Time is running out for users of Windows XP with end of support slated for April 8th, 2014. After this date, Microsoft will cease to provide security patches, regular updates or bug fixes for the aging operating system. Anti-malware support will continue until July 14th, 2015 for the nearly 30 percent of desktop users who have yet to be cajoled away from the operating system.
21 ways to lose your data
For those of you dragging your heels about upgrading to Windows 8.1 from XP, take heed, in the last 6 months there have been 21 security vulnerabilities identified and patched in Windows XP.
If you don’t understand the full gravity of the previous statement, that’s 21 ways in which your Windows XP operating system could be hacked, had we passed Microsoft’s looming end of support date.
Worse still were we past July 14th 2015, there wouldn’t even be security signatures to inform you that your system has been compromised.
Let’s take a look at some of the vulnerabilities identified in the last 6 months that have been patched by Microsoft, and reflect on the associated hacks.
Windows XP hacks
Vulnerability in Windows Kernel Could Allow Elevation of Privilege (patch)
Originally discovered by FireEye in November, and later reported on by Computer World, the vulnerability allows a standard user (with access to the PC) to elevate their privileges to install programs, view, change, or delete data; or create new accounts with full administrative rights. This exploit targets a remote execution vulnerability in old versions of Adobe Reader that were originally reported by Adobe to have been patched in May.
Microsoft revealed that this vulnerability is currently occurring in ‘limited targeted attacks’.
Vulnerability in VBScript Scripting Engine Could Allow Remote Code Execution (patch)
This vulnerability was announced 11th February, 2014, and is marked as CRITICAL by Microsoft. The exploit was privately reported to Microsoft (aka not announced to the media) and focusses on the VBScript scripting engine in Microsoft Windows. In order to be infected you would need to visit a website and click a link specifically crafted by an attacker.
However, once exploited the attacker could gain the same rights as the existing user. If that user happens to be an admin, the attacker could take complete control of the system, install programs; view, change, or delete data; or create new accounts with full user rights.
Cumulative Security Update of ActiveX Kill Bits (patch)
Discovered by the Cyber Defence Institue inc, this vulnerability currently being exploited exists in the InformationCardSigninHelper Class ActiveX control. This attack is the same as above using a attacking a separate vulnerability. You would need to visit a specifically crated site by an attacker and then initiate Active X control. Once complete the attacker gains the same rights as the user and could take over the system.
On-going attacks expected
Scary reading, and that is only 3 of 21 attacks where your system could be compromised and attackers take control. Come April 8th, 2014, patches for the kind of attacks mentioned above will no longer be available. To make matters worse, attackers will be able to follow Microsoft’s security vulnerability updates to target XP.
As vulnerabilities often affect multiple desktop operating system, attackers can use security patches to reverse engineer the exploit on Windows XP. And with no patches forthcoming from Microsoft, users of XP will remain totally exposed.
You have been warned….
- Edward Jones works for Firebrand Training as a technical writer. Having worked in the industry for 3 years, Edward has experience with a range of Microsoft technologies and operating systems. Edward writes for a variety of blogs and technical publications on all things technology.
