HMS Queen Elizabeth Running Windows XP - Allegedly

[Alan B]

Telegraph

HMS Queen Elizabeth is 'running outdated Windows XP', raising cyber attack fears

Fears have been raised that Britain’s largest ever warship could be vulnerable to cyber attacks after it emerged it appears to be running the outdated Microsoft Windows XP.
As HMS Queen Elizabeth left its dockyard for the first time to begin sea trials, it was revealed the £3.5billion aircraft carrier is apparently using the same software that left the NHS exposed.
Screens inside a control room on the ship, which is the largest vessel ever built for the Royal Navy, reportedly displayed Microsoft Windows XP - copyright 1985 to 2001.
The operating system was that which left the NHS and other organisations around the world vulnerable to a major WannaCry ransomware attack last month. It affected 300,000 computers in 150 countries.
Windows XP is no longer supported by Microsoft, meaning it does not receive updates to protect users from new types of cyber hacks.

...

A defence source told the newspaper that some of the on-boar hardware and software "would have been good in 2004" when the carrier was designed, "but now seems rather antiquated".

Er, yes.

However, he added that HMS Queen Elizabeth is due to be given a computer refit within a decade.

Ten fucking years to replace XP?

And senior officers said they will have cyber specialists on board to defend the carrier from such attacks.

Oooo! The magic word 'cyber'! So that's all right, then.

[NineBerry]

It's only relevant when the systems are connected to an insecure network. You often need old software to interface with old hardware. Similar issues in medical imaging where I work. Devices need to run for 20 years or so to justify the lot of money it costs to buy them. This hardware needs drivers which are not available for newer operating systems. So you continue to run the old software, making sure the system is protected by either not connecting it to a network or a very specific network that controls what communication to allow with these old systems.

[JimC]

They would be fine with Apple...

[NineBerry]

Apple only runs on Apply Hardware....

[Scot Dutchy]

Rotten Apple software.

[Alan B]

It's only relevant when the systems are connected to an insecure network. You often need old software to interface with old hardware. Similar issues in medical imaging where I work. Devices need to run for 20 years or so to justify the lot of money it costs to buy them. This hardware needs drivers which are not available for newer operating systems. So you continue to run the old software, making sure the system is protected by either not connecting it to a network or a very specific network that controls what communication to allow with these old systems.

I would suggest that with any operating system (even Apple! ), the drivers for any external hardware could be re-written to accommodate.
As far as the computer is concerned, I used to run Win95, then Win 98, then Win 2000 on the same machine. I then upgraded to a faster PC and installed the latest Win XP. I now use Win 7 on the same machine. Win 10 will be no problem (when I get around to it). One does not necessarily have to buy new hardware (in the Windows & Linux worlds) if the OS is upgraded.

If the 'cyber specialists' on this boat are worth their salt, then there should be no problems in re-writing any drivers for any new OS. I suspect that they may not be of that calibre. I stand to be corrected.

If they have XP then their system could quite easily be upgraded to Win 7 (or even Win 10) without, I suspect, any requirement to change the drivers for external systems - or buy new hardware!

[Scot Dutchy]

It seems another MOD balls up. Do they have any planes for this tub? Really what in the hell are they going to do with it? I suggest mooring it in the Thames for temporary accommodation for inhabitants of the tower blocks while they are having cladding removed.

[NineBerry]

Drivers and software to interface with a machine are written by the manufacturer of the machine. There is not only the technological aspect but also the regulatory aspect. When a piece of hardware and a piece of software were developed for and tested with a certain environment, you cannot just change something in the environment. Regulation would require to do all the testing again, maybe have the system validated again in many different manners.

The company who originally produced the hard/software might not even exist anymore.

[Alan B]

Drivers and software to interface with a machine are written by the manufacturer of the machine. There is not only the technological aspect but also the regulatory aspect. When a piece of hardware and a piece of software were developed for and tested with a certain environment, you cannot just change something in the environment. Regulation would require to do all the testing again, maybe have the system validated again in many different manners.

The company who originally produced the hard/software might not even exist anymore.

True - up to a point. In this particular case, the boat was ordered in 2007 and construction began in 2009 (Wiki). XP was only copyright up to 2001 - it was 6 years out of date before the boat was ordered. (Win 7 became available in 2009).

There was no bloody excuse to use XP. Some civil servant or some 'lobbied' MP needs a kick up the arse.

[NineBerry]

They might use components that were designed long ago. We have the same issue in medical IT. You have a device and some software interfacing with it on say Windows XP. This was developed maybe 15 years ago. The system works. So, it is still sold. Driver development and regulatory affairs are very expensive. Why should the manufacturer of the device invest that much more money just so that the system uses a newer Windows version. The company originally developing the system might not even exist anymore, but the product is still being produced according to specification.

I can image that regulatory affairs are even more complex and expensive when producing stuff for sensitive military use.

[Alan B]

They might use components that were designed long ago.

This immediately came to mind:
"Sir, I've been able to source a remote controlled Bronze Canon on Ebay..."

But seriously, I would think that there is a need, particularly in the military, that if a manufacturer of, say, a missile launcher, goes out of business, then any software design procedures should be archived and be available for future use and modification.

[NineBerry]

They probably are. But hiring people to do all the software adaptations AND (again!) all the regulatory stuff is expensive. And all that just for supporting a new operating system version?

[Alan B]

Of course it's expensive. But we are talking about a NEW boat with (one hopes) new equipment. If you were responsible for such a design would you choose an equipment manufacturer who had gone out of (or was about to go out of) business?
It's a different situation if equipment that has been in use for years (in a hospital) and 'suddenly' the manufacturer is no more. The hospital will be left with still working but obsolete equipment on their hands. The expense will be providing new equipment - which should be what has happened with this new boat.

[NineBerry]

I suppose that in this context, stability is more important. If you have a system that has been working and tested for 20 years, why change it so to have some fancy new Windows running it? Introducing a new environment does produce side effects. Why risk to introduce some new problem with that? It's different for normal consumer or business software. But critical areas like Military, Medical, Nuclear, it is much safer to keep an old system (when isolating it) than changing it to run on new systems.

[Hermit]

Isn't it possible to securely ringwall the ship's computer system sufficiently to prevent any malware entering or unauthorised information leaving regardless of its internal network's OS? It's not as though firewalls must run on Win XP, some sailor can receive an email with a Trojan attachment from an onshore mate or some IT maintenance officer should be able to install a rogue program via thumbdrive, or something like that, is it?

And maybe the system is actually running on Unix made to look like XP to mislead unfriendly prying eyes.