Hacker News Reader

Comment by glaberficken | Hacker News Reader

>"The Secret Service alert says ATMs still running on Windows XP are particularly vulnerable, and it urged ATM operators to update to a version of Windows 7 to defeat this specific type of attack."

I had no idea ATMs ran Windows!

View on HN

You'd be surprised how many things are running Windows. I always wonder if the manufacturer just hires cheap contractors that haven't seen anything apart from Windows in their entire life, or if there is an actual reason it can't run on linux.

OpenBSD would be perfect for the job, wouldn‘t it?

An OpenBSD machine still running unpatched from the XP era would be every bit as vulnerable.

Yes and no. OpenBSD always had far fewer exploitable bugs than Windows, so it presents a smaller attack surface. And far fewer people bothered to develop exploits. Windows has always been the big juicy target, with exploits easily available.

But on the other hand, it only takes one.

I'd challenge that. Given that there are serious security architecture differences between Windows XP and OpenBSD systems.

For starters, Windows XP has always optimized for "plug random hardware in and it Just Works" while OpenBSD aims more at "what is the minimal number of services we can have running in the base image."

Sure, OpenSSL vulnerabilities found in the intervening time will still affect both, but we're still talking orders of magnitude difference in RCE vulnerabilities.

One reason would be that the vendors require support. Of course there are supported embedded versions of Linux that they could use..

Could be to do with adding and controlling them from an Active Directory Domain perhaps.

A bank I worked for years ago had ATM domains (in different forests) and had policies applied to the ATM's.

They ran XP at the time.

If you really want a blast from the past, a lot of them (used to?) run OS/2.

OS/2 derivatives are still being developed and marketed [1] [2].

[1] http://www.ecomstation.com/

[2] https://www.arcanoae.com/arcaos/

If you're targeting known hardware, and the OS provides all the functionality you need, there's no reason to overengineer things.

I've seen an ATM stuck on the Windows XP boot screen, and one frozen with a Windows 9x "out of virtual memory" dialog box.

It's not unknown to see windows crash screens on atms.

I've never seen one like this though: https://www.betaarchive.com/imageupload/1182228936.or.19648....

The same with most point-of-sale machines. I worked for a point-of-sale vendor for a while that had both Windows and Linux versions of our software. All but one retailer chose the Windows version because they felt it was much easier to manage 10,000 Windows machines than 10,000 Linux machines.

BTW, that one retailer that used the Linux version? They replaced it with the Windows version on their next hardware refresh.

OS/2 was another common one, at least up until the current decade. Not sure there are many of those left at this point.

To be specific, it’s most likely Windows Embedded.

I am regularly surprised by the contrary. Our lifts at work once displayed a popup from the "Desktop cleanup wizard".

I was in Munich main train station and saw an advertisement display showing a OS X Desktop and a crash report. Like, why exactly would you use a Mac for this..

To be fair I've seen kernel panics on advertising screens too

The one I saw the other day was wedged at a Windows 7 Professional "Shutting Down..." screen.

In Poland, few years back, I caught several ATMs rebooting to Windows NT 5.0.

...win2000 pre-release? or did you mean NT 4?

Reply on news.ycombinator.com