[toyg]

> never applied the MS17-010 patch.

Until today, there was nothing to apply if your computers were running XP or 2003. Guess which Windows versions are the most popular in UK hospitals? So I think your sentence should read like "Hospitals just happened to be disproportionately affected by this attack because they were forced to trust Microsoft would never put corporate profit before social responsibility."

[meowface]

XP and 2003 have been end-of-life for years. They both were released 14+ years ago. So you can just change what I said to:

"because a lot of them have ineffective IT departments/mangement and never applied the MS17-010 patch or are running ancient operating systems."

edit: And in fact, Microsoft did release a special XP hotfix for this vulnerability yesterday: https://blogs.technet.microsoft.com/msrc/2017/05/12/customer...

[stuartd]

> because a lot of them are running ancient operating systems that are the only ones that can interoperate with legacy hardware

FTFY

[linkregister]

What news reports said anything about legacy hardware? The BBC and Reuters articles claimed the NHS suffered infection of their patient records servers and their reception computers.

[ptaipale]

Apparently the impacted XP and 2003 machines were accessing the same disk servers as the patient record systems. Thus an infected CAT scanner controller (or whatever) was able to destroy the patient records.

That doesn't tell a story of missing money or maintenance contracts. It tells of poor or even irresponsible and incompetent deployment procedures.

You shouldn't allow your CAT scanner to write over your patient records at a server. You shouldn't even have them in the same network segment.

[throwaway049]

And on legacy software. My NHS Trust seems to have escaped unscathed, but it has software that won't run on modern systems which is why XP is still seen in most departments.

[smitherfield]

What software is that? There is a 32-bit version of Windows 10, which can still run 16-bit Windows/DOS programs, and IE11 still supports ActiveX, Silverlight, Java applets and even (in IE10 compatibility mode) VBScript.

So AFAICT 32-bit W10 can run most anything 32-bit XP can (likewise the 64-bit versions, though neither can run 16-bit programs), and IE11 can run most anything IE8 can (with minor configuration).

Is it software that relies on undocumented APIs? (I can't imagine why hospital software would require exotic methods of poking at the kernel or hardware).

[slackingoff2017]

A lot of times it's the hardware interface that's the issue. Old stuff uses serial and parallel ports, motherboard slots,or even abuses PS2 for other purposes.

Good luck finding a windows 10 compatible PC that has ISA slots for example. A lot of old custom hardware hooked right into the ISA bus

[PhasmaFelis]

There is definitely software made for one version of Windows that won't run on another, regardless of bit count. Not a lot of it, but it's there.

In my experience, industrial software is often pretty poorly designed, so it wouldn't surprise me if it's more common in a hospital environment.

[vmateixeira]

because .. drivers?

[smitherfield]

For what? Surely buying new printers is less expensive in the long or even short run than continuing to use an EOL-ed operating system.

[TheCoelacanth]

XP has been unsupported for over three years and 2003 for nearly two years. Still using them at this point is gross negligence on the part of the hospitals.

[edmccard]

>Still using them at this point is gross negligence

I'd guess that most hospitals don't do in-house development for the software they use. They paid someone else for it, probably at "enterprise" rates; it's hard to blame them for not having the budget or desire to replace working systems with new shiny (complete with new bugs) every X years.

[worldsayshi]

Sigh, we need to fix the software economy. Imagine if the software being used by hospitals and other public institutions was open source as a rule. Then maybe it could actually be reused and collaborated on instead of rotting away with the need of replacing it all when it's just not usable any more.

[majewsky]

If only some guy with a long beard had told us for the last 30 years what was going to happen! :)

[jessaustin]

This thread seems to be a series of "well, they had to make this error because previously they had made this other error"... presumably this can go on ad naseum, but isn't the eventual resolution going to be "spend money to install current hardware and software"? They could have done that at any point in the past. Complicated etiologies for broken systems, miss the forest for the trees.

[edmccard]

>Complicated etiologies for broken systems...

...are how the state-of-the-art is advanced in other industries? Imagine if the FAA's response to an air disaster was, "Never mind root causes, you just should've bought a newer plane".

[ethelward]

If they were flying airplanes from the 50's not supported by their constructors anymore, I'd say it'd be pretty good answer.

[Piskvorrr]

Well guess what. https://www.wired.com/2016/04/gods-green-earth-b-52-still-se...

[Zenst]

Back in the late 90's the government of the time split the NHS into Trusts and outsourced the IT to the likes of ICL (not sure who does it now). With that the last time any major overhaul was done upon the hardware and software was Y2K and as with most outsourced IT contracts it focused upon support from a reaction basis and not a proactive one.

With that the GSN (Government Secure Network) is still a good ring-fence (that's outsourced as well) but once something gets inside, boom.

Now with the Trusts - they do have a local IT bod and in the cases I dealt with, somebody who knew how a PC works and enthusiastic, which is nice but also dangerous and I had to deal with a few issues that were as I call them "enthusiastically driven". As such you have all these Trusts operating at some level as independants and with varity of results.

One case, was one `IT manager` at a Trust who was posting on a alt.ph.uk (UK hacking usenet group) and offering up inside information about how they operated. That did not happen as the alt.ph.uk lot are a moral ethical lot and health services are taboo, so was rightly shot down and equally the chap was soon in talks with security services.

But with so many legacy systems, and an event driven support mentality (again Y2K being an exception) then such events can and will happen. Sadly many trusts lack provision to handle such issues and as with many IT area's are event driven instead of being proactive. Indeed ITIL the golden managment love-in solution for support management is event-driven and many an implementation ticks all the ITIL boxes of compliance and yet still lack proactive support. This alas is mostly gets compared to firefighters pouring water on buildings so they won't catch fire and sadly pretty darn systemic in many an organization.

With that the best anybody in IT can do it to flag up an issue in a documented way to cover there ass then the outlined event does transpire to prevent unfair scapegoating. A sad situation of which many of not all IT support staff in all capacities can attest too.

Ironicaly DOS based legacy systems with no networking and exitic ISA cards in some equally over-priced hardware still work and the need to replace them does become moot, alas that example gets projected upon other systems that are networked. But the whole health industry has many legacy setup's that are expensive to replace, more so if they work and the motivation to limit potential damage from future events above and beyond backup's becomes a management issue that lacks a voice for budgets.