The risk of running Windows XP after support ends April 2014

[Arthur]

Only 227 days to go! Click the link to read the full article.

 

Source: Microsoft Security Blog

 

Back in April I published a post about the end of support for Windows XP called The Countdown Begins: Support for Windows XP Ends on April 8, 2014. Since then, many of the customers I have talked to have moved, or are in the process of moving, their organizations from Windows XP to modern operating systems like Windows 7 or Windows 8.

 

There is a sense of urgency because after April 8, Windows XP Service Pack 3 (SP3) customers will no longer receive new security updates, non-security hotfixes, free or paid assisted support options or online technical content updates. This means that any new vulnerabilities discovered in Windows XP after its “end of life” will not be addressed by new security updates from Microsoft. Still, I have talked to some customers who, for one reason or another, will not have completely migrated from Windows XP before April 8. I have even talked to some customers that say they won’t migrate from Windows XP until the hardware it’s running on fails.

 

What is the risk of continuing to run Windows XP after its end of support date? One risk is that attackers will have the advantage over defenders who choose to run Windows XP because attackers will likely have more information about vulnerabilities in Windows XP than defenders. Let me explain why this will be the case.

 

When Microsoft releases a security update, security researchers and criminals will often times reverse engineer the security update in short order in an effort to identify the specific section of code that contains the vulnerability addressed by the update. Once they identify this vulnerability, they attempt to develop code that will allow them to exploit it on systems that do not have the security update installed on them. They also try to identify whether the vulnerability exists in other products with the same or similar functionality. For example, if a vulnerability is addressed in one version of Windows, researchers investigate whether other versions of Windows have the same vulnerability. To ensure that our customers are not at a disadvantage to attackers who employ such practices, one long standing principle that the Microsoft Security Response Center (MSRC) uses when managing security update releases is to release security updates for all affected products simultaneously. This practice ensures customers have the advantage over such attackers, as they get security updates for all affected products before attackers have a chance to reverse engineer them.

 

But after April 8, 2014, organizations that continue to run Windows XP won’t have this advantage over attackers any longer. The very first month that Microsoft releases security updates for supported versions of Windows, attackers will reverse engineer those updates, find the vulnerabilities and test Windows XP to see if it shares those vulnerabilities. If it does, attackers will attempt to develop exploit code that can take advantage of those vulnerabilities on Windows XP. Since a security update will never become available for Windows XP to address these vulnerabilities, Windows XP will essentially have a “zero day” vulnerability forever. How often could this scenario occur? Between July 2012 and July 2013 Windows XP was an affected product in 45 Microsoft security bulletins, of which 30 also affected Windows 7 and Windows 8.

 

http://i.imgur.com/kB0FKVU.png

 

Figure 1: Infection rate (CCM) by operating system and service pack in the fourth quarter of 2012 as reported in the Microsoft Security Intelligence Report volume 14

 

http://i.imgur.com/U55fNhv.png

 

Figure 4: The table below compares the mitigation features supported by Internet Explorer 8 on Windows XP Service Pack 3 with the features supported by Internet Explorer 10 on Windows 8. As this table shows, Internet Explorer 10 on Windows 8 benefits from an extensive number of platform security improvements that simply are not available to Internet Explorer 8 on Windows XP.

[free780]

Die xp die. Seriousy though will it ever die?

[newpersn]

Die xp die. Seriousy though will it ever die?

We will still run it.

 

Library issue computers (dell 170l)

And papercut release station. Not changing that as it works.

[X-13]

I read about this on el reg... though they sort of made it sound like Microsoft were going to deliberately release exploits to hackers.

 

They [Microsoft] don't seem to realise that when we [us techy types] still use XP, there's a reason for it. Either it's to do with software compatibility or we simply don't have the budget to upgrade.

[free780]

Esp in education there is some very rubbish software that doesn't follow good design. E.g clash with uac.

[Dos_Box]

Moving to IT News forum.

[localzuk]

We're in the middle of our migration at the moment, and have hit those issues - compatibility, budget, things that 'work'.

 

My answer to all has been "tough".

 

We have a legal responsibility to ensure the security and integrity of our data. Having gaping holes in our network is just not going to happen.

 

So, those bits of incompatible software? We'll have to do without until they can be replaced. Those machines that are just too darn old to run Windows 7? Retired. Not enough money to replace right away? We'll have to wait until we can.

