XP Systems Getting Emergency IE Zero Day Patch 179
msm1267 (2804139) writes "Microsoft announced it will release an out-of-band security update today to patch a zero-day vulnerability in Internet Explorer, and that the patch will also be made available for Windows XP machines through Automatic Update. At the same time, researchers said they are now seeing attacks specifically targeting XP users.
Microsoft no longer supports XP as of April 8, and that includes the development and availability of security updates. But the about-face today speaks to the seriousness of the vulnerability, which is being exploited in limited targeted attacks, Microsoft said. Researchers at FireEye, meanwhile, said multiple attackers are now using the exploit against XP machines, prompting the inclusion of XP systems in the patch."
Microsoft no longer supports XP as of April 8, and that includes the development and availability of security updates. But the about-face today speaks to the seriousness of the vulnerability, which is being exploited in limited targeted attacks, Microsoft said. Researchers at FireEye, meanwhile, said multiple attackers are now using the exploit against XP machines, prompting the inclusion of XP systems in the patch."
WTF (Score:1, Interesting)
Patching a dead OS just confuses users. No, really, this OS is dead except sometimes.
Re:WTF (Score:5, Funny)
I know right, like recalling cars out of warranty.
Re: (Score:3)
Good luck getting a 15 year warranty on your car.
Re: (Score:3)
The auto manufacturer is responsible for safety recalls for a very long time, if not forever. I've gotten safety recalls for cars that I haven't owned in years and that are way past the warranty period. I was the last known owner, so I got the letter.
This kind of thing is very much like a safety recall for cars, except it is for an operating system.
Re: (Score:2)
The recall had something to do with an ignition switch catching fire...even when the vehicle was not in use. Last I checked I don't think anyone's comp was at risk of bursting into flames due to a security patch not being installed.
Car comparisons won't work on this because if cars aren't recalled for dangerous flaws, owners and other people are in danger of injury or death. The only way my computer
Re: (Score:2)
The auto manufacturer is responsible for safety recalls for a very long time, if not forever.
They're responsible for ten years from the date the recall is issued, unless it's a seatbelt or maybe airbag recall. I believe seatbelt recalls are forever, not sure about airbag recalls but I'd bet the same way on them.
Re: (Score:2)
We have an ex-Chrysler employee working at my office and he had a small involvement in recalls. He said the automakers are forced to honor vehicles up to 8 years of age but it may differ from one country to another. Past this, they can choose to honor the recalls but in many cases it will be at your expense.
Re: (Score:2)
Good luck getting a 15 year warranty on your car.
Back when I was younger, and living on student income, I had warranty work done on a car when it was 14 years old.
Re: (Score:2)
I need to know the name of the car company because that just doesn't happen today. It's not a sustainable model for any company.
And again, they probably weren't obligated to do it. The government only holds them responsible for the cost of the repair until the vehicle is 8 years of age.
Re: (Score:2)
It was a Chevy Malibu. Yes, the "domestics are shit because....GM!!" fixed a problem for free, on my 14 year old car.
Re: (Score:2)
Fact is, they weren't obligated
Re: (Score:2)
Windows XP: Zombie Edition lives! IT'S ALIVE!
Either that or it's only "mostly dead" and MS is giving it a miracle pill.
Re: (Score:2)
Either that or it's only "mostly dead" and MS is giving it a miracle pill.
Shortly before this patch was issued, Windows XP distinctly said "The blaaaaaayth!"
That's smart (Score:2)
1) Stockpile exploits for Windows XP until after Microsoft no longer releases updates for it.
2) Hack XP users.
3) Profit!
Re: (Score:2, Insightful)
No, it speaks to the seriousness of letting 30% of the PC user base twist in the wind, and start thinking about 2020 when the same thing will happen to 7, and maybe start browsing the Apple stores.
Re: (Score:2, Informative)
Soo... apple is still releasing patches for OSX v10.1 "Puma", which came out the same time as XP originally... or is it that the OS X v10.5.8, the last supported OS by many of the machines from that time period (and came out between XP SP2 and SP3, to put things in perspective), is still getting security updates? Because the answer is no and no.
In fact, the oldest OSX which is still getting security updates (Lion) was released not quite three years ago. Great.
