09.21.09

Gemini version available ♊︎

Microsoft Confirms Windows XP is Not — and Never Will be — Secure

Posted in Microsoft, Security, Windows at 2:21 pm by Dr. Roy Schestowitz

Is XP EOL?

Windows XP wallpaper style

Summary: With Windows Server 2003 and Windows Server 2000 near the dumpster, Microsoft takes a huge risk by not patching the most ubiquitous desktop operating system

MICROSOFT HAS stopped issuing patches for security flaws in Windows XP, which makes XP unsuitable (and maybe illegal) for use on the Internet.

This very bizarre stance (if not illegal because Microsoft advertised XP as supported for years to come) is more or less being ratified now that Microsoft offers radical advice for ‘removing’ the security risk:

Microsoft says turn off Windows feature to protect Windows

[...]

There’s no real reason for SMB2, (Server Message Block 2), a Microsoft network file and print-sharing protocol that ships with Windows Vista, Windows Server 2008 and Windows 7, to exist. All it does is duplicate the basic network file and print functionality that Windows has provided for over a decade. But, SMB2 is in there, it is broken, and, now it can be used to take over PCs.

Microsoft admits that the problem is real. Mark Wodrich and Jonathan Ness, part of the MSRC (Microsoft Security Response Center) engineering team wrote that an experimental exploit is already out and that it can gain “complete control of the targeted system and can be launched by an unauthenticated user.” Just what you didn’t need.

There is a way to fix it. Well, sort of. You have to turn SMB2 off.

This stuff cannot be made up. Microsoft is also neglecting Windows Server 2003 and is officially ending support for Server 2000 at the moment. This is a huge strategic risk for the company. Now is the time to advance GNU/Linux for domestic and commercial use.

Share in other sites/networks: These icons link to social bookmarking sites where readers can share and discover new web pages.
  • Reddit
  • email

Decor ᶃ Gemini Space

Below is a Web proxy. We recommend getting a Gemini client/browser.

Black/white/grey bullet button This post is also available in Gemini over at this address (requires a Gemini client/browser to open).

Decor ✐ Cross-references

Black/white/grey bullet button Pages that cross-reference this one, if any exist, are listed below or will be listed below over time.

Decor ▢ Respond and Discuss

Black/white/grey bullet button If you liked this post, consider subscribing to the RSS feed or join us now at the IRC channels.

9 Comments

  1. Yuhong Bao said,

    September 21, 2009 at 3:43 pm

    Gravatar

    “Microsoft Confirms Windows XP is Not — and Never Will be — Secure”
    Against this particular vulnerability only! Besides, this isn’t unusual. Look at the last months of security bulletins before MS discontinued NT 4 support in the end of 2004, some of them say NT 4 will be never be patched for the same reason.

    Roy Schestowitz Reply:

    NT 4…

    Microsoft is not a basis of comparison for Microsoft. :-p

    Yuhong Bao Reply:

    “Against this particular vulnerability only!”
    To clarify, I mean that, yes, MS will not patch this vulnerability, but that do not change the fact that MS will still try their best to patch XP against new security holes until the end of Extended Support in 2014, just like how MS did with NT 4 until end of 2004 and 98/ME until mid-2006.

  2. Yuhong Bao said,

    September 21, 2009 at 5:54 pm

    Gravatar

    “There’s no real reason for SMB2, (Server Message Block 2), a Microsoft network file and print-sharing protocol that ships with Windows Vista, Windows Server 2008 and Windows 7, to exist.”
    Well, I would not go that far, but the merits and disadvantages of the SMB 2.0 protocol itself is another topic altogether.

    twitter Reply:

    Ah Boa, you never “go that far.”

    Anyway, what’s a softie to do? They no longer even have the illusion of network security now. If XP is never patched again and Vista is knocked off the M$ network, where does that leave the Enterprise? None of them bothered to run Vista and won’t bother running Windows 7 either. So they are left with a very broken M$ infrastructure.

    Yuhong Bao Reply:

    I was specifically talking about the SMB 2.0 protocol, not Vista in general.
    “XP is never patched again”
    Not true, see my previous comment.

