Slashdot Mirror
Windows XP Support Deal Not Renewed By UK Government, Leaves PCs Open To Attack
girlmad writes: The government's one-year £5.5m Windows XP support deal with Microsoft has not been extended, sources have told V3, despite thousands of computers across Whitehall still running the ancient software, leaving them wide open to cyber attacks. It's still unclear when all government machines will be migrated to a newer OS.
Can I post FIRST?
Who Cares? What makes the UK special? Roundabouts?
Tora! Tora! Tora!
Tor's New Search Provider Built By Ex-Google And Ex-NSA Engineers
$$$
https://blog.torproject.org/bl...
^ https://blog.torproject.org/#S...
"New Search Provider[1]
Our default search provider has also been changed to Disconnect. Disconnect provides private Google search results to Tor users without Captchas or bans."
[1] https://search.disconnect.me/
$$$
"Disconnect Search, Built By Ex-Google And Ex-NSA Engineers, Lets You Use Google, Bing And Yahoo Without Tracking"
http://techcrunch.com/2013/10/...
FTA:
"notes Patrick Jackson, the ex-NSA engineer who is now CTO of Disconnect"
Yeah.. sounds like a good choice for a default TBB Search Engine... NOT!
$$$
-- On April 28th, 2015 Anonymous said:
"What prompted the change in search engine? Are we now getting paid to include disconnect as the default search engine?"
-- On April 28th, 2015 gk said:
"We don't get paid for that as it currently stands. But Startpage was not happy with our traffic and showed sometimes CAPTCHAs. Disconnect on the other hand approached us with respect to search engine traffic and donated some money."
Donated some money? Hahahahahhaaha. I wonder WHY they approached Torproject? You don't get paid for that CURRENTLY? Nice wording! But there was a DONATION, rrrriiiiight? I can't wait for future news! Please do let us know if and when you start collecting further $$ from the source.
I am insulted. I will continue to use Startpage's free web proxy service in TBB, and DuckDuckGo's .onion hidden service free search engine:
http://3g2upl4pq6kufc4m.onion/
So what's next, Torproject? Keystroke logging for Amazon or another company? Partnering with Recorded Future or something like it? Is this what the project has come to now? But that "Disconnect" Search Engine site is so pretty. So nice and clean, WOW! It sort of reminds me of the polished DoD sites I have wandered through.
$$$
Read Their Privacy Policy:
https://disconnect.me/privacy
Disgusting.
"I love how they "never collect your Personal Info, except when they do" and "never share your Personal Info (the one they didn't collect, remember?), except when they do""
$$$
With this new "Search Engine", I feel like a rug is being pulled out from underneath me and damn it "that rug really tied the room together."
Maybe the UK consider to take Microsoft to court in case something happens and sue them under product responsibility laws or something.
If builders built buildings the way programmers wrote programs, then the first woodpecker would destroy civilization.
The Brits aren't dumb. They figured out that whether they throw 5.5M at MS or not, XP will run on regardless. Surely MS don't supply the anti-virus / firewall software? That must be 3rd party, and I'll bet, works out a heck less than 5.5M quid. The posting suggests that the second XP "support" vanishes, billions of malwares will converge on those computers. No. Unless MS pays someone to do it...
Why won't a nubile girl let me fuck her in the ass?
Slightly hyperbolic there....
And conveniently ignoring all the other security infrastructure that may or may not be around these boxes, for example firewalls, IDS/IPS, proxies, anti-malware systems, etc.
And didn't Microsoft say that the support costs would increase year-on-year for XP?
So prospective cost would be (completely random guesstimate) 7-10 million, maybe more.
So basic risk analysis - what's our exposure/what's the cost of a breach? Is it more than £7-10 million?
Nothing. They're just gonna keep running a 15 year old OS because they are a bunch of punters.
God save the queen (once she gets the goatse virus someone better save her!)
Simple answer is just too remove all the pc's from the internet. Do they need it to work out taxes, etc? Of course not.
It's a country where Segways are illegal to use outside of private property (so unless you live on a big estate, virtually nowhere), so in answer to the question, no.
Why? BECAUSE NEW TECHNOLOGY IS SCARY!
Hyperbole much? Systems don't suddenly develop security holes the day a support agreement is ended. If it was fine the day before support ended, it's fine the day after. Of course, the moment a new issue _is_ discovered, it's game over.
Given the shear amount of warning Microsoft did about Windows XP. I have no sympathy for anyone still using XP and complaining about support. Even Google is going to drop support for Chrome on XP in the next few months. Not only that, I can't imagine any software the is useful is even being updated for XP at this time.
If Apple or Google had control of XP they would have stopped supporting it long ago and would have probably given no extensions for support paid or otherwise.
TFA and the summary make it sound as if it is the lack of support contract which makes these systems insecure. This is complete and utter nonsense - it is the fact that they are running Windows XP which makes them insecure. It's not as if malicious hackers around the world were sitting there rubbing there hands in glee, waiting for the day the support contract expired to plunder the systems, having previously been completely and utterly thwarted in their evil plans by the exchange of funds between the UK government and Microsoft.
But at least a support contract would get them fixes for any newly discovered vulnerabilities, right? Well, maybe. No software is perfect, but the world - and Microsoft's practices - have moved on, and realistically it would take a *lot* of money for MS to spend a meaningful fraction of their resources securing an OS past the end of its useful commercial life.
Assuming that IT pros outside of Slashdot are about as smart as IT pros posting on Slashdot, it's quite likely that those PCs have been replaced, reconfigured (remove network card and USB ports, seal the PC case?) or placed in different areas in their networks to mitigate the risks of running XP. Adding extended support at that price needs to be part of the solution, not the only thing they've done. Hopefully they've used that time for deploying and testing new security measures.
