First Windows XP Security Problem Microsoft Won't Fix

[J529]

http://www.businessweek.com/articles/2014-04-28/the-first-windows-xp-security-problem-microsoft-wont-fix

Microsoft warned many of its customers that they were on their own earlier this month when it stopped supporting XP, an older but still widespread version of its Windows operating system. The software remains functional, but Microsoft won’t fix its newly discovered security holes, leaving those who haven’t upgraded to a newer version vulnerable to a future hacking attack. It didn’t take long to find one.

Over the weekend, computer security company FireEye said it had noticed a number of attacks on U.S. firms via a vulnerability in various versions of Microsoft’s Internet Explorer. If successful, the attacks can force a computer to run code of the attacker’s choosing, which could extract data or send spam. More than 26 percent of desktop computers used the affected browsers last year, according to NetMarketShare. FireEye gave the attack a name—Operation Clandestine Fox—but wouldn’t say much about the extent or targets of the attacks.

Microsoft is working on fixing the IE problem. The fix, though, will not be sent to machines running XP. As of the beginning of this month, XP was the world’s second-most-popular operating system in terms of Internet usage, according to StatCounter, and was the OS of choice of more than 18 percent of Internet users. In an e-mail to Reuters, the company suggested that people update their systems.

Story: End of Windows XP Support Means Added Opportunity for Hackers

There are other things that could protect XP users from attacks. The vulnerability exists in a Web browser, which means that it can only be exploited if victims use that browser to visit a website designed to attack them. “An attacker would have no way to force users to visit these websites,” wrote Microsoft in a security advisory. “Instead, an attacker would have to convince users to visit the website, typically by getting them to click a link in an email message or Instant Messenger message.”

This almost certainly means that this won’t lead to the kinds of devastating attacks on ATMs some security experts wrung their hands about earlier this year. Many ATMs and other industrial computers have been built around their operating systems, making it a difficult task to upgrade to a new OS. As a result, many continue to run XP even though their makers had ample warning to switch to a newer version of Windows.

Aravinda Korala, the chief executive of KAL ATM Software, wrote earlier this month that any ATM Armageddon is a ways off. “Most bank ATMs are very well protected,” he wrote in ATM Marketplace, a trade publication. “They are connected on a private network with no Internet access. They are locked down tightly so that only the minimum functionality necessary for the ATM to operate is allowed.” For one thing, ATMs don’t click on suspicious links.

[TOMapleLaughs]

Internet Explorer is vulnerable?

You don't say...

[avelanch]

who the frack uses IE?

[Blame Obama]

me

[AbbyNucksFan]

my wife does.. even after years of trying to convince her not to.

[Rick Grimes]

If you're still using IE, you really should just take a hammer to your CPU. It would be faster.

Mozilla Firefox and Google Chrome are both vastly superior browsers.

[Down by the River]

IE is better than Firefox. Firefox was great and then did nothing and slowly IE has become better. Or so I've been told. I only use chrome.

[Grapefruits]

IE is better than Firefox. Firefox was great and then did nothing and slowly IE has become better. Or so I've been told. I only use chrome.

I gave up on IE years ago because it was sooooo slow. I switched over to Firefox and loved it. Last while, it's been getting buggy and locks up.

I started using IE from time to time. It is way better than it used to be. Runs fast and works well.

[drummer4now]

IE is better than Firefox. Firefox was great and then did nothing and slowly IE has become better. Or so I've been told. I only use chrome.

Thats because the add-ons slow FF. The FF of 2005 before it became mainstream was revolutionary lol until Chrome came along and ripped it off.

[Tre Mac]

I use IE whats the big deal. Doesnt Google harsh spy on you? Not that any site I goto is questionable I just hated searching for something about WoW and having all these 'escape dept' sites pop up.

[drummer4now]

I use IE whats the big deal. Doesnt Google harsh spy on you? Not that any site I goto is questionable I just hated searching for something about WoW and having all these 'escape dept' sites pop up.

Dont know about Google, but Microsoft openly gives user data to the NSA. Like outlook mail, bing search history, etc..

[Mr. Ambien]

IE is better than Firefox. Firefox was great and then did nothing and slowly IE has become better. Or so I've been told. I only use chrome.

I switched to the Phoenix browser over 10 years ago.

In the 90s Netscape was the popular browser, then IE. Both browsers wound up being large piles of exploited mess.

Something happened with the Netscape developers and they went on to make Phoenix, which later became known as Firefox.

I thank the pixel heavens for this browser. Because of Microsoft's antitrust problems, there was virtually no competition, and Microsoft was perfectly content (being that they had something like over 95% browser marketshare) having in the late 90s/early 2000s a highly exploitable browser integrated with virtually every aspect of their operating system and not empowering individual users to take control and fix it.

Then came Phoenix and it was like a proverbial second coming of Christ.

And while I don't use Firefox anymore (I use Chrome like you), I definitely appreciate the advances browsers like Firefox helped push. This is why competition is always better for the end user/consumer.

