What are the potential security issues when I keep using Windows XP?

Question

Microsoft stopped updating Windows XP and the media warns us of security leaks. I actually just read that continuing to use Windows XP is "extremely" dangerous. Why exactly is this such a danger? I would believe that by now XP should be pretty safe to use after years of updates.

Are there particular things XP users have to look out for and perhaps take counter measures against?

I would also believe that all the interesting places for hackers will update to Windows 7/8 and serious threats will not be created anymore in the future, at least not specifically aimed at Windows XP.

Answer 1

Some reasons that XP is NOT safe, regardless of security updates.

Here are some facts to be aware of:

1. Antivirus is a conceptually flawed approach to malware protection. Everyone should use one, but accept that at least 20% of the threats in the wild will penetrate their defenses. at times (depending on product) up to 60% of malware may evade detection.

2. XP due to its age and popularity, has more established 0-day exploits than any newer windows OS. There are currently 964 CVEs affecting XP, 511 affecting Vista, and 410 affecting Windows 7 (many of which relate to Windows 7 Phone).

3. XP lacks a number of critical kernel features common today including:

   • driver signing requirements (and WHQL certification)
   • restricted access to raw memory
   • Kernel-mode integrity checking
   • protections from malicious kernel patches
   • working Address space randomization and Data Execution Prevention (true DEP is impossible without additional restrictions on memory access)
   • Permissions enforcement on all resources, including registry keys and device drivers (Windows Resource Protection)
   • TPM integration
     
     

4. Most XP users run as system admin. Simple attacks like drive by downloads can automatically:

   • patch kernel components
   • install malicious drivers and rootkits
   • manipulate, install, and start services.
   • access protected registry areas
   • access raw memory to steal data.
   • traverse user directories and files with no boundaries.
     
     

5. Many new applications or new versions of old applications won't run on XP. Though I am loathe to consider it, IE is a widely used browser, and the versions of it that can be run on XP are objectively less secure than the modern versions for Win7/8. MS may provide a patch for vulnerabilities found in their SSL libraries, but they can't make it use real ALSR if the underlying kernel can't.

6. UAC (while annoying, and not nearly so flexible as sudo) does present a meaningful limitation on the actions an attacker can take without user intervention.

7. Exploits don't just go away. the attacks that were going on in 2004 against XP are still going on, they are just affecting fewer and fewer people every day as consumers get new PCs. there will remain malware targeting XP for a very long time yet. It is likely that no new security patches will be available to patch vulnerabilities that exist only in XP (are already mitigated in vista+).

Answer 2

Windows XP has been deemed "dangerous" by several people because Microsoft is no longer providing security updates. Some people state that because of the lack of updates, any new vulnerabilities found in XP will not be patched, which can be a major security issue as many healthcare facilities still utilize XP, and several Point-of-Sale (POS) systems use XP as their base (we don't want another Target incident). I'll also add some history here: when Windows XP SP2 left support, there was an increase of malware by 66% with machines running XP SP2 instead of SP3 (source - ComputerWorld).

On the contrary, some believe the XP is still safe. There is an excellent article on ComputerWorld stating that "Sticking with Windows XP can be a smart move". In a nutshell, some users believe that XP will be perfectly safe, as long as you use a good third-party firewall and good third-party antivirus (it is strongly encouraged to not use Windows Firewall on XP anymore because of the lack of updates). I'll add an article on "How to Support Windows XP Now That Microsoft Isn't"

I'll add some links down here for some good readings about the "death" of XP (I understand that links are discouraged, however this response and many others could last forever if I try to include every little detail in this answer):

• The Risk of Running Windows XP After Support Ends
• Windows XP: The End is Nigh
• Windows XP Infection Rate May Jump 66% After Patches End in April
• How to Support Windows XP Now That Microsoft Isn't

Answer 3

Many of the vulnerabilities discovered in Windows are applied to all current operating systems, including XP.

When these fixes are no longer released for XP, but released for other versions of Windows, it's easy for an attacker who knows what they are doing to determine how XP is vulnerable, by monitoring the updates released for operating systems past XP.

Microsoft is basically telling anyone who cares exactly what is vulnerable in XP after the XP EOL date.

Answer 4

For the purposes of this answer, I am interpreting the question as focused on what has changed about running Windows XP on April 7, 2014 vs on April 9, 2014. To put another way, I am not going to speak to the myriad of advantages and disadvantages that were true on both days, but rather what specifically changed about Windows XP security on April 8th.

So, from that perspective, lack of patching capability is the security issue with XP post April 8th, and it's a major one. No, running "good" anti-virus software and a third-party firewall won't make up for it. Not by a long shot.

