London's Metropolitan Police Still Running 27,000 Windows XP Desktops (thestack.com) 166
An anonymous reader writes: London's Met Police has missed its deadline for abandoning the out-of-date operating system Windows XP, as findings reveal 27,000 computers still run on the software two years after official support ended. Microsoft stopped issuing updates and patches for Windows XP in Spring 2014, meaning that any new bugs and flaws in the operating system are left open to attack. A particularly risky status for the UK capital's police force – itself running operations against hacking and other cybercrime activity. The figures were disclosed by Conservative politician Andrew Boff. The Greater London Assembly member said: 'The Met should have stopped using Windows XP in 2014 when extended support ended, and to hear that 27,000 computers are still using it is worrying.' As in similar cases across civil departments, the core problem is bespoke system development, and the costs and time associated with integrating a new OS with customized systems.
It's not as simple as "just switch over" (Score:5, Insightful)
Re: (Score:2)
Re: (Score:2)
Years to plan, but generally when you have no budget the planning is pointless. These are not like corporations where expenses are approved with a rubber stamp.
Another issue is that this "planning" often happens at the IT level, which over time has become more insular and disconnected from the larger organization they're supposed to be working with. So plans come down as directives or orders, "do as we say" rather than "let us help you".
Re:It's not as simple as "just switch over" (Score:5, Funny)
[[and they can always leave a few isolated XP boxes up to support laser engravers and the like.]]
Not if they have software or hardware has to have a network connection for 3rd party licensing purposes. .
That's the future for Windows 10. Your network goes down, you don't just lose your "cloud", but the ability to do pretty much anything. They'll make sure they keep a local cache of the start menu ads, "for your convenience during the interruption of service."
Re: (Score:2)
We remove them from the domain, use local firewall to block all but needed ports, stop the server service and block outbound communications to the Internet at the firewall.
Apart from removing them from the domain, surely that is what you should be doing for all your computers no matter what OS they use? I do this even on my home systems - block everything and only allow what I want to access the world, not what the developers want.
Re: (Score:2)
It the London Metropolitan Police the same as the police for the "City of London"? If so the problems couldn't happen to a "nicer" bunch of guys.
Re: (Score:2)
Seems unlikely they would have 27,000 PCs with hardware that isn't supported by Windows 7, and if they do it would make sense to get a driver created for it. More likely it's just their usual incompetence.
It's going to bad when the first copy of the Police's national database is stolen. It's got a lot of information about not just criminals, but everyone they come into contact with. Biometrics, photos, suspicions, unproven allegations, random comments... And they are relying on XP to keep it safe.
Re: (Score:2)
Seems unlikely they would have 27,000 PCs with hardware that isn't supported by Windows 7, and if they do it would make sense to get a driver created for it. More likely it's just their usual incompetence.
Go down to your local underfunded hospital. There's lots of old hardware floating around that are just chugging away doing their jobs even though you wouldn't want to run anything more modern on them, like something that requires more than 32 megs of ram.
Re: (Score:2)
Re: (Score:2)
As someone who is on the tail end of a 700 computer migration from WinXP to Win7, I feel their pain. A single critical program that won't run on Win7 can be a showstopper. Not to mention special hardware for which no Win7 drivers are available - all of a sudden that $120 upgrade cost for a Win7 license became $25,120 when you include the cost of a new laser engraver.
Since I'm going to assume that not every computer in your organization has a laser engraver attached to it, I'm thinking that a moderately-built Win7 machine running a virtual XP environment under VMWare Workstation would likely be far less than $25,000.
Then you lock down that virtual XP environment where it does not talk to anything other than the laser engraver. Perhaps you have not removed the issue altogether, but you've certainly taken considerable steps to insulate risk by keeping the unsupported OS
Re: (Score:2)
VMware Workstation can't do PCI Pass through so if that laser engraver needs an custom card then no. It can do true serial pass through? use an usb one as real one?
Switching to Linux is much simpler (Score:4, Funny)
JUL
Linux Rocks
Re: (Score:3)
Re:It's not as simple as "just switch over" (Score:4, Informative)
And of course, it's possible to get malware inside the Virtual PC. So now we're looking at two antivirus licenses per computer.
