ID: IRCNE2013081925
Date: 2013-08-17
According to “Computerworld” Microsoft warned Windows XP customers that they face never-patched, never-dead "zero-day" vulnerabilities if they don't dump the 12-year-old operating system before its April 2014 retirement deadline.
The warning -- just the latest in a two-year campaign to denigrate XP and convince users to leave it behind -- was similar to one given earlier this week by a long-time SANS security trainer, who predicted that hackers would save their vulnerabilities until after XP's retirement, then unleash them on unprotected PCs.
"The very first month [after April 2014] that Microsoft releases security updates for supported versions of Windows, attackers will reverse-engineer those updates, find the vulnerabilities and test Windows XP to see if it shares those vulnerabilities," said Tim Rains, a director in Microsoft's Trustworthy Computing group, in a Thursday blog.
"If [XP shares the vulnerabilities], attackers will attempt to develop exploit code that can take advantage of those vulnerabilities on Windows XP. Since a security update will never become available for Windows XP to address these vulnerabilities, Windows XP will essentially have a 'zero day' vulnerability forever," Rains said.
Reverse-engineering of patches is a common practice by both security researchers and cyber criminals.
Once a patch is released -- say for Windows 7 in May 2014 -- hackers can do a code comparison between the updated and non-updated versions to locate the changes. With the changes in hand, astute researchers can figure out where the vulnerability was. Finally, they can use that information to poke around Windows XP to see if it, too, has buggy code similar to the non-patched Windows 7.
That's one of the reasons why when Microsoft patches a bug in Windows 8, it often also patches the same vulnerability in older editions.
- 3