Security is a multi-faceted problem. "Being Secure" involves using encrypted communication channels (https), running active monitoring/detection software (anti-virus/malware), only downloading software from trusted sources, validating signatures on downloaded applications, avoiding notoriously weak software, and updating/patching software promptly.

All of these practices and products taken together can be called security hygiene and, in the case of Windows XP, you can continue to practice all these things except for one: patching, but it won't help.

Why Patching Matters

Therein lies the first and most critical problem. Aggressive patching is the absolute most effective practice of all, and this is why:

• Anti-virus fails at alarming rates, 40% according to this study. Plenty of others abound. Detection is still mostly based on fixed signatures. Remixing old exploits to evade detection is trivial.
• Firewalls do not stop what users let in. PDF, Flash, and Java: the Most Dangerous File Types are all invited right through the firewall. Unless the firewall is blocking The Internet, it's not going to help.

Running the latest anti-virus and firewall just doesn't do much. That's not to say they aren't effective in combination with all the above hygiene, and anti-virus will eventually detect some exploits as they age, but even then trivial repackaging will evade detection and the underlying exploits will still work. Patching is the foundation of a good defense. Without patching, everything else is just gravy. The vast majority of malware depends on unpatched software to succeed:

How the most common cyber exploits could be prevented (2011):

One of the more disturbing, although not surprising, findings was that the top 15 vulnerabilities being exploited by observed attacks were all well-known and had patches available, some of them for years. The Office Web Components Active Script Execution vulnerability, No. 2 on the hit list, has been patched since 2002. The top vulnerability, in Microsoft’s Internet Explorer RDS ActiveX, has been patched since 2006.

Interesting Analysis on Patching and Attacks:

“In this supplemental analysis, zero-day exploitation accounted for about 0.12 percent of all exploit activity in 1H11, reaching a peak of 0.37 percent in June.”

“Of the attacks attributed to exploits in the 1H11 MSRT data, less than half of them targeted vulnerabilities disclosed within the previous year, and none targeted vulnerabilities that were zero-day during the first half of 2011.”

In other words, the vast majority of successful exploits are only possible because people did not apply patches when they became available. Even now, the majority of the successful Java exploits are against vulnerabilities that have been patched, users are not updating. I could post dozens more research papers and articles but, the point is, when vulnerabilities are known and patches are not applied, that is where the damage increasingly comes from. Malware, like any software, grows and spreads over time. Patches inoculate against old malware but, if patches never come, the environment is getting increasingly toxic by the day, and there is no cure to be had.

Without patches, zero-day vulnerabilities are never closed, they are effectively "zero-day" forever. As each new vulnerability is found, malware authors can spin new minor variations to avoid signature detection, and the OS will always be vulnerable. So Windows XP will become less and less secure over time. In practice, this will look a lot like what we see in the above GCN report among the 40% of XP users in 2011 who hadn't even installed patches from 2002 (so, post-April 8th, that will be 100% by definition). Compounding the problem will be the fact that malware authors are already focusing on XP again, knowing that anything they find will remain valuable and exploitable long term.

In the age of always/frequently-on, always-connected devices, aggressive and frequent patching is a base requirement of any OS.

Answer 5

The danger is with the applications that exist within Windows XP, such as Internet Explorer. Under XP this software will no longer receive patches, so as new exploits develop and are fixed under the Vista and Windows 7 that same exploit will still remain under XP.

One exploit that provides proof “WMF” exploit virus, which allows hackers to run code on a unpatched machine. This exploit was discovered in 2006 but had existed as code had been migrated from the days of Windows 3.0 and affects all Windows versions from Windows up to Windows Server 2003. Microsoft has issued a patch to fix Windows 2000, Windows XP, and Server 2003, but did not patch Windows NT. Microsoft re-uses code from old versions of the OS, brought forward. It does not mean that all the bugs have been fixed and exploits patched.

Setting aside the issue of security and not fixing the continuing exploits one can look at the future availability of software. Newer application may not run on a XP machine due to not being able to install newer .NET frameworks or other requirements that does not exist under XP. As I have seen with Windows 9X most software companies tend to support for ensuring that their product will function under those OS’s. Norton Antivirus was one product that comes to mind, as the installation for this product relied on Internet Explorer for its installation.

As for counter measures to protect the system, to me would to me just give one the illusion of a protected system, as there is some much to Windows. You would have to spend countless hours keeping track of what is patched / and what is still a security risk. Only counter measure is replace Windows XP with a OS that Microsoft will continue to Patch. It all boils down to what you are going to use the PC for, who is using it (Other computer users or just yourself), and what its attached to. As for my home network I discontinued XP a long time ago, skipped Vista and its issues, and run both Ubuntu and Windows 7. I have tested Windows 8 but did not like how it acted on my network. The Operating System is the sum of all its parts, there is more too it then just an unpatched firewall or installing a new anti-virus to try an protect it.