A special edition of Windows! Just for us jolly Brits! :D
Special features:
Automatic porn filtering to protect from accidentally seeing something gross on the web
Automatic blocking of torrents to prevent us from accidentally pirating something
Automatic uses your webcam as a mini CCTV, for 24 hour protection
And more!
It's well understood that Windows is so flaky it needs constant patching and the minute you stop paying, it explodes into a fireball. The only thing keeping that POS software from chomping on your important data is a constant fee paid to Microsoft to tame it.
What you need is to cloudify the lot, you don't see clouds explode into fireballs do ya! That's the power of the cloud, I learned that at MBA school.
Linux would be a refreshing change. And updates are free!
Political correctness is really just herd psychology pushed by insecure people who desperately seek social conformity.
Exactly what kind of support are they getting? Just telephone type "my cup holder broke"? Seems like internal IT could handle most of that. Or are they actually fixing Windows XP bugs for them?
"I have never let my schooling interfere with my education." - Mark Twain
Now take that 5.5 million and replace your old machines and software.
Leave machines open to attack, wait until they're "attacked", then argue you need more surveillance.
There is a conflict of interest. Microsoft makes more money if its software is considered insecure. Microsoft effectively has a monopoly, but it was somehow decided by the U.S. government that Microsoft's monopoly was not covered by U.S. laws against monopoly.
There are many situations in which Windows XP is secure. For example, XP is secure when run on a network that is solely internal, and every computer on that network is run as a limited user. Businesses doing the same work every day don't need new hardware or software if the equipment they have now is serving them well.
Software doesn't have a "lifespan". It works the same as it always did, with the same hardware.
See my article, Microsoft Windows XP "end of life": Conflict of interest.
Support for the current Government reaches EOL next week and currently seems unlikely to be renewed. However, it looks like an upgrade supported by multiple vendors for five years may be in place shortly after:
http://www.telegraph.co.uk/new...
Maybe someone from the UK government have found out about the PosReady registry hack...
Good tactic from the MS marketing guys to drop this in the news and get them to sign faster without negotiating too much!
I'm not trolling, but is XP that bad? I'm asking whether there is any vulnerability right now that would likely affect the average user?
Further, is XP worse than they'll eventually find 8 or 10 to be, especially with all the "cloud" nonsense? To me this seems like the devil you know versus the devil you don't, arguably FUD. Since hackers strive to be "profitable" in their endeavors, wouldn't they focus on the more popular OSes anyway?
At this late point in the game, no government department is going to waste time and money on migrating to Windows 7 - a 5 1/2 year old OS that hasn't received a service pack in 4 years, whose "mainstream support" already ended in January.
With that in mind, you better hope your IT department has at least been following the Windows 10 beta program, in terms of testing on a few machines. It'll be released by October in time for the Christmas gift period - leaving a slim window of opportunity to be deployed at your office by the end of March (the end of your fiscal year).
tl;dr - you're up shit creek... :(
If these computers are within a secured network and particularly if they don't have access to the internet, then there isn't any great risk in continuing to use these XP machines.
SURELY NOT!!!!!
Did you really just call XP 'ancient software'? Are you twelve? Calling an operating system that persists on a significant percentage of computers to this day 'ancient' is ridiculous, I don't think it even qualifies for the term 'legacy' yet.
They could retrofit all of these XP machines with Linux and open source software that would meet 99% of their needs, at a cost of some re-training, and development / porting of custom software. Naturally, MS would fight this tooth-and-nail. Who said that bribery won't get you anywhere?
Therefore the product is still supposedly viable, according to Microsoft,who will INSIST that they get to keep the copyrights and nobody else is allowed to use it.
Why should it be allowed to die off because you don't WANT to sell it, when you also don't want ANYONE ELSE to?
Why should MS be allowed to claim it is worth a huge stack of money yet insist that it's not worth keeping going?
14 years is a blink of time compared to the term of copyright on it. According to the rights they insist for it, the product is still practically shrink-wrapped new.
really XP OS is a best Operating system. it is very easy for everybody. alhera
All XP gets regular updates. They have to or the net would break.
Need Mercedes parts ?
"You have to consider local, internal attacks..."
... there's no real thing as a limited user in XP because it's basically a cinch to demonstrate privilege escalation using any number of pieces of bog-standard software on XP..."
If you know of an attack that works against a Windows XP limited user, please mention it. It is likely it could be fixed without Microsoft's support.
"XP is dead. It's lifespan is over."
Software doesn't die. Are you saying that, after literally thousands of bug fixes, Microsoft had still not fixed all the vulnerabilities in Windows XP? That's certainly possible; Microsoft makes more money if there are vulnerabilities, since people pay full price for the next version of the operating sytstem.
"we had major difficulty getting drivers for things as simple as SATA controllers for it"
SATA add-on cards.
"If you have ANY significant number of XP machines, it's time to pay the pittance that an entirely new machine would cost"
That's not the problem. The real cost is in all the configuration and teaching people to use new computers. There are programs, lots of them, that don't run on Windows 7.
"And Windows 10 is expected to be free..."
I'm guessing that Windows 10 will be "free" because it will force a lock-in to Microsoft's methods.
"If you have a "network", especially a business one, of any description, you are negligent in sticking on XP now."
What is particularly vulnerable about XP on a network? We use a software firewall on each computer, Windows 7 or XP, and everyone operates as a limited user.
"You can't secure XP.
Look at this video of a "privilege escalation": Windows XP local privilege escalation. It's total nonsense. One of the comments: "When you try this without administrator rights you get an error: Access is denied."
deserves the attacks they get. I do not see a reason why anyone should be running XP anymore.
....and learn from their mistakes. It now takes me 20 minutes to load Linux Mint on an ex-XP machine, then back to work.