End of Windows XP Support Era Signals Beginning of Security Nightmare 646
colinneagle writes "Microsoft's recent announcement that it will end support for the Windows XP operating system in two years signals the end of an era for the company, and potentially the beginning of a nightmare for everyone else. When Microsoft cuts the cord on XP in two years it will effectively leave millions of existing Windows-based computers vulnerable to continued and undeterred cyberattacks, many of which hold the potential to find their way into consumer, enterprise and even industrial systems running the latest software. Although most of the subsequent security issues appear to be at the consumer level, it may not be long until they find a way into corporate networks or industrial systems, says VMWare's Jason Miller. Even scarier, Qualsys's Amol Sarwate says many SCADA systems for industrial networks still run a modified version of XP, and are not in a position to upgrade. Because much of the software running on SCADA systems is not compatible with traditional Microsoft OS capabilities, an OS upgrade would entail much more work than it would for a home or corporate system."
Re:release the source? (Score:4, Informative)
"Why not liberate the source?"
Maybe because there is XP code still in Vista and later versions?
Maybe because it would just encourage the people who are still using XP to continue using the "Open Source" version?
Re:release the source? (Score:5, Informative)
My comment is based on experience, not supposition.
Re:What about XP mode in Windows 7 (Score:5, Informative)
Is Windows XP Mode supported throughout the lifecycle of Windows 7?
No. Windows XP Mode is a full virtual version of Windows XP and follows the same support lifecycle as Windows XP. Windows XP extended support phase ends in 2014.
Unfortunately IE6/7/8 will live on and I have nightmares that we will be supporting them until 2038...
Re:Well... (Score:5, Informative)
I agree, the 14 years was pretty generous.
When XP was originally released, I was running some SuSE 7.x version. The first 7.x version was released in september 2000. The last 7.x version went end-of-life in december 2003, meaning a support span of 3 years and 3 months. Fedora has something like a thirteen month support span, depending on the release date of version x+2. Only RHEL appears to be supported for 10 years.
There is one big difference: all Linux distros release a new version every 1-2 years. The next windows release took 6 years, but the next windows release that was really usable in companies took a few years more.
Re:release the source? (Score:4, Informative)
Yeah. Besides, why is he slashdotting from work at 3:34AM?
Because the slashdot timestamping system does not stamp posts with your local time. I posted something just afer 14:00 hours yesterday, it is timestamped 7:22PM.
Re:Well... (Score:5, Informative)
I'm also sure that a lot of those embedded and industrial systems will be updated before then.
I'm very sure a lot of those WON'T be upgraded. Those that do need to pass several barriers:
1. Manufacturer needs to provide an updated system.
2. The system needs to be able to be taken down for maintenance. I know some industrial plants have an 8 year maintenance shutdown cycle.
3a. You need the motivation to upgrade. Security holes in an OS is not motivation, the vendor will have to EOL the entire system before most people will move.
3b. If the entire system isn't EOL'ed the vendor will need to provide an OS / interface update for their existing system. Seeing a vendor provide a partial update like this is rarer than rockinghorse poo. Assuming they have the motivation and capability to do it, some systems need to pass certification as well which they often don't think is a justifiable expense.
4. Speaking of justifiable expense an upgrade like this would involve stripping all I/O out of the old control system, replacing the system itself, recommissioning and loop checking, and then testing the software. Often the time constraints for such an activity is measured in days not weeks. It's a big and very labour intensive job, not to mention expenses will run in the hundreds of thousands. That's a LOT of money for maintaining the status quo.
Basically I guarantee there'll be plenty of embedded and industrial systems running on Windows XP for many years to come. How do I know? Well currently there are plenty of embedded and industrial systems running on Windows NT4 as well. We have about 8 such systems at our plant. One of them at least gets upgraded "soon". Windows NT4 was EOLed in 2004, the PLC was EOL'ed in 2007, we received approval from the corporate bigwigs for the upgrade last year, and the next scheduled shutdown is 2017. Fun fact, we buy old PCs capable of running Windows NT4 from our employees and have about 10 of them in storage, just in case.
Although it could be worse, one plant in my city runs a PLC from the same vendor as the one above which is a version older still. Their attached PCs run DOS.
Re:release the source? (Score:3, Informative)
It can take five to ten years (or in some cases I have seen, 20 years) to replace an embedded SCADA system.