Re: (Score:2)
Then write some custom software/scripts to allow those functions to pass through to the parent machine. SysAdmin isn't meant to be a walk through the park. Use a little bit of ingenuity to make the workflow smooth.
Re: (Score:2)
I suggest that you do an internet search for "dongle emulator", then run the software in a VM.
Police Laser Engraver (Score:3)
Re: (Score:3)
That is all very nice, but as an engineer I am always surprised how many IT problems are self inflicted.
"Every computer has to run off the same image" must be up there with the most painful guidelines ever. 90% - sure, 98% - good. But every computer? That is just not feasible, and there is always going to be the odd laser engraver, scanning oscilloscope, motion simulator, or ATM machine that still runs an obsolete OS as an embedded system. Nothing wrong with that as long as network connections are strictly
Re: (Score:3)
From most of the reports I've encountered, MSWind10 should be avoided no matter what the circumstances. I've encountered one report that (with certain options I don't remember) they've fixed many of the GUI problems. Everyone else has been dubious, speculative, or downright abusive about things like it's privacy policy, it updating requirements, etc.
Re: (Score:2)
That is all very nice, but if you want to avoid Windows 10, you have to avoid Windows. Or you stay with an unsupported product like Windows 7, but then again you could have saved yourself all that trouble and stayed on unsupported Windows XP.
Windows 7 is nearly seven years old, and extended support will end in just over three years, so migrating to it now is madness.
Re: (Score:2)
Well, I avoid MS Windows for other reasons having to do with the EULA, so that's ok.
Re: (Score:2)
And while we are at it, why is anybody migrating to Windows 7, a system that is already EOLed? Surely by now migration to Windows 10 would be indicated.
You're right.
You don't work in IT.
Re: (Score:2)
I'll speak to this, as IT.
Because we've NEVER had staff request something way past what they really need, and essentially lie to us to get it.
I've also worked with older devices, in my case an expensive HAAS CNC machine, that would ONLY work with an older version of windows ( Unless you wanted to buy their new machine). They used bizarre dongle that we couldn't push through VMS, and even VMS that said it would work didn't work.
Re:It's not as simple as "just switch over" (Score:5, Insightful)
I still have to support NT4, XP, VxWorks, Win98 and even some networked DOS machines in our factory.
You don't go changing the OS on a piece of equipment that costs over a million bucks to replace and all the software for the equipment is written for that OS. You just keep supporting it. And when you have hundreds of machines that cost a shit-ton of money to replace but work fine with the old OS, you keep supporting it.
And you call the new employees a buncha goddamn whiners because they don't want to learn "old stuff."
Knowing old stuff makes you valuable.
Re: (Score:2)
I always held the philosophy that security starts with the network. If a custom or legacy solution needs to be roped off, then what's the problem? Almost anything can be mitigated.
Re: (Score:2)
We ran into this same issue - in our case it was a video/controller board for some electron microscope - and the board itself was like 15k, and it just wasn't in the cards to upgrade it mid research project. So all dozen or so XP machines get to use the local network and that is it.
Every single other application I was able to hack/triage to get running on Windows 7 or 10 in some way or another.
I would suspect in the police dept - network security should be as concerning as physical security though - you nev
Re: (Score:2)
Re: (Score:2)
As someone who is on the tail end of a 700 computer migration from WinXP to Win7, I feel their pain. A single critical program that won't run on Win7 can be a showstopper. Not to mention special hardware for which no Win7 drivers are available - all of a sudden that $120 upgrade cost for a Win7 license became $25,120 when you include the cost of a new laser engraver.
I completely agree with your point but if you've got an SA or other enterprise or SMB licensing agreement with Microsoft then your upgrade licenses are $0. If you're buying OEM with 50, let alone 500 desktops you're doing it wrong.
But I do agree with your point, the major cost in doing any kind of upgrade comes in support and ancillary costs, not in the upgrade itself.