Re:That's smart (Score:5, Informative)
Reality distortion field on.
Re: (Score:2)
As far as I've seen, Apple hasn't released any statements to that effect. The stated reason the last two big security patches were not made available to 10.6 Snow Leopard is because the problems they were patching were introduced in 10.7 Lion.
I don't think Apples vague maybe/maybe-not support policies really help much.
Microsoft has no spine. (Score:2, Informative)
Re:Microsoft has no spine. (Score:5, Insightful)
Yes, how dare they provide support for a large percentage of their userbase, rather than try to force their users to pay them more money for the latest version! Those bastards!
Seriously, I get that XP is old and there are real disadvantages to its continued use, but it's amazing to me that we've actually reached the point where MS is getting flack for not adhering strongly enough to planned obsolescence. Like, we want them to be greedier now and stop providing free updates? I'd like to believe that they'll continue supporting Win7 for quite some time. I don't particularly like the idea of forced paid upgrades, or the "subscription Windows" that everyone seems to think is coming.
I'd love it if people would start moving off of XP and onto modern OS'es, but that's not going to happen right away regardless of what MS does, and I'm not going to knock them for supporting their product long-term.
Re: (Score:3)
I agree with you. I don't know one XP user that would pay for a subscription. MS is a business and for some reason the expectation is that they should continue supporting the product at no charge. Yet we don't have that expectation of anything else in life. The software world always gets shafted.
I had customers contacting me regarding a 10 year old project with a bug recently discovered. I sent them a quote to fix the issue and they asked me why I was charging to fix the software. They also told me they exp
Re: (Score:2)
I don't know one XP user that would pay for a subscription.
Allow me to introduce you to one...
http://www.engadget.com/2014/0... [engadget.com]
Re: (Score:3)
Why should they continue to spend money to support an ancient OS that no one is buying any more? They're not receiving any new revenue for it, so why should they continue to support it? Who would expect any company to continue to support obsolete products a decade or more after they were sold, without some kind of service contract? In most places, a 1 or 2-year warranty is all you can expect.
I'd rather see them stop supporting XP at all, for anyone. If people don't like that, they should switch to somet
Re:Microsoft has no spine. (Score:4, Insightful)
Because they're acting as a responsible corporate entity, maybe? It must be shocking to Apple users to see something like this, but Microsoft has actually been a relatively responsible, responsive company for a long time, now.
Why Microsoft won't abandon those users (Score:4, Insightful)
Why should they continue to spend money to support an ancient OS that no one is buying any more? They're not receiving any new revenue for it, so why should they continue to support it?
They are absolutely receiving revenue for it, just not directly. These users are part of the Windows total addressable market. Developers choosing to write applications and looking at which platform to choose look at this number. 30% of the Windows userbase comes from XP. If Microsoft upsets these users by letting rampant malware trash their systems, a chunk of these people may switch to e.g. Apple. Oops! Now we have more cross platform or Apple-native apps being developed because there are more users there. Microsoft does not want this to happen.
Re: (Score:2)
I don't think XP users are buying applications at this stage. They're just using their old computer for web-browsing and email at this point.
Re: (Score:2)
Windows users rarely buy applications in general. They use freeware and open source ones, and play games. Some will get a pirated version of Photoshop or stuff like Reason and Ableton Live.
Re: (Score:2)
Re: (Score:2)
Actually they are receiving tens if not significantly more of millions in support contract revenue on the XP side
Not from consumers they're not.
and still have to support server 2003r2 (effective XP in the patching sense in most cases) through next July.
That's not really relevant. Doesn't matter if it's technically similar, it's still a different product with a different market. They have every right to treat them differently, and to shut off support for one and not the other.
Re:Microsoft has no spine. (Score:5, Insightful)
They should support it as long as they hold copyright on it. When the support ends, it should be put in the public domain.
Re: (Score:2, Funny)
And I want a pony.
Re: (Score:2)
About the only way this could work would be if Microsoft lobbied (and got) sane copyright terms into law.
