Microsoft Says No TCP/IP Patches For XP 759
CWmike writes "Microsoft says it won't patch Windows XP for a pair of bugs it quashed Sept. 8 in Vista, Windows Server 2003 and Windows Server 2008. The news adds Windows XP Service Pack 2 (SP2) and SP3 to the no-patch list that previously included only Windows 2000 Server SP4. 'We're talking about code that is 12 to 15 years old in its origin, so backporting that level of code is essentially not feasible,' said security program manager Adrian Stone during Microsoft's monthly post-patch Webcast, referring to Windows 2000 and XP. 'An update for Windows XP will not be made available,' Stone and fellow program manager Jerry Bryant said during the Q&A portion of the Webcast (transcript here). Last Tuesday, Microsoft said that it wouldn't be patching Windows 2000 because creating a fix was 'infeasible.'"
Yeah, right (Score:5, Interesting)
The U.S. Navy's and Marine Corp's NMCI [wikipedia.org] computing infrastructure is all Windows XP. Let's see whether or not Microsoft withholds a patch from them.
Unclear (Score:5, Interesting)
It is unclear how large a threat this is to the end user. However the fact that XP is being loaded on netbooks suggests that Microsoft has a revenue stream that it should protect by writing a patch if it is serious.
XP/2003 (Score:1, Interesting)
I thought the Code for windows 2003 and windows xp was mostly identical. As a currently shipping product isn't that a violation of some states/countries warranty/merchantability laws.
Upgrade or Else (Score:4, Interesting)
So, basically, upgrade or you'll be hacked?
Two questions:
1. Does 7's XP mode potentially have this issue, or is there a compatibility layer so xp doesn't talk directly to the network?
2. They seemed to be able to make massive security updates for code that was that old, and still patch a number of other issues. What about this REALLY makes it so hard to code?
In the end, while I understand not wanting to waste resources on way older products, I think it is a marketing move.
Comment removed (Score:5, Interesting)
Question (Score:5, Interesting)
Wait (Score:1, Interesting)
Looks like all of those netbooks microsoft allowed to be shipped with XP in the last two years will be tasty targets.
XP Still uspported on netbooks. (Score:5, Interesting)
Re:Yeah, right (Score:5, Interesting)
I just had to post an invoice to the marine corp's web site. I luckily had one computer at work that was not upgraded to ie8. It would only respect ie6 or 7, and had some issues if I just changed the user agent on FF.
If people keep being forced to upgrade their browsers, no one will be able to use the government systems anymore.
I'm sure it will be an issue for the little companies billing, but you'll never hear about it.
Re:Yeah, right (Score:4, Interesting)
US Navy already ditching M$ (Score:5, Interesting)
The U.S. Navy's and Marine Corp's NMCI computing infrastructure is all Windows XP. Let's see whether or not Microsoft withholds a patch from them.
Since 2008, the US Navy will acquire only systems based on open technologies and standards. That excludes M$ products explicitly in every way but name. The TCP/IP being just one example of failure on M$ part to implement standards. US Navy is ditching M$ [fcw.com].
They'll probably go with an American company like Red Hat or roll their own spin of Red Hat.
The question remaining is will Bill's father's political connections keep lil Bill out of Camp X-Ray or not? If you've got Windows on your network, then you have a personnel problem, not just a network security problem.
Re:Unclear (Score:3, Interesting)
It is unclear how large a threat this is to the end user. However the fact that XP is being loaded on netbooks suggests that Microsoft has a revenue stream that it should protect by writing a patch if it is serious.
Excellent point. I wonder if this could put MS into legal trouble. Does anybody know what software distribution laws say about distributing software with known security issues without the intention of filling them? Are they at least bound to notify the user? I mean people have burnt themselves on hot coffee and won lawsuits because they weren't notified. Surely this should be a more valid suit, as you don't even need to be a complete moron to get affected.
Wouldn't SynAttackProtect work here? (on 2000 too) (Score:3, Interesting)
The DOS/DDOS possible via the latest weakness in Windows 2000's IP stack @ least (uses RDR20.DLL as the LSP (layered service provider) vs. MSWSOCK.DLL (the LSP used in XP/Server 2003 onwards, by way of comparison, & this is where I think the problem lies largely, as it is the "most radically different part" of the IP stack in Windows 2000 vs. the more current builds of Windows that I could see @ least)?
