Hacker News Reader

Comment by Paul_S | Hacker News Reader

The world banking system runs on windows? Of all things in that article this was most surprising to me.

Mostly run on IBM mainframes. Some run on Windows. Only thing that saves former is investment required to learn to hack it plus arcane controls/procedures encoded in it. It's why attacks are often inside jobs at least partly.

Serious question: what OS should it run on? I agree that Windows is a bad choice but other options are not much better as far as security (for this kind of attacks) is concerned... Are they?

BSD UNIX can be good from a security standpoint. But, there are also OS out there written from the ground up to be secure.

Sure, but this attack modified local binaries so that they performed operations for attackers. How do you fight that?

The short answer is to only run signed binary's and or not allow new code at all. How to manage that while maintaining flexibility and minimizing costs ends up getting really complex. But, really there is a long continuum between say a personal blog at one end and an ICBM at the other. IMO, the banking system is at the high end of that scale.

I would say a cross-platform kernel, and the business logic running in a virtual machine, like Java. That combined with a hardware encryption module.

Much of what that article is about, their software relies on Oracle DB for just about everything.

Perhaps "why using easy to hack native binaries" is a better question.

Maybe an IBM Mainframe running z/OS. just wondering ..

From a security stand point, why is Windows a bad choice?

I'd be bold and say it doesn't really matter. It's all security through obscurity.

I was more surprised to learn that they run on an Oracle Database.

But now looking back, I'm not sure what better option they would have had.

Reply on news.ycombinator.com