 

With the amount of sensitive data that schools store and handle, it is simply irresponsible to leave such holes in place.

[CyberNerd]

XP still has 30%+ marketshare. It seems a bit odd that MS will 'infect' or lead to these products to be infected by withdrawing support. I can't see that it will do Microsofts credibility any good if there is another mass windows virus/exploit and their only solution is 'give us more money or buy another PC'. Cue for a car analogy.

 

There is still a lot of software that runs XP only and not so well in W7. It's still possible to keep using it without sacrificing any 'legal responsibility for needing to but PC's' - however that works. Most will run well in WINE and there are plenty of products (deepfreeze), VDI etc that will allow XP machines to return to base image when rebooted. I can also confirm that XP runs MUCH faster than W7 or W8 in a virtual environment.

[localzuk]

XP still has 30%+ marketshare. It seems a bit odd that MS will 'infect' or lead to these products to be infected by withdrawing support. I can't see that it will do Microsofts credibility any good if there is another mass windows virus/exploit and their only solution is 'give us more money or buy another PC'. Cue for a car analogy.

 

There is still a lot of software that runs XP only and not so well in W7. It's still possible to keep using it without sacrificing any 'legal responsibility for needing to but PC's' - however that works. Most will run well in WINE and there are plenty of products (deepfreeze), VDI etc that will allow XP machines to return to base image when rebooted. I can also confirm that XP runs MUCH faster than W7 or W8 in a virtual environment.

 

Think of it this way. XP still predominantly exists in business environments, and criminals will know this. If you have an XP machine attached to your network, and therefore your domain, you risk allowing that PC to be a security hole. A weak point where, sure, security isn't non-existent, but it is weaker as zero day exploits will exist on it. That machine will be a target for attackers and will be a great place to start an attack on other internal machines by doing things like password grabbing and data collecting.

 

The fact that XP still has 30% marketshare is neither here nor there. Microsoft had a large share of Windows 2000 users after it ended support for it too.

 

Microsoft's credibility isn't at stake here, your data is.

 

You don't have a legal responsibility to buy PCs but you do have one to protect your data properly.

[Arthur]

It seems a bit odd that MS will 'infect' or lead to these products to be infected by withdrawing support.

What that article is saying is that hackers will reverse engineer hotfixes designed for Windows 7 (or newer) and see if the same vulnerabilities exist on Windows XP. It goes without saying that this is not a new development or limited to just Microsoft OSs.

 

Microsoft warns it'll hand out zero days for Windows XP « The Register

 

"The very first month that Microsoft releases security updates for supported versions of Windows, attackers will reverse engineer those updates, find the vulnerabilities and test Windows XP to see if it shares those vulnerabilities," said Tim Rains, Microsoft's director of trustworthy computing, in a blog post.

 

"If it does, attackers will attempt to develop exploit code that can take advantage of those vulnerabilities on Windows XP. Since a security update will never become available for Windows XP to address these vulnerabilities, Windows XP will essentially have a 'zero day' vulnerability forever."

 

I wouldn't take any notice of The Register's sensationalist headlines. They often bear little resemblance to the article.

 

I can't see that it will do Microsofts credibility any good if there is another mass windows virus/exploit and their only solution is 'give us more money or buy another PC'.

You can't expect any business to support software indefinitely. For example, do you seriously expect Google to support Android 1.5 forever - it is 'only' 4 years and 3 months old!

 

I can also confirm that XP runs MUCH faster than W7 or W8 in a virtual environment.

So does Windows 3.1!

Edited August 17, 2013 by Arthur

[FN-GM]

And papercut release station. Not changing that as it works.

 

For someone in IT its not the best attitude. Surely its all about progression.

 

They [Microsoft] don't seem to realise that when we [us techy types] still use XP, there's a reason for it. Either it's to do with software compatibility or we simply don't have the budget to upgrade.

 

To be honest you have had a long time to overcome this...

[X-13]

To be honest you have had a long time to overcome this...

 

Not really. Curriculum is all Win7. Admin on the other hand is LEA controlled. And they haven't done anything.

 

There's been a lot of talking, but no actual doing.

[localzuk]

Not really. Curriculum is all Win7. Admin on the other hand is LEA controlled. And they haven't done anything.

 

There's been a lot of talking, but no actual doing.

 

Are you a Sims school? You're gonna have issues soon if you're still on XP and are a Sims school...