Re: (Score:2)
The way I look at it, if you cannot afford or buy updated software to replace the "mission critical" software running on outdated systems, you're not evaluating the situation correctly. You cannot afford not to, you just have chosen different priorities or your "mission" isn't that "critical"
IT systems are not a "buy once, keep forever" like older mechanical systems of the past. That Laser Engraver may work nearly forever, but the Computer that controls it won't.Places without upgrade policy/plans get stuck
Re: (Score:2)
Even older systems? (Score:3)
Re: (Score:2)
My CNC is connected to a ThinkPad 760XL running MS-DOS with TurboCNC.
Now get off my lawn.
Re: (Score:2)
Re: (Score:3)
I don't think an old Dremel 395 qualifies as a 3D printer.
Unless you meant "subtractive 3D printer", then yes.
Re: (Score:2)
I know of some old PLCs with programming and HMIs that run on XP. The manufacturer is unwilling to port their software to newer platforms. And the PC components were written to check for XP-specific components and abort if they were not found. They don't actually use these components, but my guess is that these tests were 'baked in' by the development toolchain to prevent running the produced s/w on Wine or Apple platforms.
Re: (Score:2)
At least on Linux you could patch the kernel yourself (I mean, if you're a big corporation like EATON or Siemens), but this Windows lock-in in industrial automation is one of the worst problem ready to explode: ten years ago all these insecure plants weren't connected
Re: (Score:2)
Lol that's cute. I work with a DOS programming / HMI tool for turbine control and for programming safety systems on several of our plants.
Re: (Score:2)
DOS is so old that there isn't much of an attack surface by network. No infected USB drives either. Just don't stick any unknown floppies in the drive.
Re: (Score:2)
Amen to that.
Re: (Score:2)
virtualized
That's still a full up installation of XP. Even if it's running on a hypervisor on newer h/w.
Re: (Score:2)
Re: (Score:2)
Well, I've got one MSWind95 system running, but it's about to go away, and a Mac 10.4 system that is turned off, and has been for over a year.
In both cases the machines have been retained because of proprietary software that held data in proprietary file formats written by companies that have died. This has created in me a very strong bias in favor of FOSS software, and especially GPL, though if the code is open other FOSS licenses can also be accepted.
Run them for another ten years (Score:5, Insightful)
As long as firewall is on and you run a fixed set of apps from trusted sources, you are perfectly safe. So is IE if you only visit internal sites. And for external browsing, browser security is more important than OS security. There will be forked versions of recent Firefox and Chromium builds forever.
The whole upgrade hype is largely financially motivated on part of Microsoft and consulting agencies.
Re:Run them for another ten years (Score:4, Insightful)
To IT Admin,
Don't worry, I've got the solution to our Win XP upgrade issue -- it's a weird forked version of Chromium I found on some website. I'm sure it's super safe.
Thanks,
Random Internet Person
Re: (Score:2)
The whole upgrade hype is largely financially motivated on part of Microsoft and consulting agencies.
Not really. Your scenario means the sysadmins must forever deal with exceptions, control tightly the set of applications, the trusted sources and so on. There is an extra burden of work for this and it is prone to errors from the sysadmins. So, the switch may worth the extra bucks depending on the size and complexity of the environment. I tend to believe it is the case here with 26 000 workstations still running Windows XP.
Re: (Score:3)
Say Microsoft is charing you $75 to upgrade each seat. Now ad in labor, troubleshooting, user training / support. Very optimistically real cost to just get built in functionality running to the same level will bring the total to $200/seat or 5.2 million dollars. I have no idea how much of your hardware will need to be upgraded, again with associated labor costs. Add in fees for upgrading Office and 3rd party apps that do not run well Windows 10. And cost of fixed in-house apps.
I will be happy to assist with
Re: (Score:2)
Re: (Score:2)
Just locking down existing software can be conceivably done in 100K (say a month time for 3 engineers and support for 1% of users who had an unexpected problem). You already have ability to push group policies and remotely install software in bulk right?
If your company routinely accepts 5000% overspending, this will not be the only project when this happens and expenses add up. Doubly important for a police department or other entity running at taxpayer expense.