Which is a good argument for not using Windows(tm) in any form for industrial control, but that argument was apparently lost in the late 1990s.
sPh
Re:release the source? (Score:5, Informative)
You obviously don't know much about SCADA systems. They are proprietary, top to bottom. And there are reasons for this that do make sense.
First of all, let's look at the whole picture of a SCADA implementation...in this example, I'll talk about the systems that control and analyze the burn inside a coal-fired power generation facility that uses coal to heat water into steam which then drives a turbine; this is the kind of power plant that produces most of the power in our country. (I'm in the United States, for context there.) The systems are analagous to the ECU of a car with a fuel-injection engine, both controlling the delivery of fuel and air while monitoring the effects of those controls in the context of the demands being placed upon the boiler. Just as with a car engine, there is lag in making changes to the burn, just as an engine has delay when you step on the throttle.
There are many devices involved...gas sensors, temperature sensors, lasers...and all of them are purpose-built by the company that makes the control system; they are proprietary. The protocols that are spoken between devices are usually open, like DNP3 or modbus, but the data schemas that are used are also proprietary (most ICS protocols are pretty soft, working more like a layer 6 protocol than a layer 7). The logic that drives decisions, reporting, and the translation of human interaction into discrete behavior by control devices? Also proprietary. The control systems are built by the same company to work end-to-end on that specific type, size and model of boiler, and the whole thing is tested as a unit. For the most part, the notion of modularity...the way that you could replace a Cisco firewall with an equivalent Juniper firewall, or replace an EMC SAN with a NetApp SAN...does not exist in any way whatsoever. (It does in small ways, but even then most manufacturers will refuse to support the system if you so much as change the IOS image on a Cisco switch without it having been tested first, which takes about 6 months for a full facility and requires that it be offline the whole time.)
The complexity of these environments...and the ramifications of improper behavior by any one component...cannot be overstated. So, it's essential from a legal standpoint to have entities backing the pre-manufactured components who can be held accountable should it be necessary. I know, you can't sue Microsoft for software bugs, but you can't look at their behavior over the past 15 years and tell me that there wasn't an effective motivation to improve security. They've dramatically improved the security quality of Windows, while rolling out and evolving a patching system that is now the gold standard for software companies. They have something to lose from producing an unreliable product, even if that loss does not come in the form of a lawsuit. And after seeing what Oracle has done to mySQL and Java, it's not hard to see the potential for disaster if you rely on an open-source project that may have to fork because their patron got acquired, as well. An even scarier possibility is what Tenable did with Nessus when they forked and closed the source, ending support for the older OSS version.
One more thing...this isn't a website we're talking about. It's a power plant. When things go wrong in these environments, it isn't just embarassing. People often die. At one plant I've done work at, a mistake caused a ~300 KV transformer to detonate. Oversimplifying the situation, the power ended up flowing the wrong way, and the transformer's cooling spaces (filled with oil) exploded in a BLEVE, showering the nearby parking lot with flaming oil. It was a Michael Bay-like situation; I saw the pictures that were taken while the fires were still burning. A mistake involving the boiler can cause the flame to collapse resulting what they call a "beer can," when the fire suddenly goes out and the inside of the boiler cools so rapidly (in a matter of seconds, or less) that it crushes itself. This is not a small thing...the walls
Re:what's the difference (Score:5, Informative)
Rather than saying they have different release cycles you should be saying they have different release methodologies or software life cycles. Apple apparently supports two releases back (searches for "apple software life cycle" only result in forum posts asking the same question), while Microsoft has defined support periods that are generally quite long. Microsoft's approach is important for people who intend to incorporate Microsoft's products into their business processes. Apple's approach is (marginally) acceptable for consumer products.
Apple releases new versions that don't have substantial backward compatibility guarantees about as often as Microsoft releases service packs that do make an emphasis on backward compatibility.
As far as comparing between the two -- in my experience having two macs, a first gen apple tv, an ipod, a couple of iphones and an ipad and five windows boxes running XP, Vista and 7 -- windows service packs frequently deliver not only rolled up bug fixes, but new functionality similar to the kinds of new functionality that you'd find in Apple OS X releases.
Fundamentally Microsoft does a much better job of supporting prior generation platforms than Apple does by far. Hell, Apple, as near as I can tell, obsoletes products just because.