Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Comments
Microsoft: Ignore Unofficial XP Update Workaround
Newest First  |  Oldest First  |  Threaded View
whs87
50%
50%
whs87,
User Rank: Apprentice
6/1/2014 | 1:46:29 PM
Other means
I assume most software vendors who have to keep supporting their code for XP do so for some legitimate reasons, like their software is part of a bigger system or maybe they spend their programming resources already on something else.  Why redesigning a perfectly working system just to switch the OS?

In many such cases it might be sufficient to tamper-proof the software.  One tool for tamper proofing real Win32 machine code has just reached alpha state, see my startup company White Hawk Software, or my blog entry on this subject.
RyanSepe
50%
50%
RyanSepe,
User Rank: Ninja
5/31/2014 | 7:31:29 PM
Staying on XP
For XP die hards there are some things that might help from an enterprise perspective.

1) If you have an IPS, there lies the ability to "soft patch" machines. Vulnerabilities specific to XP picked up by anomaly and mitigated. If initially the malware subverts your IPS hopefully you have an IDS complement to detect post intrusion before any major detriment.

2) Incorporate CSP on a client last server scale. By doing so you essentially harden the systems similar to patching.

3) Pull your systems off the internet if feasible. If you can perform a majority of work internally without external help, then pull the network from the hands of the internet. If you need internet capabilities on a small scale, purchase pcs with a new os like 7/8/linux, you can segment your network into a safe internal with only a subnet touching the internet. This follows a VLAN segmentation type principle. Any questions or thoughts?
anon3493590510
50%
50%
anon3493590510,
User Rank: Apprentice
5/29/2014 | 9:59:37 PM
Re: ATMs are at big risk
There is this misguided belief that everyone who declines to upgrade to windows 8.1 is doing so because they are lazy, unwilling to change or just stupid.

There is however a significant reason to avoid this upgrade that is considered and responsible.

Windows 8.1 is inherently designed to be both massively intrusive of its users privacy and dramatically more populated with vectors for compromise, despite the wise ones' counsel that it is much more secure.

Every aspect of 8.1 is exposed to the internet and almost every feature and function invokes a remote call to some Microsoft server for reasons entirely unrelated to the functionality being invoked.

It is intrusive by design. Heck, in their pitch to us to use it as our "enterprise platform" they were quite giddy with the reach of the new OS such as the ability to remotely change or delete files on employees home computers. This is an enterprise feature to be much prized in the case of employees being dismissed or investigated. Failing to recognize of course that the management team are all also "employees" who would be subject to the same "modern security."

The OS aggressively pushes users to open more vectors of attack by using every means short of a personal visit to cause the user to create and use a Microsoft cloud account to simply log in to their local desktop rather than private local credentials.

Moreover, the Windows Firewall is all but compulsory since updates and other essential feaures will not work if it is disabled -- even if there is a recognized third-party firewall installed. The trick is that Windows Firewall, of course, is designed with holes all over the place to accommodate Microsot penetration of the system.



And Boo! Have you actually read the Privacy Policy that is compulsory with Windows 8? It should be scary since it gives Microsoft carte blanche over everything on your computer.

Sure, committed users can soldier through the strong arm tactics to use cloud credentials and sure IT staff can find all the necessary procedures and tricks to plug the holes and properly secure the system. And sure MS declares it has no ill intent with all of its self-serving Terms and Privacy policies -- except if they suspect your machine is used in a manner contrary to the "interests of Microsoft."

And yes, there is no current evidence that all these vectors are being exploited.


But why should anyone have to fight to use their own property. Why should anyone, particularly businesses accept that everything they do is subject to Microsoft's terms and Microsoft's interests? And why should any vectors be opened if the associated functionality is not of interest to the potential victim?

It is much easier to secure an unpatchable XP network than it is to cope with all the malice contained in an operating system that is by design an internet/Microsoft cloud platform.

I would have expected a service such as DarkReading to take a more serious and critical look at the dark side of upgrading. And those who are sufficiently interested to use the content to have an equally critical mind.

