Hello, support? What do I click if I want some cash? UK banking giant Barclays has become the McDonald's of bork as its ATMs continued their parade of Windows-based shame. Register reader "Head of IT, Phil" spotted these examples of Barclays borkage in the Scottish city of Aberdeen, demonstrating that the bank is apparently as incapable of keeping some of its ATMs upright in …
Obviously.
Windows is not, never was, and will never be, suitable for embedded applications (which is what this is).
Any compliance department that signed off on the idea of Windows running an ATM (or warship) is in itself not fit for purpose, and needs replacing with one that is.
And any board of directors that is happy to employ a compliance department that is happy to sign of on the idea of Windows running an ATM is inself not fit for purpose and needs replacing ...
”Windows is not, never was, and will never be, suitable for *embedded* applications (which is what this is).”
Agreed. Why don’t they just replace embeeded Winzo$es with good’ol deskto versions. You know, an ATM AD account for everyone with a debit card, crtl+alt+del to login and voilà, problems gone!
Yes, I know. Don’t bother with me coat.
Though Windows has all the grace of an elephant doing a monkey dance and the virus potential of a public lavatory, it still has to be given credit for being easy to integrate into existing Windows architecture. This include dead-simple control with Group Policies, which I rave about to this very day.
And follow the money. Wherever you have a big megacorp (M$ here), you have potential fat rolls of bills being exchanged under the table (and yes, this had happened before - look up Microsoft and local governments)
Quite a few years ago, I was shown how to access the windows system built into EMC Clariion storage arrays
I will always remember the look of glee on the face of one of our penetration testers, when I told her that our company's new photocopiers contained a full implementation of Windows NT and were connected to the internal network. And of course a photocopier must retain, somewhere, images of documents of which it is producing copies...
And of course a photocopier must retain, somewhere, images of documents of which it is producing copies...
Indeed they do. I remember watching something a while back (probably on YouTube) here a guy went around buying second hand photocopiers...they all had bog standard hard drives in them, which he took out, hooked up to a PC and voila....terrabtypes of TIFF files of everything that had ever been photocopied or printed. A scary enough though, but at least one of the machines in question had been previously used by a police force
>And of course a photocopier must retain, somewhere, images of documents of which it is producing copies...
Yes and so do many printers,. It is a big headache in designing fully functional secure infrastructures for those that require (and demand) real security.
However, if you speak nicely to enterprise secure printer sales at HP and other vendors. you will find they do sell versions which support certificate-based HDD encryption and memory overwrite etc. to remove all traces of (the de-encrypted) print file from disk & memory. Most companies don't use this style of machine as they are both expensive and tend to require a user (and 'owner' of the print file) to be present to oversee the printing.
Why on earth would the photocopier hard disk store and retain the copy/scan images indefinitely? That's surely an obviously bad thing to do from a security perspective. It also means that you need to spec a larger hard disk than you would otherwise require.
The sensible thing to do would be to auto-delete files after 24 hours, and also to delete all images on power up (both to aid decrufting in case the copier has previously got into an unstable state requiring a reboot, and to ensure that somebody aacquiring a second-hand copier can't access any not yet auto-deleted files from the previous owner)?
And even just "tell the filesystem to mark this as deleted" is extra development work and something that ought to be tested and may have unfortunate failure modes. It might be "sensible" to implement it, but if the market doesn't insist on it there's no economic incentive for the copier vendor to do it.
Which is why a former employer of mine had a contractual agreement with the supplier that said that if the device had to go off-site to be repaired, or was being disposed of, the HDD/SSD came out before the device left our premises and it was to be retained by us - usually for destruction.
We did have to padlock-and-chain the devices to the floor to stop some jobsworth just taking one away, but that was one data loss pathway that was blocked.
I would laugh at these poor decrepit cash machines, except I recently lost 2 evenings of my life upgrading a family members computer from Windows 7 to Windows 10 because he was scared that it would be insecure. The reason for his concern? He received an email off Barclays telling him his computer needed to be upgraded and should not longer be used for online banking.