WELL - That's taken care of by the SynAttackProtect setting here -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters
What does it do??
http://msdn.microsoft.com/en-us/library/aa302363.aspx [microsoft.com]
Description: When SynAttackProtect is enabled, this value specifies the threshold of TCP connections in the SYN_RCVD state. When SynAttackProtect is exceeded, SYN flood protection is triggered.
TcpMaxPortsExhausted
TcpMaxHalfOpen
TcpMaxHalfOpenRetried
Also have to be considered as well (these determine how long before SynAttackProtect "kicks in", vs. the DOS/DDOS attack that could occur)
This SynAttackProtect registry value causes Transmission Control Protocol (TCP) to adjust retransmission of SYN-ACKS. When you configure this value, the connection responses time out more quickly in the event of a SYN attack (a type of denial of service attack).
2: Set SynAttackProtect to 2 for the best protection against SYN attacks. This value adds additional delays to connection indications, and TCP connection requests quickly timeout when a SYN attack is in progress. This parameter is the recommended setting.
NOTE: The following socket options no longer work on any socket when you set the SynAttackProtect value to 2: Scalable windows
-----
IIRC? This is called the "Silly Window Syndrome", & this is a way, in theory, around it... & iirc, "Scalable Windows", via setsockopt API calls from an attacker are what the problem is here anyhow & this ought to 'stall it'... thoughts/feedback?
APK
P.S.=> Also, "hardcoding" the TcpWindowSize & GlobalTcpWindowSize settings in the registry in TCP/IP Parameters (see registry path above) SHOULD also help here also, for servers that can accept MANY connections from MANY clients, worldwide, as your specific constraints specify...
Thus, effectively stalling the ability to use TcpWindowScaling is stopped by SynAttackProtect too, so an attacking system/app sending a setsockopt of 0 for this SHOULD also be nullified, on a server also...
(However/Again - Workstations are easily taken care of , vs. servers, just by what I wrote up above either by PORT FILTERING)
IP Security Policies, which can work on ranges of addresses to block, OR, single systems as well you either ALLOW or DENY to talk to your system, still can help also... vs. a DDOS though? SynAttackProtect is your best friend here... you'd use netstat -b -n tcp to see which are held in a 1/2 open SYN-RECEIVE state, & BLOCK THOSE FROM SENDING YOUR WAY (or just by doing it in a router or routing table)... takers anyone, on these thoughts (especially for Windows 2000)?
Thanks for your time... apk
Re:Yeah, right (Score:5, Interesting)
Many people have compared defense work to "white collar welfare". I think the private companies are more frugal than that, since they are constantly cutting costs & laying-off workers, but having worked at the FAA it seems like a sound argument. I saw government workers sitting around doing nothing but surfing the net day-after-day. The FAA could lay-off 75% of the workforce and not notice any drop in output.
But of course if the FAA did that, then the politicians who represent those workers would scream bloody murder, and the layoffs would be canceled.
Halliburton (Score:3, Interesting)
Why not? The Pentagon continued using Halliburton for years, on huge no-bid contracts, even when its divisions were installing showers in Iraq that electrocuted our servicemembers. And that's just the worst failure the public heard about, after most of a decade of abusive cronyism.
Microsoft is much richer than even Halliburton, and its failures much less publicly scandalous. Why would it face a tougher standard? I'm sure Dick Cheney owns a lot of Microsoft stock, too.
Microsoft extends XP downgrade option to 2101 (Score:4, Interesting)
Microsoft Corporation has announced a limited one-off extension of availability of its Windows XP operating system to April 2101 after criticism from large customers and analysts. This is the fifty-sixth extension of XP's availability since 2008.
Through successive releases of Microsoft's flagship Windows operating system, demand for XP has remained an important factor for businesses relying on stable XP-specific software and installations, who have pushed back strongly against the software company's attempts to move them to later versions. Windows administration skills have become rare in recent years and consultants have demanded high fees. Reviving Windows administrators from cryogenic freezing has proven insufficient to fill the market gap, as almost all begged to work on COBOL instead.
"Windows XP is currently in the extremely very prolonged super-extended support phase and Microsoft encourages customers to migrate to Windows for Neurons 2097 as soon as feasible," said William Gates V, CEO and great-grandson of the company founder. "Spare change?"