The obvious related issues are that some parts of Win XP may exist in other Microsoft products. Microsoft may not actually be the copyright holder for all of XP. Some bits they may have licenced, other bits they may have "pirated". (Piracy within proprietary software, even of OSS, d
Re: (Score:2)
It's one thing to stop feature updates. That happened once Vista came out. But security updates? That's like knowing that your product is certain to cause property damage after a certain amount of use but still keeping it out in the wild. With non-software, there'd be mass mandatory recalls. At least with software, it's a matter of putting out an update.
And yes, severe security vulnurabilities are a defect in the product and zombies do cause monetary property damage albeit a very small amount individually.
Re: (Score:3)
After painstakingly upgrading the entire office to windows 7 over the last few years, recommending to all friends family and clients that they NEED to upgrade, I am somewhat conflicted.
Firstly, microsoft is making me look like a lying dick. When I heard about this IE vulnerability, I thought "awesome! now everyone that hummed hawed and complained at me for forcing upgr
Re: (Score:2)
Firstly, microsoft is making me look like a lying dick. When I heard about this IE vulnerability, I thought "awesome! now everyone that hummed hawed and complained at me for forcing upgrades will be apologizing!". So i am pretty pissed off that they now go back on their word and still support XP making me look like I didn't know what I was talking about.
That's okay. Your friends and family won't hear of that flaw and patch unless they read Slashdot or other tech websites.
There's also a pretty much untold story. Google Chrome and maybe Firefox and some other stuff support XP for an additional year. Microsoft does support a version of XP for one more year too!, it's called Windows Server 2003 with final EOL on July, 14th 2015. It is not strictly XP but is rather close.
Re: (Score:2)
I don't understand why a spine is necessary. If the market is crying out for XP, why not just simply migrate XP to an annual license of $20 and let people keep their beloved 512 MB P IVs going for as long as their bits keep shuffling?
Microsoft had an awesome opportunity with WinXP and they just threw it away...
Re: (Score:2)
Re: (Score:1)
"XP support is over" my hammy.
Re: (Score:2)
The irony? (Score:3, Funny)
Re: (Score:1)
Hello, Alanis. Still don't know what irony is, eh.
Re: (Score:2)
Is IE still used to download and install through Automatic Updates?
Re: (Score:2, Informative)
No, you can only enable Automatic Updates and wait for them to get pushed down. The Windows Update site has not worked on XP for a couple years now, although I can't remember when it officially happened. It's the same with Windows Server 2003...
Re: (Score:2)
The Windows Update site has not worked on XP for a couple years now
It works on some of my installs, and not on others. My working theory is that windows installs sometimes get owned during install while doing some kind of autoupdate :)
Re: (Score:2)
If you're gonna keep running XP (Score:3)
At least switch to a non-Microsoft browser and email client - something that'll continue to get updated like Firefox, Chrome, Thunderbird, etc.
Re: (Score:2)
Except, of course, that some business-critical sites will ONLY work with IE. It sucks, but until the vendors fix them, it is what it is.
Re: (Score:2)
"Out-of-band" Are you awake editors? (Score:3)
I thought Slashdot was supposed to be a geek site. It's an "out-of-cycle" patch, not an "out-of-band" one, although I assume it could be delivered out-of-band if you really wanted to (USB stick, CD, whatever.) Most users will certainly be receiving the patch in-band.
Submitters are allowed to be ignorant and make stupid mistakes; it's the job of the editors to correct those mistakes before posting a story.
As I see It..... (Score:2)
Support is not over, I believe I read that the UK government is paying in excess of 55million or more for XP support and then the Dutch government is doing the same. If Microsoft is being paid by multiple government entities to continue to provide patches and updates for XP why not give the general public the benefit of those patches as well? I realize that the most likely answer to that is why should they when what they want is everyone still using XP to go out and buy a shiny new Windows 8/8.1 PC. But at
It Makes Perfect Sense (Score:2)
The exploit has been known -- to SOMEONE -- for a while. So why did it come out of inventory all the sudden right now? Afraid that too many valuable targets would switch off XP or install new protection? Hardly likely that XP users will really switch this year. And where did it come from anyway? Transmitted from secret MS operatives to the bad guys? NSA wants to scare people into switching? Stupid bad guys just decided to use it while it was still fresh? There are many conspiracy theory variants on t
Give us the old GUI on windows 7 / 8 (Score:2)
I guess people would object less to giving up Windows XP if the plain old simple GUI was still an option. Not just "Classic" UI in Windows 7 : that one is crippled with the colour themes removed, it is absent from Windows 8.x, the task bar has to be tweaked and feels maybe not 100% the same (I want "show desktop" on the left, not the right). Most of all, if you go that way you have that ugly ass file manager. It's ugly and wastes space.
