Computers; what if the railway was attacked?

[takno]

Aircrafts has already been hacked, someone hacked onto a United! 737 IFE and caught by FBI !!:roll:

Somebody had an illegal sniff around the wi-fi on a United plane, jumped to some wildly inaccurate conclusions about what he had access to, posted these on Twitter from the sky and seemed suprised when the FBI wanted a little chat on arrival. Just to be clear, nothing was hacked, and there was no evidence whatsoever that the avionics weren't properly air-gapped.

 

[Dave1987]

In class A airspace flight speed is up to 500mph and in this case see and avoid seemed unreliable, isn't? Also what in case the weather is IMC?:roll:

Ever heard of TCAS(Traffic collision and avoidance)? Ever heard of VHF? Ever heard of lost comms procedures? And since when in a TCA(Terminal control area) like the LTMA(London terminal movement area) is any aircraft doing 500mph? Considering below FL100 their is a 250 knot limit unless authorised by ATC! If the ATC for the LTMA at Swanwick and the controllers couldn't see the aircraft on their panels or talk to their aircraft the aircraft would not just fall out of the sky because the aircraft are being flown by humans! TCAS onboard the aircraft would still work and VHF onboard the aircraft would still work so the pilots could all still communicate with each other. The captains in charge of their various aircraft would be able to assess the situation and keep their jet safe. Next.....

 

[14xxDave]

One of the problems is the end user software. I hail from a scientific background and it was a nightmare with certain pieces of software that was written specifically for XP and no drivers were ever written for later versions. We actually had to go looking for old PCs that could run the software and also had the correct connections. I discovered manufacturers wrote their code for one version of OS and that was it!

 

[68000]

Safety critical communications used for railway signalling are not transmitted via the internet. Whilst interrogation systems may use internet connection they cannot be used to transmit instructions, any attempt to do so would be blocked by the interlocking which would reject any such instruction.

Some safety critical comms are sent over the internet (interlocking data over FTN-x). Intercepting or disrupting them will not result in safety incidents but will result in down time for the service which means no train service. The safety angle come into play if one interlocking instruction is misinterpreted by another

 

[Sacro]

It's not quite as simple as upgrading an operating system.

I work for a large organisation. Thousands of PCs and bespoke systems that have to be compatible with each other for the business to function. We're not talking about popping out to PC World and purchasing an updated PC and the latest version of Office.

What we need is stability. Upgrading to a new operating system represents a huge risk so it is only ever done when it becomes absolutely essential. It's not just about cost, it's also about business continuity and stability.

And how many years have to pass from the last available security updates before it's considered wise to physically disconnect it from the public internet?

 

[al78]

And how many years have to pass from the last available security updates before it's considered wise to physically disconnect it from the public internet?

Whenever Microsoft announce they will no longer provide updates.

Not updating software which has been declared obsolete, for which security updates have ceased, and are as such vulnerable to a cyber attack is like living on a hurricane prone coastline and not having relevant insurance. The risk of disaster might be very low, but if it happens and you haven't got appropriate measures in place, it could be very VERY expensive. Do you feel lucky?

 

[Crossover]

But keeping computers updated isn't free - at least in "time" unless they can do it themselves. Can they? Otherwise I assume every single PC, laptop and tablet a company has, and in the case of the NHS that would be hundreds of thousands, would have to be updated...and not just once but every so often. My surgery has about 10 consultation rooms, each with its own PC, then there's the admin area and the back offices, so (a) what would need doing to each item (b) how long would it take and (c) would there be any cost in monetry terms? I've no idea - on my PC my antivirus asks to be updated, and I just click and let it get on with it. Would that be the same in an office?

In a properly configured system, updates will be applied automatically and systems rebooted, on client machines at least - this should be both anti-virus and other patches. Better still, it should be able to report back so the admins know at a glance what may need a closer look. The only real investment in time, if everything is doing this OK, is the additional time spent waiting for PC's to shut down and start up when they get the patches.

Backend stuff may be different and may be patched manually to control how certain things start back up, for example - there is a greater time cost on this

They don't come for free but they provided twelve and a half years of updates and support for XP without requiring anyone to pay anything on top of the original licence. That seems a pretty fair deal to me! They even gave people plenty of notice of their plan to discontinue support!

How long should they be required to provide free support for? How much extra will a license cost as a result?