Re: (Score:2)
Despite me advocating not migrating as OP, US military is not a model of financial efficiency and thrifty organizations can probably manage a lot less than $3500/year or in total. Painstakingly make everything look and work the same in a customized image, create simple in house software to provide any missing functionality, have early adoption enthusiasts that will be on help to provide peer support, and so on, Best done by gradually bringing in new systems when old ones need to be replaced anyway of course
Re: (Score:3)
Your scenario means the sysadmins must forever deal with exceptions, control tightly the set of applications, the trusted sources and so on.
And how is this different from what goes on every day under any scenario dealing with networked computers?
Re: (Score:2)
I run an XP desktop at my office. It's used exclusively for our high-speed document scanner. It's not allowed on the internet, meaning that it only accepts connections to and from our file server, which is running Debian. I don't see any reason to upgrade to Windows 10 for this use. There are five computers in my office, four of them desktops, so this means that 25% of the desktops at my firm are running Windows XP.
How do you limit connections? (Score:2)
Re: (Score:2)
20% of computers, 25% of desktops...
Re: (Score:2)
Well, in theory you're right. But as the old engineering saying goes: in theory, theory and practice are the same but in practice they're different.
Sure, in many cases you can depart from best practices and still be OK ... if you are scrupulous about other best practices. But if the reason you're being cavalier with the rules of thumb you're breaking is that you don't have the budget or bandwidth to implement them, chances are that reason applies across the board.
So a lot depends on why you do something
Re: (Score:2)
IE8 is not for going online, it's for shortcuts to specific internal web apps, with address bar hidden. Actual web browser is a company-standard build of chromium auto-updated through puppet.
Re: (Score:2)
It seems most upgrading today is done solely due to FUD.
Here are the main drivers for updating (in my opinion), in order:
- Support (While I may be able to deal with 99% of issues, those 1% issues can be show stoppers. Software support is a much needed life line)
- Hardware compatiblity (drivers....)
- Security (operating systems that receive continued patches is a really good thing)
- Management (better deployment options, group policy changes, etc)
- Software needs (newer software requires a current OS*)
* Most of the time, this is probably arbitrary installer sett
Re: (Score:2)
I am not necessarily suggesting downgrading new hardware to Windows XP. Gradual replacement provides a perfect opportunity to slowly roll out Windows 10 and resolve any problems without breaking all users at once. Once you are down to couple of thousand old PCs, by all means do a mass upgrade / potential hardware replacement to standardize.
Core problem (Score:2)
Bespoke software development isn't the problem, software not developed to sensible cross platform standards is the problem.
I regularly use a piece of bespoke software that was developed many years ago as a standards compliant webapp, it still works today in all the major browsers on any platform - including on mobile phones, which didn't even have browsers when this software was written.
If you plan appropriately when acquiring new software, these problems wouldn't occur.
Re: (Score:2)
"a standards compliant webapp"
Sure, but what if the software has to do something with real hardware: machine control, machine vision, network analysis, hardware programming and IO, data logging, etc.... no "webapp" is able to do anything like that. And while a good cross-platform native program will compile cross platform without [much] issue, what about the hardware drivers that you rely on. What if multiple vendors are involved?
All I'm saying is that it can get really complex really quickly. For my work,
Re: (Score:2)
then write low level driver code in standard C, and the UI in Java, or BASIC or anything that is not machine dependent. Come on, some of us knew how to do this in 1980.
OTOH, perhaps the problem is all down to hiring young whipper-snappers, and paying peanuts.
Anyway, its entirely likely that not even one of the 27,000 XP machines are connected to the Internet anyway. I know its hard for people here to realise it, but there are many uses of compu
Re: (Score:2)
"then write low level driver code in standard C"
While a nice modular approach that will most certainly be platform specific.
When it comes to hardware IO there is nothing that offers true write-once compile-anywhere... :(
Re: (Score:2)
Web UI = Salvador Dali [Re:Core problem ] (Score:2)
I'm not sure what you mean by "standards compliant". The standards are only suggestions, and not all browsers followed them, or interpret them differently, and CHANGE how they interpret them over time.
I've seen web apps "break" and/or degenerate due to browser implementation changes that one could not foresee.