"... mail the appropriate customers ..."
Unfortunately, in the words of the late Douglas Adams, no bank gives a fetid dingo's kidneys what OS you're using. The purpose of instructions like these is to pass the buck for online banking "security" to the user. If you haven't done what they told you to they can say it's your fault when your account is raided.
As a lawyer friend said a long time ago "the banks don't have better security than you, they have better PR". They're also adept at sidestepping responsibility.
> Barclays were at least intelligent enough to log the user agent data
> from Online Banking logins
Epic fail on your part.
You shouldn’t even believe it’s from Barclays, FFS. Any email claiming to be from a bank - whether it’s your bank, another believable bank or the National Bank Of Nigeria - MUST be deleted unread.
I guess that it must be one of those wonderful UK banks that 18 months after the due date still cannot provide confirmation of payee? Until they put their house in order they cannot complain about anyone else's security practices.
Off colour banking in the UK is only for the very strong-willed and hearted.
Does this particular family member also click on links in random emails from eBay, Amazon and Paypal to login and confirm their details? The day I start taking IT security instructions from my bank is the day I chuck all my computers in the bin and buy an abacus.
Sadly, he probably would. He got caught with the "we are calling from Microsoft, your computer has a virus" scam to a point of letting them start controlling his computer remotely before an intervention saw the network cable ripped out the back and the phone put down.
The funny thing is, on those sorts of attack vectors, it really doesn't matter what version of Windows is on the machine!
When those scam merchants ask me to download the software and allow them to connect I have a surprise. I tell them I'll need to hang up to get on the internet which usually is met with protests. I explain that the modem has to use the phone line to dial the internet and no I don't have a mobile. After they get over the "You're using Dialup???" I explain that I've only really got the computer for online banking and shopping.
I hang up after promising to download the software and go back to what I was doing. A couple of them actually called back only to be met by Barry from Birmingham who runs a small garage/workshop. The fun I have had telling them their big end has gone. You don't see too many of them around for an Austin Princess anymore. If they can give me their bank details I'll get looking for one.
Since ditching the landline number I get less of these calls.
Saw an older customer rushing around a store today "where is the toilet roll, I need toilet roll" he said.
Store assistant showed him... "Is this kitchen roll? I need Kitchen roll!"
Poor chap was worked into a crazed frenzy because of the news stories of "toilet roll has run out" and seemed to have no idea what he was doing.
Point? How do we help these people? The scams are bad. But I think the problems are much much deeper.
Deep fried Mars bars are not a staple here in Scotland. I have NEVER been in a chippy which offers them, though some will do them as off menu items on request I have also NEVER been in a chippy where someone else orders one. Most people of the right age have tried them from the time when they were all the rage, but the idea that we mainline deep fried Mars bars is bogus.
Calzones are popular and most chippies offer them. A cheap and cheerful option is chips and cheese or chips and curry sauce or if you are in funds chips, cheese and curry sauce. Since I'm genuinely gluten intolerant these are options for me though some, including the one round the road, do an unbattered smoked sausage which being German in origin does not contain any filler so is gluten free. So I can have a sausage supper.
If I want a battered fish supper I have to break out the deep fry setup and do for myself. I have smoke detectors and never leave the kitchen while deep frying. I find a simple tempura batter works very well.
I do a good line in gluten free sourdough doughnuts (ring variety). You pipe rings of batter onto squares of greaseproof then invert these into the hot oil, using tongs to peel them off the forming doughnut.
Living in Aberdeen, deep-fried Mars bars are common. Especially as it was invented in Stonehaven which is just down the road.
Thing is, they're actually pretty damn tasty. Have to admit to having a couple myself over the years - although mainly when visiting Stonehaven with guests (always nice to buy one from the original source of the craze).
What's a "chippy" in English? Is it like a "fish and chips" place were one drinks lots of beer. Is it any place where there is only beer? I thought that a "chippy scot" was an upbeat, friendly talkative Scotsman, but I could be wrong. Maybe it's a Scotsman who hangs out in bars and drinks beer?
