• Welcome to OS2World OLD-STATIC-BACKUP Forum.
 

News:

This is an old OS2World backup forum for reference only. IT IS READ ONLY!!!

If you need help with OS/2 - eComStation visit http://www.os2world.com/forum

Main Menu

Windows-based cash machines `easily hacked`

Started by miturbide, 2008.03.05, 05:05:55

Previous topic - Next topic

miturbide

http://www.os2world.com/content/view/17344/2/
QuotePosted by Martin Iturbide - Wednesday, 05 March 2008


Guys..... .. .

It was finally time that this get documented on the press.
We all know that this was happening.

But what is interesting also is how the author get flamed for writting this article. "Written by an anti-Windows journalist" said someone.

We all predicted that with an Windows ATM network the costs of maintaining it will raise, antivirus has to be bought, patches need to be applied, etc. And now this author gets a source that says that there is more downtime on Windows ATMs.

I think that this was easily predictible.
Martín Itúrbide
OS2World.com NewsMaster
Open Source Advocate

Skype - martiniturbide
Google Talk - martiniturbide@gmail.com

saborion2

This article should remind one about one of the  Ian Flemming movies starred by the famous actor - James Bond (007) The name of the movie - "Never Say Never". From all appearances the legendary OS/2 Operating System could very well sooner rather than later get the long overdue attention it deserves from OEMs in particular. The rest could be history for OS/2 programmers who have been languishing over the more recent years.!!!

warpcafe

Oh, come on folks!

Although I like to see our predictions proved... no bank will ever re-install OS/2 on their ATMs, not even speaking of eComStation. And here's why:

Imagine that you would be the IT guy of a bank in charge of your (let's say) 250 ATMs... which is ridiculous little BTW... how would you get a support contract from IBM if you plan to install OS/2? How would you get the contract if it was eComStation? Choose between Serenity Systems (sigh) and Mensys (cough)... wake up:
What it needs is people with toolboxes driving around in cars wearing "eComStation support" on their blue collars. Where is the company that can guarantee such people to be available anywhere in a town/country within 24 hrs? If I was the guy in the bank IT dept., I would choose whatever company and OS that grants me a 24hr service and immediate troubleshooting for my ATMs.
It is the service provider and the service level and the cost that is taken into consideration for a bank - not the OS, they give shit on that. To become a service provider for a bank you need to have a critical mass of people that can deliver... and there's myriads of folks that "do windows", some "do linux" and very few die-hard zealots that "do eCS/OS2"... if you were a service provider company - what OS would you chose in order to get enough cheap people that are somehow reliable to actually provide a service and comply with SLAs?

Okay, never say never: Perhaps someone will open a company specialized on ATM and services that focuses on OS/2 or eCS. Then the only thing it takes is to get 1 or 2 companies and you're in the game... of course, yeah - that might work. But let's face facts: There would rather be such company that uses a Linux flavour instead... simply for the license cost for the OS at least.

Regards,
Thomas
"It is not worth an intelligent man's time to be in the majority.
By definition, there are already enough people to do that"
- G.H. Hardy

BigWarpGuy

The people with the 'eComStation Support' shirts will be like the Maytag man (in the commercials) where they would not have much to do since eCS works so well.  ;D   8) 

Isn't one of the reasons IBM won't open source OS/2 because there are ATM's that use it?  ???

kim

Well, here are some few nice photos of various Windows system that crashed..

kim


kim


kim


kim

Well, going back on track again; yes, it's true that ATM can be hacked and as noticed in the various above pictures; some of them crashes. But, beliving that this would be the opportunity for any kind of OS2 package is to have false hopes. As already said, there is no organisation that can support for example eCS and even if ATM quite often uses standard PC's or PC-components the issue with hardware issues would still be a factor and it won't be better when quite a few of them are using more mini & pico boards to minimize the size of the units and minimize the components involved.

About vulnerabilities that makes Windows based ATM hackable or vulnerable - take the same specification used on the Windows ATM and apply that on an another OS and you'll find similar or other vulnerabilities that can be used to take the system. Of course, the system has to be hardened and configured according to protect the customers. Reading that quite a few of the ATM are sending the customer info un-encrypted and it's only the PIN-code that's encrypted. Well, then it would be safer to find weak protected ATMs and analyse traffic from them instead of installing skimming equipment.