Microsoft Corporation, along with Monsanto Corporation and the RIAA, exists as a protected species in the Seattle Memorial Glass Crater Bad Ideas And Warnings To The Future National Park in north-west Washington on the radioactive remains of what was once the planet Earth, under the protection of our Linux-based superintelligent robot artificial intelligence overlords. Company revenues for 2098 were over $15.
illustration: A background wallpaper for your insecurable XP desktop [today.com]. (Anyone got a pointer to the 1024x768 version?)
31 days. (Score:3, Interesting)
I say give 'em a month, tops, and then there will be a patch (or news of a coming patch) for Windows XP.
Now would be a terrible time for Microsoft to alienate all those big corps that have XP and force them into another OS, if they want to keep their customers.
It'd be great for everyone else, as customers may start looking into things they would never have considered otherwise, such as various open source operating systems, and the necessary apps it would take to keep them going in their workflow, post-transition.
The way it looks is, some people (usually companies) will view this as a threat from Microsoft that reads: "Upgrade if you want protection."
Some of them in this group will obediently upgrade to Fista or 7.
Some of them will reluctantly upgrade to Vista or 7.
Some of them will stay with XP and find other ways to secure themselves.
Some of them will [cross their fingers and hope|pray] that Microsoft changes their mind and offers a patch.
Some of them will be offended and migrate to another OS outside of Big Red Robotland.
And of course, some of them will feel that litigation solves everything, and want to take MS to court for "refusing to patch an OS that is in such widespread use" (or) "intentionally posing a security risk".
Refusing a patch like this, in my humble opinion, isn't something you want to do until a few months after your new OS lands, at the bare minimum. That way, you've already got people migrating.
XP's patching lifecycle isn't up yet, from what I can see here, though: XP SP2 should be good until July of 2010 [microsoft.com], and SP3 should be good a bit longer than that, so I'm surprised no-one has really called 'em out on that.
Coming to a law court near you (Score:3, Interesting)
2. Run all updates.
3. Browse web, get hacked by this exploit. Lose money through "identity theft" / bank fraud.
4. Turn up in court with the receipt for the netbook & windows license stating when purchased, and the date and time Microsoft refused to patch the hole which caused your loss.
5. State that Microsoft is profiting from a product which is unsuitable for purpose, and it knows is unsuitable.
6.
7. Read Microsoft fine print and realise that you have to now give Microsoft your first born child for ever doubting that their asses are covered.
Yeah, consumer loses out on this one.
Re:Yeah, right (Score:5, Interesting)
Actually, this isn't funny and may well be the type of attention-getting answer we need to this problem. People should start sending off some emails to their representatives that points this problem out. Microsoft says they are supporting WindowsXP until 2014 for security matters and other serious problems. I'd say this qualifies. This "move" on Microsoft's part represents a squeeze play against all of its customers not the least of which is the U.S. Federal Government. And with all the attention on money problems, it can't be ignored or written off.
I foresee a congressional hearing on the matter should Microsoft continue down this road.
If the government plans to spend trillions on this surprise upgrade requirement, perhaps moving to another OS might be another consideration to weigh in. We KNOW Microsoft will leverage its position as "the" OS vendor to do nearly anything it wants. We can't force them to behave. Perhaps the best thing to do is push the misbehaving child to the curb and use someone else's product.
Re:Infeasible? (Score:3, Interesting)
There's nothing wrong with inventing words.
"Colonize" didn't exist until the printer Benjamin Franklin started using it (and the British printers criticized him for turning a noun into a verb). These are called inkhorn words, because it's as if they magically sprung from the ink well. Some succeed while others like Bush's "misunderestimate" or Jefferson's "undamage" did not.