I remember when Barclays Cash Points were based on a rubber belt on rollers that whirred and clunked as it trundled between the various options. They worked OK; gave out money, printed balance on a bit of paper - everything that current machines do - and support probably consisted of a regular oiling of the mechanism.
we're sure that somewhere in the bowels of the bank is an IT professional with head in hands, saying: "I told you this was going to happen..."
I'm sure that said IT Professional is not there any more I'm afraid. They were a contractor who said "No" to their across the board rate cutting.
Pay peanuts and all that...
7th June: "Dear sir, your account is 10p overdrawn. We are charging you £10 for this letter."
14th June: "Dear sir, your account is £10.10 overdrawn. We are charging you £10 for this letter."
21st June: "Dear sir, your account is £20.10 overdrawn. We are charging you £10 for this letter."
28th June: "Dear sir, your account is £30.10 overdrawn. We are charging you £10 for this letter."
3rd July: "Dear sir, we have bounced (a standing order) due to insufficient funds. We are charging you £25 for this letter."
4th July: Me: "I'd like to close my account, please."
(True story - I had just started work and joined because they had a branch onsite where I worked - yeah, it was a long time ago!. Anyhow, I asked how they justified £10 for a letter, and why they felt the need to send another letter every week, and the answer was that they had incurred extra expense by sending me each letter. I tried pointing out that I was losing a morning's pay to see them in person, their letters - in fact the whole process - were automated and hadn't required ANY human intervention and certainly not £10-worth of computing power, electricity, ink, paper and postage, and while I could understand one letter the rest were not jut overkill but an insult. Especially since my "unauthorised overdraft" was incurring something like 30%/month 'fees' and the interest would be added when (ha!) I cleared my unauthorised overdraft!... and yes, those fees would be levied on the letters too. I also pointed out that one of my workmates had gone considerably more overdrawn than I had but not received any letters. I'm sure the fact that his parents had their mortgage through Barclays didn't affect the branch's behaviour in any way...)
I had a similar experience with Natwest. Every time they wrote to me, I replied, thanking them for the information and explaining that the account would revert to credit within a day. I also enclosed a bill for my letter - £15 a time. Over about a year, they ran up a bill of over £550 with me. I wrote to them demanding payment, explaining that I was billing them for the time taken to deal with their correspondence....
I received a letter telling me that they considered my claim "frivolous".
I went to the local Crown Court and issued a Small Claims Summons against the manager of the branch (with the help of the Clerk of the Court, who thought it was a great wheeze).
I managed not only to get a major branch of Natwest chained shut on the last Friday of a month, but I also got the Bank Manager collected by Bailiffs and "escorted" to the Court where he had to wait until mid-afternoon for the case to be heard.....
The Magistrates found in my favour and issued a Costs Order as well - I collected a total of ~£1150 from the Bank and closed my account.....
Word of warning - subsequent experience shows that ALL the UK banks are equally inept!
Around 1999 I was a software contractor at Barclays. As well as Y2K checking I was part of a team developing an updated teller package. My main responsibility was testing. I was amazed at how many "deal breaker" problems that I discovered were "signed off" as "not critical" and, therefore, not going to delay the roll-out. One bug involved account opening which checked for post codes, PO boxes and BFPO addresses (aka our armed forces); it did not accept BFPO's at all.
It would have been a simple problem to fix but, clearly, someone decided that no one from our armed forces would want to open a Barclays current account......
Meeting the "roll-out" date was paramount. Slippage was a no no; the bugs would be handled later by a different team - with a different budget perhaps.
A lot of the application programmers were ex-counter staff that had been "retrained". I think that tells you all you need to know.
I would assume, back then anyhow, everything could be fixed "manually". There seems to of at least been the idea in the industry that a phone call, or paper list, could fix any computer problem.
So not so much lack of respect to the forces, but lack of respect to the IT staff offering to fix something that would be a logistical paper trail nightmare later down the road.