Dont know about Google, but Microsoft openly gives user data to the NSA. Like outlook mail, bing search history, etc..

It's really moot, Google does too, and most other companies. And when they don't, the NSA has data mining centres that relay real-time data from major backbones and trunks (that all phone calls and data traffic goes through in a region) indiscriminately and stores it for... "national security" purposes, aka whatever they want.

[Ronalds.Kenins41]

me

you realize if you go onto chrome there are WAY fewer pop up adds and it runs fasters also because of that chrome is less susceptible to viruses and trojans.

[Ronalds.Kenins41]

I use IE whats the big deal. Doesnt Google harsh spy on you? Not that any site I goto is questionable I just hated searching for something about WoW and having all these 'escape dept' sites pop up.

I would rather by spied on then get a virus and wait forever for pages to load.

By the way I'm not an xp tossed mine out 8 years ago.

[RonMexico]

So let's read between the lines a little. Reported in February of this year, Windows 8 sales not as good as expected. XP is outdated and still used by many people. Let's end support and tell the general public that using XP is a risk to your personal information when it really isn't. Many people rush out to buy a new OS and Windows 8 sales grow. Marketing at it's finest.

[Mr. Ambien]

So let's read between the lines a little. Reported in February of this year, Windows 8 sales not as good as expected. XP is outdated and still used by many people. Let's end support and tell the general public that using XP is a risk to your personal information when it really isn't. Many people rush out to buy a new OS and Windows 8 sales grow. Marketing at it's finest.

No, it's more like, Microsoft doesn't find it profitable to be supporting a 14 year old OS after they've released a handful of others. One can't expect any company to support dated software like that.

Anyways, I use Windows XP still (built this machine back in 2007), when I build a new machine within a few months, will upgrade to Windows 7 Pro/Ultimate, and will use that until they stop supporting it.. probably around 2020. Also plan on dual booting with whatever flavour of Linux I feel like (using their boot loader instead of MS's).

[Heretic]

If you're still using IE, you really should just take a hammer to your CPU. It would be faster.

Mozilla Firefox and Google Chrome are both vastly superior browsers.

This is my 25th year in the IT industry.

Getting tired of stupid "haters" bashing IE - they are the ones that should Shut The Heck Up.

For business, IE is way more stable than the likes of FF and Chrome and is more compatible with business Apps.

At home, I use Chrome for general surfing and IE for business and banking.

25 years, no issues (except when I played with FireFox for a year).

[Raph]

I use IE whats the big deal. Doesnt Google harsh spy on you? Not that any site I goto is questionable I just hated searching for something about WoW and having all these 'escape dept' sites pop up.

If you want to stop companies from spying on you, get off the Internet.

This is my 25th year in the IT industry.

Getting tired of stupid "haters" bashing IE - they are the ones that should Shut The Heck Up.

For business, IE is way more stable than the likes of FF and Chrome and is more compatible with business Apps.

At home, I use Chrome for general surfing and IE for business and banking.

25 years, no issues (except when I played with FireFox for a year).

So what do you do? Desktop support? Anyone who writes code has a mad hate for IE, and for good reason. The hack fixes are always for IE only. They are better at being compliant now, mainly cuz they have since they realized they can no longer bend the will of the marketplace.

[Offensive Threat]

Netscape, then IE, then Firefox, now Chrome. ITs all good. I was running XP up until about a year ago. Win7 now and no plans on Win8. Will see what Win9 is like.

My Mom is one of those people who used IE forever. She didnt even know there was such a thing as other browsers. I told her to try chrome and she said "But all the sites I like are on internet explorer" so thats your typical IE user. Got her to switch to Chrome eventually. Took a while.

[Mr. Ambien]

This is my 25th year in the IT industry.

Getting tired of stupid "haters" bashing IE - they are the ones that should Shut The Heck Up.

For business, IE is way more stable than the likes of FF and Chrome and is more compatible with business Apps.

At home, I use Chrome for general surfing and IE for business and banking.

25 years, no issues (except when I played with FireFox for a year).

If you've really used IE for that long then you'd fully understand why IE has been bashed and not pull the fanboy crap for pixels.

It was impossible to use IE during the mid-late 90s until early-mid last decade and not get drive-by malware, ridiculous amount of pop-ups (some pop-up loops), and so on. Microsoft had NO desire to fix any of these overwhelmingly large problems (that users endlessly complained about) until competition came along and took a massive chunk of their browser marketshare, rightfully.

As for compatibility, that comes with monopolizing the software market, which is why MS has found itself in court countless times over antitrust issues.

I certainly don't mind using MS products, like Windows or Office, but what I really "tire" of is fanatics like quoted poster. Thanks to people like this, companies get away with spending less and less on quality (QA/QC) and instead spend it on marketing. With fanboys like this, all companies have to do is market highly flawed products and the fanboys do the dirty work for them.

Slow adoption of Windows 7, companies mainly skipping Windows ME/Vista/8, people are dissatisfied with Microsoft, and the fact that so many stick around has little to do with how wonderful Microsoft products are. Some perspective would be helpful for you.