End of Windows XP support era signals beginning of security nightmare

Consumer, corporate and even SCADA systems could be at risk when Microsoft stops supporting Windows XP.

Microsoft’s recent announcement that it will end support for the Windows XP operating system in two years signals the end of an era for the company, and potentially the beginning of a nightmare for everyone else.

Best Microsoft MCTS Certification Microsoft MCITP Training
at certkingdom.com

When Microsoft cuts the cord on XP in two years it will effectively leave millions of existing Windows-based computers vulnerable to continued and undeterred cyberattacks, many of which hold the potential to find their way into consumer, enterprise and even industrial systems running the latest software.

RELATED: Critical Patch Tuesday bulletin addresses Microsoft Office attack seen in the wild

MORE: Useful security threat data advisory tools

Jason Miller, manager of research and development at VMware, says the introduction of Windows XP “was the hey-dey of buying computers,” with markets having become familiar with Windows 95 or 98 and manufacturers like Dell releasing affordable options. With such an influx of new users, it comes as no surprise that Windows XP remains one of the most common operating systems despite the introduction of two entirely new versions in the decade since it hit shelves. In fact, March 2012 statistics from NetMarketShare.com show XP in the lead for operating system market share, at 43.09%.

Although that number is on a steady decline, its high volume just two years before support is cutoff is cause for concern, Qualys CTO Wolfgang Kandek says. Most enterprises are likely to upgrade their operating systems in the wake of the announcement that XP support would be cutoff. They have plenty of reasons to, such as security concerns raised by the IT department or the need for the latest version of Word or Excel to open new document formats.

Remaining consumers, though, will be much less inclined to make an upgrade.

Several trends account for this. First, and foremost, is cost. At-home computer users who are still content with XP are unlikely to purchase a new operating system without any financial incentive, especially considering that many of the features for Windows 7 require hardware upgrades. Try telling someone who uses their home computer to just check their email and read the latest Yahoo News headlines that they need to spend $500 for a new one.

Then there’s the awareness issue. How many at-home consumer users will even know that Microsoft will be cutting off XP support? How many will know what “the end of support” means for them at the user level, and how many will actually care? Microsoft is of course doing what it can to help spread the word, providing a deployment toolkit and its “Springboard Series” to hold its users hands through the process. Microsoft can only lead these XP-running horses to water, though. It can’t make them drink it.

Finally, the burgeoning tablet market could present a roadblock to PC software upgrades. Amol Sarwate, director of Vulnerability Labs for Qualys, says that many entertainment-minded users who purchase a tablet may still have XP-based PCs still kicking around their homes.

“If I have a Windows XP machine and I go buy a new tablet, for most of my needs I will use my tablet, but I still keep my XP machine for doing some chores that only a desktop can do. So that could also play a role here,” Sarwate says.

Although most of the subsequent security issues appear to be at the consumer level, it may not be long until they find a way into corporate networks or industrial systems, Miller says.

“Where do you think all these botnets are set up? They’re not set up on the corporate computers,” Miller says. “They’re set up on my grandmother’s computer, my mother’s computer, and they don’t even know its running because they’re running vulnerable software out there.”

Even scarier, Sarwate says many SCADA systems for industrial networks still run a modified version of XP, and are not in a position to upgrade. Because much of the software running on SCADA systems is not compatible with traditional Microsoft OS capabilities, an OS upgrade would entail much more work than it would for a home or corporate system.

“A lot of these systems are connected to critical infrastructure and that particular SCADA software running on Windows XP has to be first upgraded to a new operating system,” Sarwate says. “So there is a SCADA vendor also in this picture and some SCADA software and hardware which is already configured in plants, factories or critical infrastructure. So in the typical SCADA environment I don’t think Microsoft could encourage people to upgrade because the problems there are completely different.”

In a blog post, Sarwate also highlighted the dangers inherent in many SCADA systems stemming from an inadvertent connection to the public internet. Many companies are under the impression that their SCADA networks are disconnected from others, Sarwate wrote, when in fact they may be just as susceptible to malware as corporate or at-home desktops.

“A search for ‘data presentation and control’ software on the internet yields SCADA systems with management services exposed to the internet,” Sarwate wrote. “If an organization’s SCADA network is not securely connected with the IT network, worms can jump from the HR desktops or reception kiosk into the SCADA network.”

Of course, there are other factors to consider, including the notion that many XP users who will not be protected by Microsoft in 2014 most likely haven’t been deploying the patches Microsoft has issued since 2004. Similarly, Sarwate says that traditionally when Microsoft issues its monthly bulletins, “SCADA system administrators will not apply the patch.”

But at the same time the sophistication of cyberthreats appears to be evolving. Miller cited the increased intelligence of spam attacks, which used to make such obvious spam-like claims as discounts on designer handbags or erectile dysfunction medication, but have lately begun more frequently sending more fake, but seemingly legitimate, emails from UPS or Delta Airlines. By then, new attacks may be designed to leverage these outstanding XP devices without the knowledge of their owners nor the others that they infect, Miller says.

“If you’re writing viruses your main goal is to be non-intrusive. I do not blue-screen the machine. I do not crash the machine. I am on the machine silently. They do not even know I’m there. Hence the bot that runs,” Miller says. “So there probably will be quite a few people that will be in a security nightmare in that aspect of it.”

Best Microsoft MCTS Certification Microsoft MCITP Training
at certkingdom.com