I used a 3rd party file manager, but it was not integrated (start menu,
Re: (Score:2)
Most of all, if you go that way you have that ugly ass file manager. It's ugly and wastes space.
Click the little arrow on the top right corner of the window. It allows you to hide the Ribbon menu (after that it will be temporarily shown when you open the subsections). From the View subsection you can also hide the side pane to make it even more compact.
Premise untrue (Score:2)
Microsoft no longer supports XP
Why do people keep saying this? It's simply untrue.
Microsoft do still support XP. The real change that has happened is that Microsoft have gone from providing free support to charging a lot of money for the same support. That's all.
Re: (Score:3)
Windows 3.1 doesn't support Windows Update.
Actually, 3.1 doesn't include Internet Explorer either, so it's not vulnerable. I don't know if 16-bit IE (I have a VM with IE 5 on 3.11) is vulnerable.
Re: (Score:2)
Those AOL 3.0 floppies (which is what most people used before Win95) had a custom version of IE. I'm not too worried though, even though I mess with Win 3.1 a lot myself, the malware's 32 bit API calls to modify the registry won't work, not even under Win32s.
Re: (Score:3)
Or even come with a TCP/IP stack (though it's possible to add one)
Re: (Score:2)
there is Windows for Workgroup, and in any case you can put Mosaic on either one to browse web pages
Re: (Score:2)
Which is in the Windows 3.1 (Janus) series
Re: (Score:2)
Streeeeeeeeeeeeeeeeetch
Re: (Score:2)
There is Windows 3.1 for Workgroups and Windows 3.11 not-for-Workgroups, but those versions must be extremely rare.
Re: (Score:2)
Updating Win 3.1 to 3.11 was just a matter of downloading a couple of files (as a package IIRC) from MS and installing them. Never owned Windows for Workgroups but do own WinOS2 which is a fork of Win3.1.
Re: (Score:2)
I stuck with Trumpet Winsock for a very long time. It was a far superior stack (I believe it supported IPV6 many years before Microsoft too. Not that I ever used it)
Re: (Score:2, Funny)
(Floppy) discs will be sent out soon for registered users.
Re: (Score:2)
Re:just kill them already (Score:5, Insightful)
the problem is when they get hacked, they aren't going to get rid of their machines or go offline.
they will just become one more in the zombie army, and the REST of us end up suffering.
Microsoft is doing the right thing here.
Re: (Score:2)
Re: (Score:3, Insightful)
Re: (Score:1)
Oh man, serves them well. When I go to that website I get "Your browser doesn't support Javascript". Seriously. The rest of the world disagrees though. If they can't make a website without depending on explorer specific js hacks it's no wonder they write software for specific OSes too.
Re: (Score:2)
Re: (Score:1)
Re: (Score:2)
Re:just kill them already (Score:5, Interesting)
XP is used in many commercial products which cannot easily be replaced by the end user. For example: http://rightfast.com/index.php... [rightfast.com]
I'm going to go out on a limb here and say that there's nothing wrong with XP in an embedded environment (such as in a bank's ATM). Exploits in most operating systems are almost always related to application-level attack surfaces, such as IE and Flash (as was this particular vulnerability). In a point of sale unit, there is no one surfing the web with the browser. As long as the front-facing application and hardware are properly locked down, there should be no problems. Note that Target's POS data breach was NOT done through the machines themselves, but through the backend network itself. Granted, lack of address space randomization makes it an easier target, but note carefully that the exploit discussed in the article was available on ALL platforms and IE versions, not just XP/IE6.
Where a company or user will get into trouble is if they're using Windows XP + IE6 in a user-controlled, internet-facing computer. And let's be clear here, it's been IE6 and not really XP that was the problem since the latest patches and the firewall was turned on by default. If they rely on IE6, then there's a good bet that they also rely on Flash or a Java plugin as well, and that's just tripling your attack surface, especially if they're not kept up to date as well for reasons of compatibility or laziness.