[X-13]

Are you a Sims school? You're gonna have issues soon if you're still on XP and are a Sims school...

 

We're not a SIMs school... we're an RM school.

 

But there was talk of SIMs during bett.

[newpersn]

For someone in IT its not the best attitude. Surely its all about progression.

 

Its sat on an old p4 box from stone ages. It boots up in less than 30secs and connected directly to the print server.

 

When the library move to the new building in September 2014 I will think about getting on to windows 7.

 

Its just finding the time to play with all the settings to get just right.

[cpjitservices]

XP was and still is a good OS, BUT i think Windows 7 does replace XP. 7 is what XP was. The only thing that annoys me at the moment for software compatibility is that I have a Windows 8 machine - the one im using now - I want to connect to my VMware server via vsphere client, but the server still runs version 4 - version 4 of vshphere client doesnt run on Windows 8. So until I upgrade I have to use a Windows 7 machine to manage my host. I remember all the talks about upgrading to XP when I worked for a school that was running Windows 98, no software will work etc etc - I've never had a problem with XP and software its always just worked, as has Windows 7.

So if you have got Windows XP, make sure you have a damn good AV suite and firewalls correctly configured! I wouldnt like to run XP in any sort of enterprise environment but IF I really had too, theres no way that thing would be allowed to talk to the internet!

[DMcCoy]

XP -> Now = 12 years

 

12 years *before* XP we would be on Windows 2.11 (*almost* 3.0)

 

XP no matter how you look at it, is old.

[Arthur]

XP was and still is a good OS

XP was good, but it definitely isn't now. It's an unbelievable dated OS.

 

XP no matter how you look at it, is old.

I wonder how many people would continue to use XP if they were forced to run it on hardware from the same era? Not many I bet!

 

http://i.imgur.com/s4eRV2L.jpg

 

^ The HP laptop above cost $3,599.99 when it was released at the beginning of 2002 and had a 1.13 GHz Pentium III-M, 256MB RAM, 30GB HDD, 802.11b WiFi, 56k modem, 3.5" floppy drive, 1x DVD-ROM drive and weighed almost 3KG.

[Arthur]

http://blogs.windows.com/cfs-file.ashx/__key/communityserver-blogs-components-weblogfiles/00-00-00-53-68-metablogapi/MS_2D00_WINXP_2D00_EOS_2D00_V4_2D00_FINALnoQuotes_5F00_081413_5F00_35983445.jpg

[CyberNerd]

Only Microsoft could come up with advertising telling us how terrible their older products are.

[SYNACK]

Only Microsoft could come up with advertising telling us how terrible their older products are.

 

I don't know, I've had Toshiba telling me their old products are junk and I should buy a new one. To be fair, the car industry does the exact same thing MS did, the golf platform has ads about an extra 15% space and 40% stronger chassis making it safer than the last one. Maybe if MS had installed extra airbags in Windows you'd be less critical.

[Arthur]

I've had Toshiba telling me their old products are junk and I should buy a new one.

Acer does that too. Less than a month after releasing the Iconia W3, Acer announce they are working on its successor due to how bad the W3's hardware is. Why even bother releasing it in the first place!

Edited August 29, 2013 by Arthur

[Arthur]

 

96% of US schools facing huge cost of Windows XP upgrades « AVAST

[SYNACK]

 

96% of US schools facing huge cost of Windows XP upgrades « AVAST

Does anyone else remember when the us used to be ahead of the curve and seemed to be the source of lots of the education specific developments, what happened, does technology conflict with creationalisum.

[Dos_Box]

XP was good, but it definitely isn't now. It's an unbelievable dated OS.

 

 

I wonder how many people would continue to use XP if they were forced to run it on hardware from the same era? Not many I bet!

 

http://i.imgur.com/s4eRV2L.jpg

 

^ The HP laptop above cost $3,599.99 when it was released at the beginning of 2002 and had a 1.13 GHz Pentium III-M, 256MB RAM, 30GB HDD, 802.11b WiFi, 56k modem, 3.5" floppy drive, 1x DVD-ROM drive and weighed almost 3KG.

 

OMG! I managed a 'mobile classroom' set of 25 of those for 6 years between 2003-2009. At the end it drove me insane how slow they got (still running XP) when I had to patch/update them several times a year it was a major chore.

It would have been great in 2002, but in 2009 I just wanted to burn the lot of them!

 

*I even upgraded the RAM and HD's on all of them to no real effect