Slashdot Mirror
Windows XP Support Deal Not Renewed By UK Government, Leaves PCs Open To Attack
girlmad writes: The government's one-year £5.5m Windows XP support deal with Microsoft has not been extended, sources have told V3, despite thousands of computers across Whitehall still running the ancient software, leaving them wide open to cyber attacks. It's still unclear when all government machines will be migrated to a newer OS.
Maybe the UK consider to take Microsoft to court in case something happens and sue them under product responsibility laws or something.
If builders built buildings the way programmers wrote programs, then the first woodpecker would destroy civilization.
The Brits aren't dumb. They figured out that whether they throw 5.5M at MS or not, XP will run on regardless. Surely MS don't supply the anti-virus / firewall software? That must be 3rd party, and I'll bet, works out a heck less than 5.5M quid. The posting suggests that the second XP "support" vanishes, billions of malwares will converge on those computers. No. Unless MS pays someone to do it...
Slightly hyperbolic there....
And conveniently ignoring all the other security infrastructure that may or may not be around these boxes, for example firewalls, IDS/IPS, proxies, anti-malware systems, etc.
And didn't Microsoft say that the support costs would increase year-on-year for XP?
So prospective cost would be (completely random guesstimate) 7-10 million, maybe more.
So basic risk analysis - what's our exposure/what's the cost of a breach? Is it more than £7-10 million?
Nothing. They're just gonna keep running a 15 year old OS because they are a bunch of punters.
God save the queen (once she gets the goatse virus someone better save her!)
Simple answer is just too remove all the pc's from the internet. Do they need it to work out taxes, etc? Of course not.
It's a country where Segways are illegal to use outside of private property (so unless you live on a big estate, virtually nowhere), so in answer to the question, no.
Why? BECAUSE NEW TECHNOLOGY IS SCARY!
Hyperbole much? Systems don't suddenly develop security holes the day a support agreement is ended. If it was fine the day before support ended, it's fine the day after. Of course, the moment a new issue _is_ discovered, it's game over.
Given the shear amount of warning Microsoft did about Windows XP. I have no sympathy for anyone still using XP and complaining about support. Even Google is going to drop support for Chrome on XP in the next few months. Not only that, I can't imagine any software the is useful is even being updated for XP at this time.
If Apple or Google had control of XP they would have stopped supporting it long ago and would have probably given no extensions for support paid or otherwise.
TFA and the summary make it sound as if it is the lack of support contract which makes these systems insecure. This is complete and utter nonsense - it is the fact that they are running Windows XP which makes them insecure. It's not as if malicious hackers around the world were sitting there rubbing there hands in glee, waiting for the day the support contract expired to plunder the systems, having previously been completely and utterly thwarted in their evil plans by the exchange of funds between the UK government and Microsoft.
But at least a support contract would get them fixes for any newly discovered vulnerabilities, right? Well, maybe. No software is perfect, but the world - and Microsoft's practices - have moved on, and realistically it would take a *lot* of money for MS to spend a meaningful fraction of their resources securing an OS past the end of its useful commercial life.
Assuming that IT pros outside of Slashdot are about as smart as IT pros posting on Slashdot, it's quite likely that those PCs have been replaced, reconfigured (remove network card and USB ports, seal the PC case?) or placed in different areas in their networks to mitigate the risks of running XP. Adding extended support at that price needs to be part of the solution, not the only thing they've done. Hopefully they've used that time for deploying and testing new security measures.
A special edition of Windows! Just for us jolly Brits! :D
Special features:
Automatic porn filtering to protect from accidentally seeing something gross on the web
Automatic blocking of torrents to prevent us from accidentally pirating something
Automatic uses your webcam as a mini CCTV, for 24 hour protection
And more!
It's well understood that Windows is so flaky it needs constant patching and the minute you stop paying, it explodes into a fireball. The only thing keeping that POS software from chomping on your important data is a constant fee paid to Microsoft to tame it.
What you need is to cloudify the lot, you don't see clouds explode into fireballs do ya! That's the power of the cloud, I learned that at MBA school.