Most systems would have had paper based backups/phone system backups should the computers/power/hardware fail. But too much reliance on this is possibly shown by the constant system failures, where cash machines/stores/internet banking now fails, and the old "get out the carbon copy card swipe machine" no longer fixes it.
The interesting question (and probably only Barclays IT department will be able to answer) is whether using Windows 7 on an ATM really is a security risk.
Sure, Windows 7 is no longer supported and can be remotely hacked, but that only matters if the machine is accessible from the Internet. If the ATMs only attach to a private Barclays network that isn't reachable from the outside, then the risk should be minimal.
Crashing the machine with "you need to upgrade" popups doesn't help anybody here.
A relative used to work at a co-op bank branch many years ago. She tells a tale of a new account opening for an Indian restaurant "taste of the raj" where they accidentally typed a T instead of a J.. Cheque book even reached the customer before it was spotted..
When the wife opened her account, for some reason they fucked up putting the right address on it, and managed to put the first line of the address, and the branch's postcode. Cue six months of her statements (understandably) not getting delivered before her account got suspended because they were returned to sender.
Cheque book even reached the customer before it was spotted..
Many, many yeas ago, my father and one of my brothers both banked at the same branch of Midland bank. Said bank sent one of my dads chequebooks to my brother.
He, not noticing the different initials (his only had one letter different) used about 10 cheques before he noticed (about £120 - which, in the late '80s, was a decent sum). Said cheques had *his* card details on the bank but Midland honoured them anyway (showing how little notice the banks actually took of that).
Dad phoned up the bank, got nowhere (except the statement that he needed to take his own son to court to recover the money).
So it got escalated past the local bank manager to Midlands regional management. Who promptly grovelled, refunded the money (without taking it from my brothers' account) and, we later heard, redeployed the manager upwards to a role where he didn't actually have to make any money or customer related decisions.
That whole thing started me on the "I'll never use a bank again" trend (that was confirmed by how Lloyds treated me as a student). Which is why I've had a Nationwide Building Society account for 32+ years..
No, but it would have opened up an entirely different set of problems.
We're currently dealing with some legacy OS/2 applications in the field. The major problem is finding replacement hardware that OS/2 runs on. We've been trying to migrate to ArcaOS. but finding programmers with the skills to maintain and develop OS/2 3.x drivers has proven just as challenging for us as it was for our customers to find 8GB IDE hard drives and Pentium processors.
And given that many of the ATMs were running OS/2 1.2 and later 1.3, and never updated to OS/2 v2.0, let alone Warp or Merlin, that problem would only grow.
I worked at IBM from 1990-1992, and I ran it as my home system until 1996, when NT4 came along and beat the stuffing out of if. I liked it for what it was, but I don't have any illusions about it being a cure-all for modern problems.
ATMs are a relatively benign application as real-time systems go. Windows is widely used in industrial systems**, often with a tweaked kernel to enable real time operation. To make matters worse suppliers integrate their development platforms with Microsof's Visial Studio so the code isn't just running on Windows but developed for and inextricable from Windows.
I was horrified to find this out when I first got involved with industrial electronics but you get an incredible level of pushback from management if you suggest that there's something inherently wrong with this approach. Fortunately for me I'm retired, more or less, and since Windows development is somewhat of a dead end I cn just back off and let Nature take its course.
(Two that are common but El Reg readers may not know about are TwinCAT and ApplicationStudio. A lot of this software is European -- most industrial automation stems from Germany at the moment.)
Oh lord, TwinCAT...
Had to support a multi-spindle machining center that ran on that monstrosity.
Virtual cam system using hydraulic servos on each axis, real-time positioning to 12 microns, all running on a bespoke NT 4 computer that was forever stuck in German locality. To say nothing about the failing harddrive and BIOS battery that always went flat.
BECKHOFF was "kindly" called "FECKHOFF" more than a few times...
Mazak was using XP Embedded for a while. Heard all sorts of fun tales from the service techs about operators installing stuff on them, or infecting them via USB drive.
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2024