Recently there has been some interesting stories here in Sweden regarding break in to bank offices to install equipment to wire tap local system and perform money transactions with the data collected. An IKEA department store last week had to go public and warn customers that they've located false card readers that had been manipulated to skim cards. So the weakness of system can be found everywhere and for banks it often just a matter of risk calculation on how much money the should spend to prevent the risk. Problem is that if the security gets in the way of the customers, the banks would rather go for a lower level of security than risking losing customers.

saborion2

The Beginning of Understanding:

Hi "Warpcafe"! With regards to the statement you have made above in which you stated among other things; "Imagine that you would be the IT guy of a bank in charge of your (let's say) 250 ATMs... which is ridiculous little BTW... how would you get a support contract from IBM if you plan to install OS/2? How would you get the contract if it was eComStation? Choose between Serenity Systems (sigh) and Mensys (cough)... wake up:
What it needs is people with toolboxes driving around in cars wearing "eComStation support" on their blue collars. Where is the company that can guarantee such people to be available anywhere in a town/country within 24 hrs? If I was the guy in the bank IT dept., I would choose whatever company and OS that grants me a 24hr service and immediate troubleshooting for my ATMs.
It is the service provider and the service level and the cost that is taken into consideration for a bank - not the OS, they give shit on that. To become a service provider for a bank you need to have a critical mass of people that can deliver... and there's myriads of folks that "do windows", some "do linux" and very few die-hard zealots that "do eCS/OS2"... if you were a service provider company - what OS would you chose in order to get enough cheap people that are somehow reliable to actually provide a service and comply with SLAs?

Okay, never say never: Perhaps someone will open a company specialized on ATM and services that focuses on OS/2 or eCS. Then the only thing it takes is to get 1 or 2 companies and you're in the game... of course, yeah - that might work..." Read again what was stated in the top line of this comment; and, here it is again - "The Beginning of Understanding" (yours) and this was appropriately written because of your "Then the only thing it takes is to get 1 or 2 companies and you're in the game" (this reminds of a Biblical verse which goes something like this; "Where two and three are gathered in my name there I am also..." which brings me back to the recent New York Giant's Championship win; besides, as far as those "big" lottery games around the world goes - they say that "you have to be in it win it". So, here is the question for you: Lets suppose your target market size is not "250 ATMs..." but millions of folks caught up in the U.S. Sub-Prime fiasco along with millions of small and medium businesses around the world needing a reliable Operating System like that of OS/2 without the overheads attached to "Windows" and "Linux". Do you see the "big" (TCO) picture about choosing OS/2 over "Windows" and "Linux".  ;) !

Saijin_Naib

TRAPS and SIQ issues, high licensing costs, and no real support from anyone. Fail. I am sorry.

saborion2

"TRAPS and SIQ issues, high licensing costs, and no real support from anyone. Fail. I am sorry". "Saijin_Naib", Can you please elaborate.

Thanks.

RobertM

#12
Quote from: Saijin_Naib on 2008.03.05, 19:45:36
TRAPS and SIQ issues, high licensing costs, and no real support from anyone. Fail. I am sorry.

TRAPS:
OS/2 doesn't trap as much as Windows bluescreens in such setups (ATMs - or the old bank workstations running Warp 3 or 4 on IBM PCs). The ATM manufacturers worked with IBM to choose the best hardware for their machines and OS/2. As a for instance, my 8 year old Netfinity has never ever ever ever trapped (or crashed) - ever.

SIQ Issues:
SIQ Issues are programming issues. It's not so much that the GUI doesn't respond (which it doesnt - but that's not the REAL issue), but more accurately that, even though it is spelled out multiple times in multiple places in the IBM Docs, programmers don't follow IBM's programming rules - if they did, a program would have a separate thread monitoring it's queue messages ensuring there was never a queue deadlock.

Thus, the SIQ "fix" later added to Warp is actually a "Well, we wrote this to deal with programs that were not written properly because the programmers did not follow the instructions" routine.

HIGH LICENSING COST:
Windows, in such an environment, is just as if not MORE expensive in terms of licensing. As a matter of fact, technical merits aside (at the time I chose OS/2 for my servers, over a decade ago), one big consideration was in order to have the ability to have more than a few clients connected at a time, I had to pay MS out the ____ to enable that functionality - not so with OS/2 - no artificial user limits are imposed.

You also are not taking into account the plethora of updates, anti-virus software, anti-spyware software, real firewall software, external firewall, a FAR larger support team* (and on and on) that a Windows box needs - which drives up that cost even more. In the end, a Windows based solution is FAR more expensive.

* As for the "a far larger support team" comment, almost 10 years ago, IBM was bidding against... IBM... (no joke - two different divisions) for a support contract for Bank of America for ALL their OS/2 boxes (workstations AND ATMs). The division of IBM that was going to sub-contract some of the work out to me lost (sadly) - but basically, I (and 1 other person who worked with me) would have been responsible for the entire Eastern Seaboard of the United States. If these were Windows setups, you'd be looking at a support team in the dozens or hundreds. Add up that cost difference.

Real Support:
Just like they do with MS, the ATM vendors have support contracts with IBM. Even today, many of them do, simply because there are still many ATMs that use OS/2. So, needless to say, both (a) the ATM manufacturers have their own dedicated Warp/ATM support team, as well as (b) reps within IBM to provide that team with additional support if the need arises.