  3. Needs Sunlight said,

    September 22, 2009 at 5:58 am

    Gravatar

    Q: When is Windows exactly like Windows?
    A: When the $NEXT_VERSION is for sale.

    Q: When is Windows not like Windows?
    A: When the $NEXT_VERSION is for sale.

    M$ always allows criticism of it’s oldest supported version when trying to drum up sales of the $NEXT_VERSION. In this case it’s trying to peddle Vista7 and stem of further upgrades to Ubuntu.

    Of course it is different now than in the past. In the past, M$ embarrassed its executives and its programmers by releasing terribly poor, insecure and unstable software. But this time, honest, they’ve learned there lesson and the company will recover its reputation with
    Windows 3.0
    Windows 3.1
    Windows 3.11
    Windows NT
    Windows 95
    Windows 98
    Windows NT 4.0
    Windows 2000 (NT5)
    Windows Millennium Edition (Me)
    Windows XP
    Windows XP SP2
    Windows Server 2003
    Windows Home Server
    Windows Vista
    Windows Server 2008
    Windows Vista 7
    Windows Vista 8
    Windows Vista ng

    … Not!

    http://linuxlock.blogspot.com/2009/08/windows-users-charlie-browns-of.html

    Needs Sunlight Reply:

    Forgot overpriced in the description above.

    http://www.law.com/jsp/article.jsp?id=1088699765289

    There are 49 other states not counting the UK. :P

  4. Roy Schestowitz said,

    September 22, 2009 at 6:14 am

    Gravatar

    Watch this video from 2007 (when Vista was released). Around the 5th minute Linus speaks about how Vista is mostly hype.

DecorWhat Else is New


  1. Links 26/05/2022: DuckDuckGo Increasingly Exposed as Microsoft Proxy

    Links for the day



  2. EPO Celebrates Software Patents Again, Dubbing Them 'Hey Hi' (AI) and '4IR'

    The ludicrous state of the EPO is demonstrated by yesterday’s puff piece about “four million” (merely requests for monopoly in Europe; most come from outside Europe) and L’Oréal, which claims to have “invented” something that was already done in the 1990s if not the 1980s



  3. [Meme] EPO's Monkey Business: Lowering the Patent Examination Bar

    As we shall show in a moment, EPO President António Campinos has lowered the quality of patents and applications; sooner or later he might outsource the job to ‘livestock’



  4. IRC Proceedings: Wednesday, May 25, 2022

    IRC logs for Wednesday, May 25, 2022



  5. Heads of Patent Offices Are Immune to Coronavirus

    The overconfident chiefs of the U.S. Patent and Trademark Office (USPTO) and EPO might love speaking about COVID-19 (in relation to patents), but they do not take it seriously themselves



  6. Links 26/05/2022: Plex Finally on GNU/Linux

    Links for the day



  7. The General Consultative Committee of the EPO Exposes a Disaster and a Lack of Genuine Dialogue

    The General Consultative Committee (GCC) at the EPO deals with unlawful proposals from António Campinos (he’s happy to violate laws, constitutions, protocols, conventions, just like Benoît Battistelli did) and once again the abuses by managers is covered up; it’s as if the Office is run by unaccountable gangsters who arrogantly curse at everyone whilst insisting they’re the nicest people ever



  8. The Latest Letter to Josef Kratochvìl and the Heads of Delegation of the Administrative Council of the European Patent Organisation

    A week-old letter from the Central Staff Committee (CSC) to the Administrative Council of the European Patent Organisation highlights the nature of a crisis; there's no genuine dialogue and staff of the EPO (i.e. the scientists who do all the actual work) is constantly under attack



  9. [Meme] The Recordings Must Have Accidentally Been Lost While Breaking the Rules