My bold...this! - it is known well in advance when items are going to go off support so it doesn't get sprung as a surprise. Knowing Windows 7 goes off support in around 3 years means businesses should be planning this as part of their upgrade programmes. It feels a long way away now, but it'll be here before we know it

 

[Olaf]

I've had quite a few times where I have been unable to collect tickets because the system was down across the entire country. A majority of the time I have just been told to collect my tickets at the other end, which of course if the ticket office at your starting station can't get access I can't see how the other office will have.

I suppose if the system was hacked then reservations on "ross Country wouldn't work, but then again no one would notice as it's a regular thing.

What would happen with the nuclear trains if the system was hacked and everything brought to a stop, if those trains had already started their journeys?

Not all system failures are attributable to abuse but yes, most companies will not go public on the majority of incidents - they will many cases only go public if there are legal implications of not doing so.

 

[Olaf]

2.5 years is a short time; ridiculously short. Just because the latest software is overtaken by the next latest software shouldn't mean you abandon the first, and be forced/blackmailed into upgrading (at time and possibly expense) especially (as in XP) there are still vast amounts of users. If a train lasts 30-odd years, so should Windows 2000!!!

Wat also annoys me about *upgrading* is that software designed for one OS may not work in the next, so there's the added cost and hassle of upgrading your software.

For example - stuff I've bought in the past - Ulead Photo Express, works in XP but not on 7. Magix Audio Cleaning lab, works in XP, but only partially on 7. Granite 2 works in XP but won't load in 7. (So no chance with 10 even though I've tried and done all the compatability stuff)

Why should a customer have to go out and replace loads of software just to keep up with having a supported OS? It's blackmail!!

But that's getting off-topic; at this point I just want to know, as a passenger, am I safe, and the resounding answer seems to be yes

Go open source - you still have to upgrade but you can pick and choose what you want.

 

[Olaf]

Apple stopped supporting my 2005 iMac (running on PowerPC) after just 4 years and I'm stuck on OS 10.5 Leopard. Seems unfair that MS are getting all the criticism. And look at how long it took to find the Shellshock vulnerability in Unix/Linux - it had existed since 1989

True Apple has own detractors, however there is a significant difference in the scale of the problems relating to the two vendors.

Microsoft will be making money out this attack as many will have to upgrade to new versions of Windows, but there will also be more cases, especially around non-end user systems that will shift to open source as a consequence of this.

 

[Olaf]

Microsoft! They sell their systems - they don't come for free, so they should support them.

As an aside; and I'm out of my depth on this one.....what about if the NHS ran Linux? Is that supported....would it run the same...could it be attacked as easily...does antivirus/malware work...is it needed?

I tried Linux Unbutu (sp?) once and half liked it half didn't; can a business and organisation run Linux?

Most business do use Linux in one form or another and it is more common than you would expect. Back-office, automation systems, telecoms, cloud services are all mostly on Linux - with Microsoft also a major Linux user and service provider. Most businesses make use of Microsoft or Apple clients, but it varies by departments and the nature of the company - tech-savvy businesses will be heavy users of Apple and/or Linux.

For a low tech, end-user dominated organisation, you are effectively tied to Microsoft products unless your staff are prepared to make the transition to Linux desktops or thin clients, but it can be done. I expect there will be a lot of migration advocacy appearing on the web as a result of this incident.

 

[Olaf]

Rubbish, it's entirely to do with cost cutting, the departments haven't the money to finance a roll-out of a new OS, which may well require newer hardware to run on.

Sorry, that is not the case; I have had the misfortune of having to work with numerous public sector organisations over the years including the NHS and is definitely not down to a lack of money (in the case of the NHS). Private businesses can be just as bad, but it is the business, reputation, and survival - plus they are more exposed to legal action.

 

[Olaf]

It's not quite as simple as upgrading an operating system.

I work for a large organisation. Thousands of PCs and bespoke systems that have to be compatible with each other for the business to function. We're not talking about popping out to PC World and purchasing an updated PC and the latest version of Office.

What we need is stability. Upgrading to a new operating system represents a huge risk so it is only ever done when it becomes absolutely essential. It's not just about cost, it's also about business continuity and stability.

Life-cycle planning is core to service provision; there is no excuse for not taking the obvious into account nor for taking steps to mitigate risk. This is not something new, it has been in place for generations.

 

[Olaf]

One of the problems is the end user software. I hail from a scientific background and it was a nightmare with certain pieces of software that was written specifically for XP and no drivers were ever written for later versions. We actually had to go looking for old PCs that could run the software and also had the correct connections. I discovered manufacturers wrote their code for one version of OS and that was it!