Because you are a fat, smelly letch?
Linux would be a refreshing change. And updates are free!
Political correctness is really just herd psychology pushed by insecure people who desperately seek social conformity.
Exactly what kind of support are they getting? Just telephone type "my cup holder broke"? Seems like internal IT could handle most of that. Or are they actually fixing Windows XP bugs for them?
"I have never let my schooling interfere with my education." - Mark Twain
Now take that 5.5 million and replace your old machines and software.
Leave machines open to attack, wait until they're "attacked", then argue you need more surveillance.
Support for the current Government reaches EOL next week and currently seems unlikely to be renewed. However, it looks like an upgrade supported by multiple vendors for five years may be in place shortly after:
http://www.telegraph.co.uk/new...
Maybe someone from the UK government have found out about the PosReady registry hack...
Good tactic from the MS marketing guys to drop this in the news and get them to sign faster without negotiating too much!
I'm not trolling, but is XP that bad? I'm asking whether there is any vulnerability right now that would likely affect the average user?
Further, is XP worse than they'll eventually find 8 or 10 to be, especially with all the "cloud" nonsense? To me this seems like the devil you know versus the devil you don't, arguably FUD. Since hackers strive to be "profitable" in their endeavors, wouldn't they focus on the more popular OSes anyway?
At this late point in the game, no government department is going to waste time and money on migrating to Windows 7 - a 5 1/2 year old OS that hasn't received a service pack in 4 years, whose "mainstream support" already ended in January.
With that in mind, you better hope your IT department has at least been following the Windows 10 beta program, in terms of testing on a few machines. It'll be released by October in time for the Christmas gift period - leaving a slim window of opportunity to be deployed at your office by the end of March (the end of your fiscal year).
tl;dr - you're up shit creek... :(
Sorry, but what tosh.
Microsoft is a convicted monopolist in the EU. Your problems in the US are your problems.
And Windows XP is not "secure". It's like saying that a door you have laying in the shed is "secure" just because you're not using it so nobody would bother to break into it.
You have to consider local, internal attacks (especially if you're dealing with government, NHS, police, etc.) as well as anything from the outside. And you can't isolate XP enough to be secure and work in a networked fashion.
XP is dead. It's lifespan is over. Hardware support for it is dropping fast. I abandoned it in my last workplace because we had major difficulty getting drivers for things as simple as SATA controllers for it, not to mention wireless and network interfaces. Beyond that, 64-bit XP is niche and 32-bit XP prevents a lot of things working. Even for home use, a lot of games nowadays do not work on 32-bit-only systems. XP-64 also brings it's own share of driver problems as there are EVEN LESS XP-64 drivers than XP drivers.
Sure, you can virtualise it, but then you're not running XP at all, really. And still the problem is "It's on your network" if you want to do anything vaguely useful with it. And that provides an attack vector both to and from that machine if it's unsupported and compromisable.
Give it up. I held out until two years ago and that was FAR TOO LONG to hold out on XP for. The alternates really don't make users suffer at all after the initial acclimatisation.
Move on. It's not Windows - it's like someone running Slackware 7 in the modern day, on a 2.2 kernel. Sure, you can do it, but you're setting yourself up for a lot of hurt and hassle just because of the age of the tools and hardware you need to use.
If you have ANY significant number of XP machines, it's time to pay the pittance that an entirely new machine would cost (I'm getting business-class machines for GBP150 - $250? - with Windows 7/8 on them). If you have one or two machines, sure it's not particularly cost-effective but I guarantee you that it will hurt your wallet more when it goes wrong unexpectedly (virus, hardware replacement, data compromise, etc.).
And Windows 10 is expected to be free, for the most part.
If you have a "network", especially a business one, of any description, you are negligent in sticking on XP now. I would not want the most basic of business data processed on XP. I don't deal in multi-million dollar networks, I don't do high-end gear with clouds and servers coming out of my ears. I do small schools. But, for any business that includes a network or server of any size, I would be doing them a disservice to suggest that that DON'T move off XP. Not just failing to mention the possibility, but failing to actively DISCOURAGE further use of their network with XP clients.