    The EPO‘s “nicest” chief, Monopoly Tony, won’t even mention the recordings…



  10. Links 25/05/2022: ‘V Rising’ on GNU/Linux and Pearl Linux OS 11

    Links for the day



  11. Links 25/05/2022: Librem Tries Another Approach

    Links for the day



  12. IRC Proceedings: Tuesday, May 24, 2022

    IRC logs for Tuesday, May 24, 2022



  13. Links 24/05/2022: nginx-1.22.0 and WordPress 6.0

    Links for the day



  14. [Meme] Divine Protection

    You won’t find Monopoly Tony (António Campinos) wearing a mask at the EPO because the rules of the Office do not apply to him



  15. António Campinos and the Alicante Clique (EPO Management, Appointed Based on Nepotism Despite Lack of Qualifications) Nowadays Exploiting Kids for PR Charades

    The sick old habit of exploiting kids for Public Relations (PR) and marketing purposes is all too common at the EPO (they’re constantly exploiting “the children” to associate criticism of the EPO with demeaning the young and innocent), but the management — which enjoys nepotism and immunity rather than relevant skills — carries on today and it’s being called “inaugural”



  16. [Meme] Snake on a Plane

    The EPO‘s President ‘Monopoly Tony’ (António Campinos), whom you never see wearing a mask (none of the photo ops; he does not even socially distance himself from peers, he wears sneakers instead of masks) during the height of a pandemic, is the "f***ing president"; don’t tell him to wear one…



  17. Microsoft GitHub Exposé — Part XX — Entering Phase II

    We're about to resume the long-running series about the sick clique which ran GitHub until the assault on women became too much of a liability (among other wrongdoings and PR blunders)



  18. Links 24/05/2022: Fedora 37 Test Days and Tor Browser 11.0.13

    Links for the day



  19. Microsoft Vidal, as USPTO Director, Already Plays 'Political Cards' to Disguise and Deflect Away From the Corporate Agenda

    Microsoft Vidal, another corporate pawn in charge of the world’s most dangerous patent system, is using soft-spoken defle



  20. Links 24/05/2022: WAL-G 2.0

    Links for the day



  21. IRC Proceedings: Monday, May 23, 2022

    IRC logs for Monday, May 23, 2022



  22. Unethical Advertising, Published as So-called 'Articles', in CNX Software

    As we noted earlier this year, the CNX team is looking for money in the wrong places



  23. Links 23/05/2022: Broadcom to Buy VMware?

    Links for the day



  24. LibreOffice Conference 2022, As Before, Puts the Keynotes on Sale (the Rich Buy Influence, the Price Doubles)

    Discrimination against the community; talks and mentions are based on money, not merit ($2000 has become $4000 in just one year)



  25. Links 23/05/2022: Kdenlive 22.04.1 and New Alpine Linux Released

    Links for the day



  26. António Campinos Promotes Software Patents Using Buzzwords and Sketchy Loopholes With Dubious Legal Basis

    ‘Monopoly Tony’ (António Campinos) is shamelessly manipulating EPO processes at both ends (sender and receiver) to facilitate the illegal granting of invalid European software patents; we’re meant to think this former EU official and imposter (banker) is some guru in the sciences because he reads a lousy speech crafted for him with lots of meaningless buzzwords peppered all over it (he’s not good at reading it, either)



  27. [Meme] Jorgotta Be Kidding Us, Campinos!

    Monopoly Tony (António Campinos) runs the EPO by attacking the very legal basis of the EPO’s existence



  28. Unified Patent Court (UPC) Relies Too Much on Lies and Mischief Without Any Basis in Law

    Today’s video runs through the typical (weekly) lies from Team UPC — lies that are very easy to debunk; Team UPC not only drafted the thing but also looks to profit from it while misleading politicians and bribing publishers to spread intentionally misleading statements (lies)



  29. IRC Proceedings: Sunday, May 22, 2022

    IRC logs for Sunday, May 22, 2022



  30. Links 23/05/2022: Fedora 36 Reviewed

    Links for the day


RSS 64x64RSS Feed: subscribe to the RSS feed for regular updates

Home iconSite Wiki: You can improve this site by helping the extension of the site's content

Home iconSite Home: Background about the site and some key features in the front page

Chat iconIRC Channel: Come and chat with us in real time

Recent Posts