Hope that answers your questions and concerns on those issues.

-Robert


|
|
Kirk's 5 Year Mission Continues at:
Star Trek New Voyages
|
|


RobertM

#13
Quote from: saborion2 on 2008.03.05, 17:57:05
The Beginning of Understanding:

Hi "Warpcafe"! With regards to the statement you have made above in which you stated among other things; "Imagine that you would be the IT guy of a bank in charge of your (let's say) 250 ATMs... which is ridiculous little BTW... how would you get a support contract from IBM if you plan to install OS/2? How would you get the contract if it was eComStation? Choose between Serenity Systems (sigh) and Mensys (cough)... wake up:

IBM, to this day, is still willing to support OS/2 in such setups - for a fee (there is even a number to call on their website, where they will happily set you up a support contract). The ATM manufacturers, to this day, still have an OS/2 support team dedicated to OS/2 based ATM support. The ATM manufacturers, to this day, still need to maintain support contracts with IBM for additional support above and beyond what their own inside techs can resolve.

Keep in mind, when the ATM manufacturers started migrating from OS/2 to Windows, it's not like their entire OS/2 support team just up and died. And with a 60% or so migration rate, it's also not like they dissappeared, since there are still tons of machines out there.

The true issue with switching (or not switching) to Windows was the lack of certain multimedia capabilities in a method that cheap developers knew how to access. Virtually every bank saw the "value" in advertising to their customers/ATM users on the ATM itself - and even though there were methods out there to do so on OS/2, they didnt know how to do so cheaply (or at all). If you read some of the initial statements from ATM manufacturers, you will see that:

(1) they claim ad based ATMs are a necessity of the times in order to recoup the cost of doing business (for the bank) and was a requested feature of the banks (which they probably noticed on earlier POS systems... which brings up a funny counterpoint to #2... Giant (Mid-East Seaboard, US, big grocery chain) switched to OS/2 Warp 4 for their POS systems in 2000 or 2002... and guess what? They are serving multimedia ads on their POS systems - and running 2 monitors - and when you watch them turn on an aisle once it's been totally off, you see the neat littke "OS/2 Warp" Bootlogo form v4 - dunno if they are still using it - but they were as of 2005)

(2) the ATM manufacturers claimed one of the key reasons they switched was because they couldn't do it on OS/2 (which was only true in the sense of the older ATMs running a v1.x version of OS/2),

(3) they thought it would be easier to manage and support (MS promised them it would be) - and are finding instead that segments of the ATM install base that took 1 or 2 techs to support are now taking hundreds to support (which makes the needs for #1 even bigger).

-Rob


|
|
Kirk's 5 Year Mission Continues at:
Star Trek New Voyages
|
|


warpcafe

Hi,

I thought everything that could be said about the topic was already said, but... okay.

Quote from: saborion2 on 2008.03.05, 17:57:05
The Beginning of Understanding:
(...)
Read again what was stated in the top line of this comment; and, here it is again - "The Beginning of Understanding" (yours) and this was appropriately written because of (snip)

Okay, and here's for the beginning of understanding (yours, not mine this time): ;-)
That "All it takes is 1 or 2 companies" should have had an explicit <ironic> tag with it I guess... any idea on the probability of getting only 1 company to replace their ATM software by a not-supported-any-longer OS/2 or a no-support-at-all eCS? :-)

To make it clear:
I would be the first to pop the corks for eCS if I'll see it running an ATM - but let's face facts:
Some ATMs are just used to dispense cash. Ok. But looking around here in Germany, these machines get more sophisticated and are targeting to replace humans... meaning, everything that can be done at a counter will soon be done on an ATM - or to call it that way "a multipurpose bank terminal". This means that banks also want to run their web-based applications and their multimedia adverstising on them. Get the picture? I am talking about you looking at an OS/2 or eCS ATM screen and all you'll see is a large empty frame with a jigsaw "(puzzle") piece and a link that says "CLICK HERE TO INSTALL PLUGIN"... :-)

Okay, come up now and tell me that this is nonsense... I know that it only depends on the efforts to get that things running on ANY platform. Yeah, but why should someone waste time and money to overcome such obstacles if he simply can avoid to mess around with them by selecting another platform, for heaven's sake?
If you were in charge of it and the CIO, CEO and CFO are asking you "what are the possible solutions"... then I guess you know what the decision will be if you tell "we can take OS/2 or eCS, do some proprietary additional hacks for about 1.2 million US$ that will take several months with no support at all - or call either Wincor-Nixdorf or Diebold and they'll give us ready-to-run Windows systems next week with 24-hr support"...

Regards
Thomas
"It is not worth an intelligent man's time to be in the majority.
By definition, there are already enough people to do that"
- G.H. Hardy