One really annoying problem is that if Page X opens P
Re: (Score:2)
I welcome you to the X window system.
Simple solution (Score:2)
M$ doesn't sell or support XP anymore, release the source code and let the market create it's own security patches.
Win10 is a combination of Spyware and Adware masquerading as an Operating System...
Re: (Score:2)
M$ doesn't sell or support XP anymore, release the source code and let the market create it's own security patches.
Maybe everyone can buy patches for windows 2000 server from the Russian mob [zdnet.com] or a github account [softpedia.com]
Re: (Score:3)
And remove one of the major clubs MS uses to beat its users into migrating to their latest? They'd be cutting their own throats. Also, XP would then never die, it would get reborn as "MS without MS" and represent a fork of their alleged software that they do not control.
Re: (Score:2)
Well, if they aren't supporting it or selling it anymore, they should lose copyright protection over it then.
Re: (Score:3)
Re: (Score:2)
Sorry, don't care. If they no longer support the OS they should lose all copyright over it.
Re: (Score:2, Interesting)
I think you are assuming that every Windows release has different code.
I would be willing to bet that Windows 10 is basically Windows 2000 with updated UI and a few more drivers baked in to the kernel.
When a Windows vulnerability affects all previous versions of the OS, it's a strong indicator that this is true.
Re:Simple solution (Score:5, Insightful)
Doesn't matter, when a company stops supporting a product, they should lose the copyright over it and it should become public domain.
should have..... (Score:4, Insightful)
'The Met should have stopped using Windows XP in 2014
The Met should have begun the switch to Linux (or at least open source technologies) in 2001.
What's wrong with XP? (Score:2)
If the government would have forced Microsoft to open the platform or continue support indefinitely there is no technical reason not to continue using XP. The only barrier right now is the lack of support, which means no security updates.
But as an operating system it still does the job of launching your applications and getting shit done.
Re: (Score:3)
Re:What's wrong with XP? (Score:4, Interesting)
Pay-to-play, even if they pass the support effort on to a 3rd party contractor, would be nice for customers. But ultimately I think Microsoft wants everyone to buy new computers and new copies of their latest operating system. The planned obsolesce has always been about money, the security aspect is a convenient excuse to push that agenda.
As an example, SABRE (airline reservation system) has been running in one form or another since the 1970's. And even though ACP (IBM Airline Control Program, an operating system) was only officially supported for about 10 years ('68-'79), it continued to be used in production environments for decades after that.
But to be fair IBM was traditionally about selling big hardware and support contracts and not about selling software, a very different style of business compared to Microsoft.
Easy solution (Score:2)
All they need to do is to firewall them with Linux boxes containing two Ethernet cards. Just like everybody else does.
Some of us ARE stuck on XP. For example, a piece of multi-$M scientific equipment might only have drivers that were issued for XP, back when it was purchased. We don't fix what isn't broken; we firewall or ghostwall it.
retail support ended (Score:3)
Re: (Score:3, Informative)
What you believe is true, despite the click-bait article's allusions. Proof? Here's the Premier Support Agreement that provides support through 2019.
https://www.london.gov.uk/site... [london.gov.uk]
National security issue? (Score:3)
Unfortunately they don't think of cross platform. (Score:4, Interesting)
So you are on Windows now. That is all good and fine. However the majority of your Applications should be Web Standards Based developed in a easy OS portable language. With a database system available in multiple OS.
Because time and time again, The next generation of Computer/OS breaks a lot of compatibility and moving over to a new platform is a big headache.
Vs that web application developed in PHP back in 2003 while may not be pretty will still work on Windows 10 or the Bosses new iPad. Without having to rework the entire thing.
Re: (Score:2)
Re: (Score:2)
"Web standards" aren't. They are like post-a-bomb cockroaches - they keep proliferating and mutating. Same with browsers.
As a long-time opponent of Java, I have to say that with the advances made, it's more than good enough, and code written a decade ago for 5.0 that doesn't run in a browser runs just fine in 8.0. Just need the current runtime for your particular host (the class files can just be copied from one OS to the other and run). Just don't use either native methods, and use the provided abstractio
Re: (Score:2)
Re: (Score:2)
So you are on Windows now. That is all good and fine. However the majority of your Applications should be Web Standards Based developed in a easy OS portable language. With a database system available in multiple OS.