You can't secure XP. You can isolate it, but you can't secure it. And there's no real thing as a limited user in XP because it's basically a cinch to demonstrate privilege escalation using any number of pieces of bog-standard software on XP (that you CAN'T patch or upgrade because the XP releases of that software are no longer updated!).
Give it up, really. And you don't even have to pay Microsoft a penny.
If these computers are within a secured network and particularly if they don't have access to the internet, then there isn't any great risk in continuing to use these XP machines.
SURELY NOT!!!!!
Did you really just call XP 'ancient software'? Are you twelve? Calling an operating system that persists on a significant percentage of computers to this day 'ancient' is ridiculous, I don't think it even qualifies for the term 'legacy' yet.
Spectrum of potential abilities:
least |---321--------------| most
321 represents the space occupied by every single human, from least to most capable. This segment is so fucking tiny that it takes a small-minded, insecure retard to worry about where they are placed on it.
tl;dr ironyyyyy
They could retrofit all of these XP machines with Linux and open source software that would meet 99% of their needs, at a cost of some re-training, and development / porting of custom software. Naturally, MS would fight this tooth-and-nail. Who said that bribery won't get you anywhere?
Just like dick size. Yet most men are worried about how they size up.
Therefore the product is still supposedly viable, according to Microsoft,who will INSIST that they get to keep the copyrights and nobody else is allowed to use it.
Why should it be allowed to die off because you don't WANT to sell it, when you also don't want ANYONE ELSE to?
Why should MS be allowed to claim it is worth a huge stack of money yet insist that it's not worth keeping going?
14 years is a blink of time compared to the term of copyright on it. According to the rights they insist for it, the product is still practically shrink-wrapped new.
I'm not worried... maybe you are?
really XP OS is a best Operating system. it is very easy for everybody. alhera
All XP gets regular updates. They have to or the net would break.
Need Mercedes parts ?
The hardware cost is irrelevant. It's the cost and time to thoroughly test / migrate / rewrite lots of bespoke software, made to the lowest quality by some company like Accenture on a contract, for which the source code probably wasn't supplied and all the original developers have left. And if the system fails the Daily Mail will write about it. And the tories slashed the budget, so all that's left can just about cover the new thing the new regulation requires.
"You have to consider local, internal attacks..."
... there's no real thing as a limited user in XP because it's basically a cinch to demonstrate privilege escalation using any number of pieces of bog-standard software on XP..."
If you know of an attack that works against a Windows XP limited user, please mention it. It is likely it could be fixed without Microsoft's support.
"XP is dead. It's lifespan is over."
Software doesn't die. Are you saying that, after literally thousands of bug fixes, Microsoft had still not fixed all the vulnerabilities in Windows XP? That's certainly possible; Microsoft makes more money if there are vulnerabilities, since people pay full price for the next version of the operating sytstem.
"we had major difficulty getting drivers for things as simple as SATA controllers for it"
SATA add-on cards.
"If you have ANY significant number of XP machines, it's time to pay the pittance that an entirely new machine would cost"
That's not the problem. The real cost is in all the configuration and teaching people to use new computers. There are programs, lots of them, that don't run on Windows 7.
"And Windows 10 is expected to be free..."
I'm guessing that Windows 10 will be "free" because it will force a lock-in to Microsoft's methods.
"If you have a "network", especially a business one, of any description, you are negligent in sticking on XP now."
What is particularly vulnerable about XP on a network? We use a software firewall on each computer, Windows 7 or XP, and everyone operates as a limited user.
"You can't secure XP.
Look at this video of a "privilege escalation": Windows XP local privilege escalation. It's total nonsense. One of the comments: "When you try this without administrator rights you get an error: Access is denied."
deserves the attacks they get. I do not see a reason why anyone should be running XP anymore.
....and learn from their mistakes. It now takes me 20 minutes to load Linux Mint on an ex-XP machine, then back to work.