all that much what OS it uses...

  • Old joke: What does a navy pilot have in common with an internet junkie?

    Both break out in cold sweat if their display shows NO CARRIER

  • The U.S. Navy develops Tor and the Airforce, as well as several other agencies use LPS to log into places. You'd think the UK navy would be smart enough to not use Window$ anything. But, this is coming from a country that wants backdoors in everything. One country's bug is another country's feature, I guess.

  • Pretty simple (Score:3)

    by backwardsposter ( 2034404 ) on Wednesday June 28, 2017 @08:59AM (#54704397)

    A lot of people keep calling this stupid, but it's actually pretty simple. The design started back in 2004. When you're working a rigid project like this, things get locked in once approved, like design and technology. If you postponed even whenever a new Windows came out, you'd have to go back, have a new CONOPS, new requirements, and start all over again and the project would never finish. Yes you'd get to reuse a lot of the previous architecture, but just think about it. If you're running the program, and software people tell you they're going to just use a new OS, you have a whole host of new things to think about.

    And in the government, hardware tends to drive software, so software is constantly trying to keep to the same milestones. And believe me, once you've tested, NOBODY wants to think about switching OS and libraries now. Throw in a few of the typical delays that come in the government, (funding/changing of the guard, etc...) and this all makes sense.

    So stupid? That's not really the issue here. It's choosing between a rigid process, that can't afford to do things quickly and is very risk averse...or finishing quickly. The most common mitigation to this issue is to include an update later, with newer Windows and some regression testing. You can't really win with the public these days anyway...imagine if they pushed it out quickly and the report instead said that there was a malfunction because it was a rush job. These days, you're damned if you do (spend a lot of money but this is what we get) and damned if you don't (rush job leads to malfunction leads to public embarrassment).

Slashdot Top Deals

news: gotcha

Close