Not all business needs can be satisfied with web applications.
- You can't upload GCode to a machine using a web browser
- You can't capture specialty device input using a browser
- You can't do anything that requires access to system protected resources due to the high level of security implemented in browsers
- You can't effectively do CAD on a web browser (although that is becoming a dead argument with OnShape).
Fact is that you have plenty of situations where web applications just don't cut it either because
Re: (Score:3)
There is a good portion of the W3C that is well supported by the major browsers and if if you follow those your app tends to function correctly in all of them.
I tend to stick to xhtml standard while the most picky, tends to render rather identically across all modern browsers.
hey, sing along! (Score:2)
hack-hack-hack
hack-hack-hack
hack the bobbies
hack the bobbies... ahhh
Re:Lots of citites still run windows (Score:5, Insightful)
Trying to run a government or even a moderately complex business with Linux machines would be the mother of all clusterfucks.
You're obviously not familiar with the patching process for Microsoft Windows. I give my thanks to Microsoft everyday for the job security it provides me.
Linux rocks (Score:2)
>> Trying to run a government or even a moderately complex business with Linux machines would be the mother of all clusterfucks.
Nope.
It just works.
Some administrations switched a long time ago.... Example : Munich City services, French Police (Gendarmerie)....
Re: (Score:2)
Re: (Score:2)
My 70 year old aunt, who was hardly computer literate, runs Ubuntu just fine. If old bill is too dumb to learn ubuntu, let them stay ignorant.
By those standards Windows XP must be a god given gift. It still resides on 70 year old aunt's computers 13 years later.
Re: (Score:2)
Well, all those people who didn't upgrade from DOS are still laughing./
As are those running Java applications, where all you have to do is copy the class files to your new machine and if you didn't use native functions or other non-portable code, or a custom java (such as on cell phones back in the day) you're still sitting pretty. (No, I'm not talking about "browser apps", which are rather limited to begin with.)
On today's computers, the problems with Java's speed are pretty much gone for most use cases.
Re: (Score:2)
Yes, but that's because code targeted for Java 1.5 on Windows would run equally well under Linux. Because Java was designed from Day 1 to be future-proof and portable. Lotsa luck with those Visual J++ apps, though.
Now excuse me while I go trying to find what they've renamed Network Neighborhood to for this Windows release.
Re: (Score:2)
Re: (Score:2)
Actually, as I understand it, Windows itself will honor a "/" as a path separator in some cases. Probably the biggest reason that DOS/Windows ended up using a backslash as a path separator was what a lot of the CP/M and MS-DOS paradigm came from the DEC OS world, where "/" was used as a switch prefix instead of the dash character used by the Unix OS. Making a "/" in a filepath potentially ambigous.
Java, on the other hand, will cheerfully honor a "real" (forward slash) as an abstract pathname separator on al
Re: (Score:2)
1. There is CentOS, with 10 year LTS releases.
And Windows XP was supported for 13 years. So in 10+ years time we'd have the same story, but with an outdated version of CentOS rather than Windows.
The problem isn't Windows vs Linux or Proprietary vs Open, it's entities being too cheap/lazy to update their software when something it relies on goes unsupported.
Re: (Score:3)
People never seem to figure out that software isn't write-once/run-forever. Over time, software rots from the outside in. Sure, the bits are all there, but the hardware and external services that they are designed to talk to eventually change so much that having the original bits is useless.
Budgeting software as a one-time expense is like buying a Mercedes and never doing an oil change.
There is a problem with Proprietary versus Open, though. I still have the source-code disks for Red Hat 7. Not the RHEL one
Re: (Score:2)
Windows XP Unofficial SP4 puts it on the POS track (Score:2)
Windows XP Unofficial SP4 puts it on the POS track
Re: (Score:2)
I've got some Linux programs (from Loki Software) that only run on an installation in a virtual machine. The problem isn't all in the OS, some times it's in the programs that don't like the newer systems.