There's sort of a media feeding frenzy about Windows XP and it's end-of-life. Yes, people should move on to a supported OS as soon as it's practical, but XP users can greatly reduce their risk simply by using up-to-date applications. Use Chrome or Firefox when browsing, and if possible remove Flash and Java (I actually removed Flash about half a year ago for security reasons, and found that, for the most part, I don't really need it anymore). Note that this exploit was performed with the help of Flash as well - nothing to do with XP.
Re:just kill them already (Score:4, Informative)
Proper embedded applications using XP should be on Windows XP Embedded/ "Windows Embedded Standard 2009". WES2009 is XP based and will get security updates until 2019.
Re: (Score:2)
Use Chrome or Firefox when browsing, and if possible remove Flash and Java (I actually removed Flash about half a year ago for security reasons, and found that, for the most part, I don't really need it anymore). Note that this exploit was performed with the help of Flash as well - nothing to do with XP.
For those whose flash lockin is Youtube content (Let's Play videos), I finally found an answer to questions I'd explored months ago. We are forced to allow flash before seeing some monetized content. It's annoying how Google refuses to give you flash-less webm and mp4 streams and even lies that Flash is a must --until you force the right browser identification strings.
The Video without flash [mozilla.org] extension for firefox is a welcome solution for Youtube and some other mainstream sites known to have HTML5 video con
Re:just kill them already (Score:5, Funny)
Re: (Score:1)
Wow, that's an utterly stupid analogy. No one is still selling Windows XP, and I doubt anyone cares if someone resells their old computer with XP on it. The problem is that people want Microsoft to continue issuing security patches for XP, even though no one (except for some governments) is actually paying MS for this service.
No one expects Ford or Toyota to do recalls for 20+ year old cars when safety problems are discovered. Everyone with a brain knows that quarter-century-old cars do not offer nearly
Re: (Score:2)
What is reasonable for people to expect generally only tangentially has anything to do with what they actually DO expect. Sometimes you need to punch people in the face to get their attention, then kick them in the balls to get them to do the right thing.
Re:just kill them already (Score:4, Informative)
Ironically, my laptop cost a lot more than my car.
The analogy isn't really fair, though. Your car doesn't get pulled abut and poked and investigated by random wandering people throughout the entire day looking for a vulnerability. Even in a crime-ridden area. Your car isn't a guardian on the front line between all your financial, personal and secret information and the public Internet (whether you have a firewall or not, the OS is still the guardian of your data here).
And, still, cars get recalled, discontinued, or just taken off the road no matter their age. If it's not a "vintage" car, good luck as it gets older getting it to pass whatever your local roadworthiness test is, especially with shrinking emission limits and tightened safety requirements.
I speak as someone whose car is 15 years old - I wouldn't touch a PC over 4-years-old for my own use unless it was incredibly well-managed (and, yes, I manage networks for a living and have managed much older PC's adequately - I'm only two years past a XP->Windows 8, Office 2003->2013, Server 2003->Server 2012R2 upgrade, precisely because it worked and it was managed adequately, but we still couldn't carry it forever). I speak as someone who buys an "old banger" of a car every time my one won't pass the next test or starts edging out of roadworthiness, and never pays more than the cheapest of new laptops for the next one.
XP is dead. Kill it. Stop dragging it. It was good and fun while it lasted, but 7 or even 8 (with some tweaks) isn't that much of a loss at all. And I've yet to see a decent reason for a program you are using not to be updated to run on 7 (and, sorry, that matters more than anything else - the OS is irrespective if you're putting all your trust, money and maybe even life / business into an app that people can't be bothered to maintain once a decade or so).
I've put people on Ubuntu in the in-between. I've pulled Windows 8 into a system people can recognise and get along with. I've needed to support the most dumb, and the most eager, and the most knowledgeable users simultaneously.
But XP is dead. The fact that I acknowledge it is extremely telling. I never kill anything without a purpose. It's tricky to even install the fucking thing on anything approaching modern hardware (a lot of BIOS do not support legacy IDE any more, and SATA installs can be a minefield of AHCI drivers in XP).