Rather than the mantra of the day, "upgrade already, upgrade already, ohmmm."
eric1972
50%
50%
eric1972,
User Rank: Apprentice
5/29/2014 | 11:50:25 AM
Old Computers An Issue
I've got friends and family members who are still using XP. It isn't necessarily because they are familiar with XP, but because they have an old computer. By "old" I mean something over five years in age. Most computers that the public were buying even five years ago were only capable of 2GB of RAM. You can't upgrade from XP to Win7 if you only have 2GB of RAM or less because the recommended amount is 4GB. So the issue is not just about having to buy a new OS, but also having to buy a new computer and get used to that as well. Not everybody has an extra few hundred bucks to throw at a new computer and OS nor the time or patience to change to a different setup. This isn't just the case with older people, but even those of us in our 20s. Most new computers only come with Win8 anyway, which is ridiculous. Some computer companies like HP actually charge you extra to have a new computer installed with Win7 while Win8/Win8.1 is included for free.
GonzSTL
50%
50%
GonzSTL,
User Rank: Ninja
5/29/2014 | 11:23:26 AM
XP Update Workaround
Human behavior suggests that people will take the path of least resistance, so a lot of them will employ the trick. The hack itself is trivial - I tried it this weekend on an XP machine and it appeared to work, even patching IE8. But as others have mentioned, it is a false sense of security; for example:
  • This procedure only works for the 32 bit versions on XP
  • There is a possibility that some applications intended for the full version of XP may be adversely affected by the patch (which is really no different from any other patch potential side effect), which may render the OS or the application unstable
  • Applications such as Office for XP will not be patched

It is common, even in these days of well publicized breaches, for people to be complacent regarding IT security. The presence of this trick will just enable that behavior.

 

 
Pablo Valerio
50%
50%
Pablo Valerio,
User Rank: Strategist
5/29/2014 | 4:54:05 AM
ATMs are at big risk
It was reported that at the end of January 2014 95% of ATMs in the US were still using XP. I don't think the numbers have declined significantly since.

If any sector is really taking chances with XP is the banking industry. The US still has little penetration of EMV security for credit and debit cards and the opportunity to hack the OS in ATMs to read the card information is very real.

I have to confess that I still use XP in one machine, which I downgraded from Vista five years ago. I use that machine only with Google Drive and Chrome browser and I never install any new software. My other computer now is a Chromebook.

My European cards are all EMV secure and I avoid using my American cards on ATMs
Bprince
50%
50%
Bprince,
User Rank: Ninja
5/28/2014 | 7:14:05 PM
Re: Upgrade from XP!
I agree Rob. Just bite the bullet already. :) Microsoft has a tool called the Upgrade Advisor that you can use to see if you can upgrade your current PC to Windows 8.1. You can download it here: http://windows.microsoft.com/en-us/windows/end-support-help

BP
Robert McDougal
50%
50%
Robert McDougal,
User Rank: Ninja
5/28/2014 | 4:36:38 PM
Upgrade from XP!
I think it is worth restating that this patch is not a valid security fix.  Applying this fix will only serve to give you a false sense of security.  If at all possible please upgrade to atleast Windows 7.


COVID-19: Latest Security News & Commentary
Dark Reading Staff 5/28/2020
Stay-at-Home Orders Coincide With Massive DNS Surge
Robert Lemos, Contributing Writer,  5/27/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: Can you smell me now?
Current Issue
How Cybersecurity Incident Response Programs Work (and Why Some Don't)
This Tech Digest takes a look at the vital role cybersecurity incident response (IR) plays in managing cyber-risk within organizations. Download the Tech Digest today to find out how well-planned IR programs can detect intrusions, contain breaches, and help an organization restore normal operations.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-11844
PUBLISHED: 2020-05-29
There is an Incorrect Authorization vulnerability in Micro Focus Service Management Automation (SMA) product affecting version 2018.05 to 2020.02. The vulnerability could be exploited to provide unauthorized access to the Container Deployment Foundation.
CVE-2020-6937
PUBLISHED: 2020-05-29
A Denial of Service vulnerability in MuleSoft Mule CE/EE 3.8.x, 3.9.x, and 4.x released before April 7, 2020, could allow remote attackers to submit data which can lead to resource exhaustion.
CVE-2020-7648
PUBLISHED: 2020-05-29
All versions of snyk-broker before 4.72.2 are vulnerable to Arbitrary File Read. It allows arbitrary file reads for users who have access to Snyk's internal network by appending the URL with a fragment identifier and a whitelisted path e.g. `#package.json`
CVE-2020-7650
PUBLISHED: 2020-05-29
All versions of snyk-broker after 4.72.0 including and before 4.73.1 are vulnerable to Arbitrary File Read. It allows arbitrary file reads to users with access to Snyk's internal network of any files ending in the following extensions: yaml, yml or json.
CVE-2020-7654
PUBLISHED: 2020-05-29
All versions of snyk-broker before 4.73.1 are vulnerable to Information Exposure. It logs private keys if logging level is set to DEBUG.