Re:Bad Car Analogy. You know it is coming ;-) (Score:4, Interesting)
Your analogy is flawed in three ways. First, MS doesn't make cars. Cars are useful. MS makes on OS which is a system component and pretty much useless by itself. Second MS is a monopoly, whereas GM is not. Third, the flaw in XP is unlikely to result in fatalities or even serious injury. Allow me to fix your analogy:
Today GM announced that the GMC trucks have some fundamental flaw in the lock mechanisms and they are prone to open and start the truck randomly. GM said it can't fix the issue because the component is supplied by EvilCorp and current law makes it illegal for them to change anything inside the locking mechanism device. Further GM can't buy locking mechanisms from anyone else because EvilCorp has a monopoly on selling them and has used criminal acts to drive all real competitors out of business. EvilCorp has already lost court cases to that effect, but after making campaign contributions to your elected officials decided not to punish them. EvilCorp says the design is very old, and fixing it is unfeasible. When asked if they will stop shipping trucks with the flaw, GM spokesman said, "we have not stopped building or shipping them yet. We don't have any real options here. We did try partnering with a company that repackages locking systems made for free by a nonprofit organization, but they aren't compatible with existing trailer hitches, AC systems, or tires and switching all of those is hard to do since all the component suppliers out there build them to work with EvilCorp products. Also EvilCorp gives away free gas tanks with every lock mechanism, but because they are really weird, gas has had to be reformulated so it has problems working in gas tanks from any normal company and nobody really sells standards compliant gas anymore. Car buyers are encouraged to remove the batteries from their trucks whenever they stop and park them in locked garages if they contain anything valuable."
Re:Yeah, right (Score:4, Interesting)
Well, that, and I think you'd find that the ones getting laid off wouldn't be the cruft. They'd lay off the productive workers preferentially.
Re:Yeah, right (Score:1, Interesting)
Sales of Win7 are down so low MS isn't even promoting it in most places. There are lots of groundbreaking problems that people will not touch with a 20 foot pole. It is an overall improvement yes, but why would I pay for DRM and a version of Vista that should have been there from the start?
MS needs to relearn basic salesmanship: underpromise and overdeliver. They have been doing the opposite and wonder why people hate them.
Re:Yeah, right (Score:4, Interesting)
Hey genius, you do realize that Windows XP is still being sold, right? That brand new computers are shipping by the thousand every single day with Windows XP as the OEM-installed operating system? Can you seriously claim that it's alright for them to just walk away from a product they are still shipping because they have better things to do with their time? Did you give your position even five seconds of thought?
Congratulations, fucktard. Worst post of the day.
you are off (Score:3, Interesting)
wrong analogy, you are focusing on the wrong issue. Real analogy: Do you still expect adobe to patch the latest versions of their software as long as they are in business? yes. What if they had a DLL that was affected in *all* versions. Do you expect them to patch it with the latest version? Hell yes you do. This is not a car warranty, so that argument is completely null. Things that are on XP cannot necessarily magically be "upgraded" like you think, additionally why should someone even feel remotely obligated to spend money on a new version of something that works just fine?
Car analogy: does the manufacturer shutdown their car after 10 years if you can keep it running?
Why should MS exclude one?
maybe you should think about the argument you are making, because it is off.
Re:Yeah, right (Score:5, Interesting)
XP SP2 and later are fine by default. What does that mean? Does that mean it's the only possible configuration? Or is it reasonable that an XP SP2 computer could end up in a state where it does have a listening service configured in the client firewall? Doesn't Vista include "a stateful host firewall that provide protection for computers against incoming traffic from the Internet [...]"? I should think so, so wouldn't that invalidate their reasoning?
I wouldn't be surprised if Microsoft is perfectly correct in not patching XP. The problem is how they communicate it. If they're patching Vista (a client OS) and they're patching Server 2003 (similar codebase to XP), then this makes it seem like they don't want to bother fixing XP, even though it's broken. If Microsoft had said, "the XP codebase is in no way vulnerable", I'd be completely satisfied. But they didn't. They said, "XP is broken, but by default it's protected".
That's not good enough.
Re:Yeah, right (Score:3, Interesting)
Citations ... err ... clarification please.
Toyota Vista [wikipedia.org] (Rebadged Toyota Camary)
Indica Vista [tatamotors.com] (Indian made/sold car)
Dodge/Plymouth Colt Vista Wagon [wikipedia.org] (Rebadged Mitsubishi Chariot)
Eagle Vista [wikipedia.org] (Rebadged Mitsubishi Space Wagon)
Thomas Vista [wikipedia.org] a mighty big station wagon. :)
Oldsmobile Vista Cruiser [wikipedia.org] The "That 70's Show" classic 1969 Vista Cruiser [imcdb.org]. :)
The only Vista I'd want to own is This One [wikipedia.org] (More Information [f-16.net]), but fuel is kinda expensive.