You want to keep it? Install Linux and virtualise it. But, for fuck's sake, stop running it as the primary barrier between your personal files, local network and the Internet (no Internet firewall in the world can stop you getting infected and spewing your data OUT of the network, especially in the consumer/home use price ranges).
Re: (Score:1)
For some of us, MS Windows is only useful for legacy application. For instance, up to this year I had a production machine running XP. It is old and cannot be upgraded to MS Windows 7 or 8. but was running programs that I needed. I will phase out the programs and machine, but there was hardly a reason to buy a new machine. Like many other people, I do run MS Windows to do work, and when doing work something old is often good enough.
In addition, MS made a decision to push IE only web coding into the 21st
Re: (Score:2)
No, it's easy. You only install the services you ne...
I'm sorry, I just can't keep a straight face anymore.
Re:just kill them already (Score:4, Interesting)
There are a lot of people out there who may not be able to afford better hardware, or a copy of Windows 7. Given a choice between a roof over the head versus an upgrade of Windows, I'm sure not many would choose homelessness.
Then there is the fact that a lot of XP systems cannot be upgraded, and are part of an embedded system. A friend of mine has a $9000.00 sewing machine that runs XP, and if one tries to stick W7 on it, it won't have the drivers to move the embroidery head.
Then there is software that requires XP to function. Another friend of mine has a CNC mill for 2D wood carving that he copies data to a full size PCMCIA card. The reader/writer on the computer will not work with Vista or newer, and it won't work in a VM, so it is XP or nothing.
People don't -want- to run XP... but a lot have to. Just like the guy who drives the 10 year old Honda Civic. It isn't because he is in love with the car, but that he can't afford a new car, or he has other priorities.
Re: (Score:2)
but why would your friend use ie on his sewing machine? imo, xp is perfectly fine for such embedded uses, but please move on when it comes to your personal general purpose computer.
Re: (Score:1)
Re: (Score:2)
If a vulnerability that turns an XP machine into a zombie that can endlessly send out spam emails, for instance, it's a pretty safe bet that their ISP will simply disconnect them and won't allow them to reconnect until they are using a newer version of the OS.
Re: (Score:2)
Re: (Score:2)
It is theoretically possible, but not terribly practical. Basically, it would involve doing a port scan when you first receive a packet from a given IP, and it is possible to determine (or make an educated guess) from the results what OS a person has (or what OS they are simulating). As I said, not terribly practical.
That's not required for the ISP, however... the ISP can certainly disconnect somebody who is creating problems for their network, regardless of the OS that is being run. I've seen an I
Re: (Score:2)
I'll file that right next to Jobs saying in the early 90s he'd never go back to Apple. Proves that Apple is run by those fucking lying Democrats, they don't give a fuck about their customers or the truth....
Re: (Score:2)
Well, Jobs never will go back to Apple now ... ;-)
Re:There should be only two options (Score:5, Insightful)
So whenever a company discontinues a product, they relinquish all rights they had to that product? I don't think that's how copyright or patent law works.
Re: (Score:2)
No, but that's how it should work. But the public interest is not what copyright is about.
Re:There should be only two options (Score:5, Interesting)
So you're saying that Dodge should be obligated to release all intellectual property associated with, say, the Magnum. Even though that same technology is used in their other vehicles. Or Sony should release everything associated with the Playstation 3 and before. I don't think you've thought this through. If a product is ultimately superceded by a different product, and thus discontinued, the manufacturer should not be obligated to release anything.
Re:There should be only two options (Score:4, Insightful)
Yes, if I own a Magnum, and Dodge refuses to support it, then I should be able to go to somebody who can and will. So, yes, Dodge should lose its exclusive privileges granted by copyright law, absolutely.
Re: (Score:2)
Re: (Score:1)
Copyright law
Re: (Score:2)
You're not making any sense. Anybody is free to update early kernels and any other open software.
That's true. But the copyrights are still valid. I you want a software regime where [no support] = [copyright lapse], I suggest you contact your congressperson and try to get the copyright laws changed. Good luck with that.
Re: (Score:3)
Re: (Score:2)
Re: (Score:2)
Which would inevitably fail. So, irrelevant.
Re: (Score:2)