Hacker News Reader

I saw this on /r/netsec a few days ago. One of the comments there mentioned that some POS devices are still vulnerable to the VNC authentication bypass exploit from 2006. The "we lose money if we patch"/"don't have time to patch, got this stuff to do" mentality is strong with this one.

View on HN

That doesn't surprise me. I've seen these things (Aloha terminals) still running Windows 98. BOH was on Windows XP at least. From my experience, it's less about not having time, and more about being completely unaware of the requirement to patch the things.

The management of OS updates also falls between resposibilities. Probably, the shop/chain owners will be responsible for OS and virus scanner updates, and because of lack of knowledge on their part, have been cause of critical disruptions in the past.

I have some hands-on experience with POS-systems from the vendor side of things, and it has happened multiple times that a customer led security patch carnival has led to major issues (windows needing to reboot 3 times before it became stable enough to make a print again, seriously?).

Reply on news.ycombinator.com