Windows XP 21 Times More Likely to be Exploited Than Windows 8

http://news.softpedia.com/news/Wind...-than-Windows-8-Claims-Microsoft-360240.shtml

 

My prio is to keep those "apps" updated, and not moving to a new OS.

 

No. That's not entirely accurate. While yes, MS has finally addressed some of the most critical long standing security limitations compared to it's predecessors, XP properly configured and supported with just the right combination from hundreds of solid security solutions fashioned more or less exclusively for that platform including but not limited to Virtualization apps, Limited Rights, HIPS, and the list goes on to infinity IMO.

It's only a matter of time before malware makers, to test their expertise yet again, start up their campaign to crack Patchguard and God knows what else they'll drive MS nuts with, and security developers will be back in the money again. LoL

 

The top overarching vulnerability in apps on WinXP is simple: they're run with unrestricted Admin rights because WinXP can require considerable work to run as a low-rights user (and I would know) and doesn't have a Protected Admin option either. So a compromise can have dramatic consequences due to the lack of OS mitigations.

Anyway, the stats seem plausible enough, given how far Windows has come since WinXP RTM, aka "Win2000 with fog lights" was released. It'll be interesting to see how things go after security support for WinXP expires.

 

A Year From Now Support for Windows XP Ends, Now What?
http://blogs.windows.com/windows/b/...now-support-for-windows-xp-ends-now-what.aspx

ESET - Six months with Windows 8 (white paper)
http://www.welivesecurity.com/2013/06/06/six-months-with-windows-8-white-paper/

 

Thats the key point, moreover many users are still on SP2 for which support has expired long ago (i.e. no security patches for them)

 

Not correct.
Mrk

 

The statements in that article is nothing more then redundancy. Of course windows 8 is more secure, at least until it's rip apart and disected like all their other platforms eventually were.

They have took measures to seal off easy tampering with the kernel at least for the time being. I noticed it is much more stable then any of it's other systems before in that when applications hang as they always will, your entire desktop doesnt crash aka: explorer doesn't exhibit such severe pressures that it caves in so readily as before.

XP is still a very workable model that many including myself will continue to exhaust until it's last breath lol. It remains immensely customizable as well as easily configurable to suit the users personal desktop needs.

 

That is according to how you have it setup, it can be just as secure as "other" OS if it is setup right, but in "STOCK" form I will agree with you

I will be using it far beyond it's so called end of life

 

It's entirely correct.

Security has, and always will be, a cat and mouse game. People criticize the hell out of governments and companies that use old OS's (including 5year old Linux distros) then end up in the news about being hacked, user credentials leaked, etc. Yet it's fine for consumers to do so? The teaching needs to begin somewhere and that's with keeping your software updated, including your OS.

5 years from now hackers will find ways past anti exploit measures that are available now, but 5 years from now we'll also have new anti exploit measures to beat them. Fortunately restricted environments like AppContainer introduced in Windows 8 makes successful exploitation unrewarding.

 

Enlighten me with hard, mathematical proof, not speculations, spins by would-be technologists or companies with vested interest in selling products directly related to XP's demise.
Mrk

 

There are solutions that don't require a lot of work, that will restrict exploits against vulnerabilites in applications from installing their payload.





----
rich
WinXP SP3
Runnining as Administrator

 

The issue here is that saying "21x more likely" is meaningless. What he should be explaining is how simple it is to attack an XP machine.

If you think that Vista+ are more secure because they aren't analyzed as much, you're incorrect. Exploiting vulnerabilities in XP is just simpler.

Explaining that to people properly is the issue, because understanding why that's the case actually takes work, and most people would rather just dance around that.

 

agree totally pete

scare tactics once again

 

Yes, but you know how to setup XP and secure it, you cannot expect that 99% of users out there will do the same or understand how to do it and even if you do it for them then at the first problem with legit new software (e.g. missing permissions, limited access, etc.) they will be lost again .

 

I was wondering something about XP's end of life. When will they shut down the activation servers? I realize the relevant data can be backed up, but could it get to a point where people still using XP would no longer be able to activate a reinstallation (at least without calling on the phone, I suppose)?

 

Enlighten me with hard, mathematical proof, not random statements from would be technological "bloggers" with vested interests in pushing their point of views on others.

Well said.

 

Who cares about the exact no. of times more likely? You know it's based on statistics so it's a rough figure/estimation. Look at it as just that and not to the point of decimal perfection. At worst, accept it as a form of exaggeration to get the message across.

If you manage to keep your setup from malware without updates....good for you. It's no surprise especially if one knows how to avoid being socially engineered and is running a setup that's different from the majority of XP or even Win8 users out there. The element of security by diversity plays a huge role there.

Arbitrary code execution. The majority of exploits likes to drop a payload on disk and create a new process to gain better persistence and be able to cause a higher level of damage. White-listing (AE, HIPS, etc) stops the payload execution (on disk) but what about in-memory execution? Memory is the greatest challenge for white-listing as mentioned here:

Application Whitelisting: Panacea or Propaganda

Key point here is that that XP is missing anti-exploit features found in Vista on-wards which is improved upon in Win7 and now Win8. Examples:

Exploit Mitigation Improvements In Windows 8
https://www.wilderssecurity.com/showthread.php?t=335602

Windows 8 Security Improvements
http://technet.microsoft.com/en-US/windows/jj983723.aspx

Sure, you can run LUA in XP but you're still missing out on the benefits of Integrity Levels. Even EMET which is highly recommended (and more so for XP since it back-ports some modern security features) can't bring ASLR and SEHOP onto XP.

Vested interest in selling products - that's like saying the obvious. The seller always has his own bias. However that doesn't mean the facts mentioned are necessarily untruthful - people like to make marketing look evil.

Basically, "More likely" doesn't mean "would be". It just signals that provided all others factors are constant, XP is easier to exploit than Win8. The argument here is Windows 8 simply makes it much harder in terms of scale of exploitability...not about whether someone's PC gets infected or not.

 

This works fine until someone invokes a privilege escalation vulnerability before launching the payload; e.g. using a vulnerable system call, or invoking an exploit in a privileged service. Whitelisting obviously makes things a little trickier since you can't just launch the payload, but that doesn't really cut it as the sole layer of defense.

EXE blockers work (for now) but using them IMO boils down to a reliance on bad engineering - namely, bad engineering on part of malware authors, who are too lazy to do the extra work to bypass your defenses (because there are millions of people with even more vulnerable setups). Even granted that "make things expensive for the attacker" is a big part of security, this doesn't strike me as sensible.

Hate to break it to you but this is classic magical thinking. The OS was vulnerable for as long as the flaw existed. If users were lucky, the hole was unknown; if they weren't, it was known to some blackhats but not to Microsoft.

Even in the former case, for MS it would be a matter of preempting the blackhats - the hole could have been discovered independently. Probably would have, given how much of a market there is for vulnerabilities. Staying a few steps ahead of the criminal element is an unfortunate fact of life in this field.

 

I did not say, nor imply, that it is or should be the sole layer of defense.


----
rich

 

The burden of proof is on you - or microsoft - because you want users to spend money. Therefore, show that their investment will be well spent.

As to my proof, it's simple:

Running default windows xp boxes, no infection.
Running default windows 7 boxes, no infection.
Hence, no infection.

Mrk

 

Your proof is mathematically incorrect! 21 times zero is still zero, that means that even in your case Windows XP was 21 times more likely to be exploited than Windows 8! (of course in your case you could also say that Windows 8 was 100 times more likely to be infected that XP, but that's another issue alltogether)

 

No, because that 21 x 0 is not 21 more than 0, it's zero
Mrk