A key problem for developers was/is that Microsoft keeps changing the APIs and OS services.

It is a bit too late for you now, but wine might be your answer:

https://www.winehq.org/

There is also React ...

http://www.reactos.com/

 

[SpacePhoenix]

In a big organisation chances are that they'll be buying dozens or maybe a few hundred computers at a time that will be the same hardware installed in them. Once one has been set up, it gets imaged, then the rest get installed from that image, then get given unique names/ids. If the OS of one screws up, it gets re-imaged over the network.

If software does require an older OS then a virtual machine can be used

 

[The Ham]

2.5 years is a short time; ridiculously short. Just because the latest software is overtaken by the next latest software shouldn't mean you abandon the first, and be forced/blackmailed into upgrading (at time and possibly expense) especially (as in XP) there are still vast amounts of users. If a train lasts 30-odd years, so should Windows 2000!!!

Wat also annoys me about *upgrading* is that software designed for one OS may not work in the next, so there's the added cost and hassle of upgrading your software.

For example - stuff I've bought in the past - Ulead Photo Express, works in XP but not on 7. Magix Audio Cleaning lab, works in XP, but only partially on 7. Granite 2 works in XP but won't load in 7. (So no chance with 10 even though I've tried and done all the compatability stuff)

Why should a customer have to go out and replace loads of software just to keep up with having a supported OS? It's blackmail!!

But that's getting off-topic; at this point I just want to know, as a passenger, am I safe, and the resounding answer seems to be yes

No, it's ransom ware, just not seen as such by the end user.

 

[Tio Terry]

Some safety critical comms are sent over the internet (interlocking data over FTN-x). Intercepting or disrupting them will not result in safety incidents but will result in down time for the service which means no train service. The safety angle come into play if one interlocking instruction is misinterpreted by another

I think you will find that the data you are refering to is classed as safety related rather than safety critical. That's why, in some cases, it is transmitted using public telecommunications networks instead of dedicated NRT infrastructure.

Yes, it could result in delays and disruption but would not be unsafe.

 

[SamYeager]

OT but I'm ever so grateful that Howardh didn't buy a copy of Windows 95 in the past as by his logic Microsoft should still be supporting it. After all it was only released 22 years ago. :roll: hock:

 

[JamesT]

Microsoft have also provided patches for XP, Windows 8 and Server 2003 - but strangely not Vista, so they are doing their best, but if people insist on not running Windows Update on a daily/weekly basis then what're they to do.

Vista was in support until April this year. The patch came out in March so Vista users should have been able to apply it in the normal fashion.
Windows 8 had a very short support lifecycle as it was replaced by 8.1 in a free update.

 

[Sacro]

Vista was in support until April this year. The patch came out in March so Vista users should have been able to apply it in the normal fashion.
Windows 8 had a very short support lifecycle as it was replaced by 8.1 in a free update.

Ah yes, that would make sense.

 

[najaB]

Microsoft will be making money out this attack as many will have to upgrade to new versions of Windows...

But no more than they would have made if the customers had upgraded when they 'should' have. And in that case they wouldn't have been able to sell those lucrative support extension contracts. So MS isn't really a winner in this.

...but there will also be more cases, especially around non-end user systems that will shift to open source as a consequence of this.

Where they can. It's unlikely that organisations that didn't have the skill/will/money to upgrade Windows version will have the skill/will/money to move to a completely different OS overnight. So they'll likely stick with what they've got for at least a full upgrade cycle.

 

[Welly]

I rode on the Pacer refurbishment demonstrator 144012 recently and noticed the Linux Penguins on the Passenger Information System screen when it was booting up so that one is safe!

 

[Ediswan]

Never used it, but read that it was appalling!! Anyone here have experience?

"It" being Vista. I am still using Vista, to type this. I also use XP, 7 and 10 on a weekly basis. Vista is no worse than the others.

The problem with Vista was that it introduced signed drivers and User Acount Control. Those did 'break' a lot of existing software and working practices. By the time everbody had adapted to those, Windows 7 was imminent. So many upgrades went direct from XP to 7, bypassing Vista.

For truly "appalling", try Windows 8, if you can find it still running anywhere.

 

[Sacro]

"It" being Vista. I am still using Vista, to type this. I also use XP, 7 and 10 on a weekly basis. Vista is no worse than the others.

The problem with Vista was that it introduced signed drivers and User Acount Control. Those did 'break' a lot of existing software and working practices. By the time everbody had adapted to those, Windows 7 was imminent. So many upgrades went direct from XP to 7, bypassing Vista.

