Microsoft will ditch Security updates, bug fixes for the venerable Windows XP Operating System today, Tuesday 08/04/2014.
It means that there will be no more official security updates and bug fixes for the operating system from Microsoft.
However some governments have negotiated extended support contracts for the OS in a bid to keep users protected.
Security firms said anyone else using the 13-year-old software would be at increased risk of infection and compromise by cyber-thieves.
Old code
Statistics suggest 20-25% of all users have stuck with XP despite the fact that there have been three major releases of Windows since its debut in 2001.
Some existing XP users have struck deals to get security fixes from Microsoft while they complete their migration away from the ageing code.
The UK government has signed a £5.5m deal for extended support. Similarly the Dutch government has signed a "multi-million euro" deal to obtain help for the 40,000 PCs running XP used by the nation's civil servants.
Anyone currently running Windows XP already faced a disproportionate risk of falling victim to malware, said Dave Emm, a senior research analyst at security firm Kaspersky.
Many of the world's cash machines are still believed to be running Windows XP.
"Our data indicates that less than one fifth of our customers run Windows XP but more than a quarter of infections are Windows XP-based," he said.
That exposure ratio was only going to get worse after 8 April, he said, once the last security patch for Windows XP had been released.
That final patch will fix a series of bugs, one of which is rated as critical and is already being actively exploited despite only being discovered in late March.
"Effectively, every vulnerability discovered after 8 April will become a zero-day vulnerability - that is, one for which there is and never will be, a patch," said Mr Emm.
Windows XP users topped the list of victims cyber-thieves targeted, said Maik Morgenstern and Andreas Marx from the German AV-Test group, which rates and ranks security software.
"Malware writers go for the low hanging fruits because it's a lot easier to infect systems running on an old Windows XP operating system compared to brand-new Windows 8.1, with all its built-in security features," they said.
"We think we will see a lot of attacks for Windows XP within the next few months, but attackers will also always add exploits for other Windows systems just to catch those systems as well."
Patch plan
Many have stuck with XP and ignored newer versions of Windows
Orla Cox, a senior manager at cyber-defence firm Symantec's security response unit, said criminals groups were likely to hoard the XP vulnerabilities they knew about rather than use them to bolster malware being spammed out to millions of people.
"The types of groups sitting on zero-days will tend to use them against high-end targets and for corporate espionage," she said. "Some organisations will have particular concerns because they find it so hard to move away from XP."
However, she added, any zero-day that did get used against a corporate target was likely to be re-used later on.
"Once it's out there it gets into the malware kits and then gets circulated and there will be no defence," she said.
Mark O'Neill, a spokesman for data management firm Axway, said organisations were getting better at coping with software that had hit its end-of-life.
"Beyond high-profile programs like XP there are a lot of products that have gone out of support because the company behind them has gone out of business or was acquired," he said.
In addition many other products were written in old programming languages that made them expensive to maintain and update.
As a result, many IT departments have put such ageing programs in the virtual equivalent of a "black box" and subsequently update the external code if security patches need to be applied.
"You can create a layer above the older application and that gives you a place to patch," Mr O'Neill said.
"Companies are not defenceless even with the things they cannot patch."
Source:
BBC
A five-year-old boy who worked out a security vulnerability on Microsoft's Xbox Live service has been officially thanked by the company.
Kristoffer Von Hassel, from San Diego, figured out how to log in to his dad's account without the right password.
Microsoft has fixed the flaw, and added Kristoffer to its list of recognised security researchers.
In an interview with local news station KGTV, Kristoffer said: "I was like yea!"
The boy worked out that entering the wrong password into the log-in screen would bring up a second password verification screen.
Kristoffer discovered that if he simply pressed the space bar to fill up the password field, the system would let him in to his dad's account.
"I got nervous. I thought he was going to find out," Kristoffer told television station, KGTV. "I thought someone was going to steal the Xbox."
Dad Robert - who works in security - sent details of the flaw to Microsoft. In a statement, Microsoft said: "We're always listening to our customers and thank them for bringing issues to our attention.
"We take security seriously at Xbox and fixed the issue as soon as we learned about it."
Kristoffer's name now appears on a page set up to thank people who have discovered problems with Microsoft products.
The company also gave him four free games, $50 (£30), and a year-long subscription to Xbox Live.
Culled from:
BBC