For truly "appalling", try Windows 8, if you can find it still running anywhere.

The other main issue was the whole "Vista Capable" shambles, with machines that would run XP reasonably well being shipped with Vista, but not having the CPU/Memory to run it decently. I did run Vista for a while (until 7 came out), and with 4GB RAM and a decent CPU it was reasonable.

I loved 8 and still do, it brought a lot of great new ideas, including the removal of the awful 'Start Menu', and the vomit of shortcuts that developers threw in over the years. 8.1 was even better, and I find 10 pretty reasonable now.

 

[najaB]

By the time everbody had adapted to those, Windows 7 was imminent. So many upgrades went direct from XP to 7, bypassing Vista.

For truly "appalling", try Windows 8, if you can find it still running anywhere.

Windows 8 and Vista are very similar in many respects - they introduced new concepts under the hood and a new interface, which meant that they were equally despised by developers and end users.

Both of them were soon replaced by the polished version (7 and 8.1) which fixed a lot of the flaws of the 1.0 release.

 

[Sacro]

Windows 8 and Vista are very similar in many respects - they introduced new concepts under the hood and a new interface, which meant that they were equally despised by developers and end users.

Both of them were soon replaced by the polished version (7 and 8.1) which fixed a lot of the flaws of the 1.0 release.

I don't recall many MS OS releases being that great on initial launch, XP was awful until SP1 and even then SP2 and SP3 made it far better, Windows 95 had 3 different releases, 98 had a second edition, only ME (I think) never had a major update.

 

[cjmillsnun]

ATC computers have been down (but not attacked) http://www.bbc.co.uk/news/uk-30454240 - link to report from 2014. One presumes rail computers could likewise go down regardless of attack? I'm happy to read that if a signal's down a train will stop; but on another thread I suggested the OS manufacturers should support their OS for a minimum of 25 years. Since 2000 we've had Millenium, XP, Vista, 7, 8, 8.1 and 10, 7 changes in 17 years. 7 is about to be unsupported - the short lifespan is IMO ridiculous. It might be quick and easy to "upgrade" from one OS to another - 10 mins? - but when there are thousands requiring this upgrade that's a lot of man-hours (and they need to be paid for) and I'm not surprised the NHS isn't up-to-date.

Why should they? Companies need to make money. Microsoft is no exception. They got their fingers burned with Windows XP in having to support it for 13 years. To support it they have to produce patches, test them on a number of systems and then push them out. It costs millions to do that with no money coming in from these legacy customers. Large businesses should be up to date and their contracts with Microsoft normally allow them to install the most up to date versions of software (Windows and Office), which they should do well before support runs out.

 

[cjmillsnun]

2.5 years is a short time; ridiculously short. Just because the latest software is overtaken by the next latest software shouldn't mean you abandon the first, and be forced/blackmailed into upgrading (at time and possibly expense) especially (as in XP) there are still vast amounts of users. If a train lasts 30-odd years, so should Windows 2000!!!

Wat also annoys me about *upgrading* is that software designed for one OS may not work in the next, so there's the added cost and hassle of upgrading your software.

For example - stuff I've bought in the past - Ulead Photo Express, works in XP but not on 7. Magix Audio Cleaning lab, works in XP, but only partially on 7. Granite 2 works in XP but won't load in 7. (So no chance with 10 even though I've tried and done all the compatability stuff)

Why should a customer have to go out and replace loads of software just to keep up with having a supported OS? It's blackmail!!

But that's getting off-topic; at this point I just want to know, as a passenger, am I safe, and the resounding answer seems to be yes

2.5 years? Windows 7 was released in 2009 and its lifecycle was published on release. It's been known for 8 years now when support would end.

 

[PeterC]

A lot of people have a very simplistic view of what it takes to upgrade the OS in a major business.

I could write an essay on upgrade issues, as could anybody who has worked in IT in a major national business but it all comes down to money. Being out of support simply isn't an arguement, you have to be able to put a positive cost benefit on the upgrade. (I never liked that approach but I was just the poor devil who had to nursemaid the old software).

 

[cjmillsnun]

I don't recall many MS OS releases being that great on initial launch, XP was awful until SP1 and even then SP2 and SP3 made it far better, Windows 95 had 3 different releases, 98 had a second edition, only ME (I think) never had a major update.

ME didn't get a major update as it was a stopgap. It was originally intended that the conversion to an NT based consumer OS was going to happen with Win2K. TBH they should've stayed with 98 and gone from there to XP.