09.21.09

Gemini version available ♊︎

Microsoft Confirms Windows XP is Not — and Never Will be — Secure

Posted in Microsoft, Security, Windows at 2:21 pm by Dr. Roy Schestowitz

Is XP EOL?

Windows XP wallpaper style

Summary: With Windows Server 2003 and Windows Server 2000 near the dumpster, Microsoft takes a huge risk by not patching the most ubiquitous desktop operating system

MICROSOFT HAS stopped issuing patches for security flaws in Windows XP, which makes XP unsuitable (and maybe illegal) for use on the Internet.

This very bizarre stance (if not illegal because Microsoft advertised XP as supported for years to come) is more or less being ratified now that Microsoft offers radical advice for ‘removing’ the security risk:

Microsoft says turn off Windows feature to protect Windows

[...]

There’s no real reason for SMB2, (Server Message Block 2), a Microsoft network file and print-sharing protocol that ships with Windows Vista, Windows Server 2008 and Windows 7, to exist. All it does is duplicate the basic network file and print functionality that Windows has provided for over a decade. But, SMB2 is in there, it is broken, and, now it can be used to take over PCs.

Microsoft admits that the problem is real. Mark Wodrich and Jonathan Ness, part of the MSRC (Microsoft Security Response Center) engineering team wrote that an experimental exploit is already out and that it can gain “complete control of the targeted system and can be launched by an unauthenticated user.” Just what you didn’t need.

There is a way to fix it. Well, sort of. You have to turn SMB2 off.

This stuff cannot be made up. Microsoft is also neglecting Windows Server 2003 and is officially ending support for Server 2000 at the moment. This is a huge strategic risk for the company. Now is the time to advance GNU/Linux for domestic and commercial use.

Share in other sites/networks: These icons link to social bookmarking sites where readers can share and discover new web pages.
  • Reddit
  • email

Decor ᶃ Gemini Space

Below is a Web proxy. We recommend getting a Gemini client/browser.

Black/white/grey bullet button This post is also available in Gemini over at this address (requires a Gemini client/browser to open).

Decor ✐ Cross-references

Black/white/grey bullet button Pages that cross-reference this one, if any exist, are listed below or will be listed below over time.

Decor ▢ Respond and Discuss

Black/white/grey bullet button If you liked this post, consider subscribing to the RSS feed or join us now at the IRC channels.

9 Comments

  1. Yuhong Bao said,

    September 21, 2009 at 3:43 pm

    Gravatar

    “Microsoft Confirms Windows XP is Not — and Never Will be — Secure”
    Against this particular vulnerability only! Besides, this isn’t unusual. Look at the last months of security bulletins before MS discontinued NT 4 support in the end of 2004, some of them say NT 4 will be never be patched for the same reason.

    Roy Schestowitz Reply:

    NT 4…

    Microsoft is not a basis of comparison for Microsoft. :-p

    Yuhong Bao Reply:

    “Against this particular vulnerability only!”
    To clarify, I mean that, yes, MS will not patch this vulnerability, but that do not change the fact that MS will still try their best to patch XP against new security holes until the end of Extended Support in 2014, just like how MS did with NT 4 until end of 2004 and 98/ME until mid-2006.

  2. Yuhong Bao said,

    September 21, 2009 at 5:54 pm

    Gravatar

    “There’s no real reason for SMB2, (Server Message Block 2), a Microsoft network file and print-sharing protocol that ships with Windows Vista, Windows Server 2008 and Windows 7, to exist.”
    Well, I would not go that far, but the merits and disadvantages of the SMB 2.0 protocol itself is another topic altogether.

    twitter Reply:

    Ah Boa, you never “go that far.”

    Anyway, what’s a softie to do? They no longer even have the illusion of network security now. If XP is never patched again and Vista is knocked off the M$ network, where does that leave the Enterprise? None of them bothered to run Vista and won’t bother running Windows 7 either. So they are left with a very broken M$ infrastructure.

    Yuhong Bao Reply:

    I was specifically talking about the SMB 2.0 protocol, not Vista in general.
    “XP is never patched again”
    Not true, see my previous comment.

  3. Needs Sunlight said,

    September 22, 2009 at 5:58 am

    Gravatar

    Q: When is Windows exactly like Windows?
    A: When the $NEXT_VERSION is for sale.

    Q: When is Windows not like Windows?
    A: When the $NEXT_VERSION is for sale.

    M$ always allows criticism of it’s oldest supported version when trying to drum up sales of the $NEXT_VERSION. In this case it’s trying to peddle Vista7 and stem of further upgrades to Ubuntu.

    Of course it is different now than in the past. In the past, M$ embarrassed its executives and its programmers by releasing terribly poor, insecure and unstable software. But this time, honest, they’ve learned there lesson and the company will recover its reputation with
    Windows 3.0
    Windows 3.1
    Windows 3.11
    Windows NT
    Windows 95
    Windows 98
    Windows NT 4.0
    Windows 2000 (NT5)
    Windows Millennium Edition (Me)
    Windows XP
    Windows XP SP2
    Windows Server 2003
    Windows Home Server
    Windows Vista
    Windows Server 2008
    Windows Vista 7
    Windows Vista 8
    Windows Vista ng

    … Not!

    http://linuxlock.blogspot.com/2009/08/windows-users-charlie-browns-of.html

    Needs Sunlight Reply:

    Forgot overpriced in the description above.

    http://www.law.com/jsp/article.jsp?id=1088699765289

    There are 49 other states not counting the UK. :P

  4. Roy Schestowitz said,

    September 22, 2009 at 6:14 am

    Gravatar

    Watch this video from 2007 (when Vista was released). Around the 5th minute Linus speaks about how Vista is mostly hype.

DecorWhat Else is New


  1. Links 20/1/2022: Linuxfx 11.1 WxDesktop 11.0.3 and FreeIPMI 1.6.9 Released

    Links for the day



  2. Links 19/1/2022: XWayland 22.1 RC1 and OnlyOffice 7.0 Release

    Links for the day



  3. Links 19/1/2022: ArchLabs 2022.01.18 and KDE's 15-Minute Bug Initiative

    Links for the day



  4. When Twitter Protects Abusers and Abuse (and Twitter's Sponsors)

    Twitter is an out-of-control censorship machine and it should be treated accordingly even by those who merely "read" or "follow" Twitter accounts; Twitter is a filter, not a news/media platform or even means of communication



  5. IRC Proceedings: Tuesday, January 18, 2022

    IRC logs for Tuesday, January 18, 2022



  6. Links 19/1/2022: Wine 7.x Era Begins and Istio 1.12.2 is Out

    Links for the day



  7. Another Video IBM Does Not Want You to Watch

    It seems very much possible that IBM (or someone close to IBM) is trying to purge me from Twitter, so let’s examine what they may be trying to distract from. As we put it 2 years ago, "Watson" is a lot more offensive than those supposedly offensive words IBM is working to purge; think about those hundreds of Red Hat workers who are black and were never told about ethnic purges of blacks facilitated by IBM (their new boss).



  8. What IBM Does Not Want You to Watch

    Let's 'Streisand it'...



  9. Good News, Bad News (and Back to Normal)

    When many services are reliant on the integrity of a single, very tiny MicroSD card you're only moments away from 2 days of intensive labour (recovery, investigation, migration, and further coding); we've learned our lessons and took advantage of this incident to upgrade the operating system, double the storage space, even improve the code slightly (for compatibility with newer systems)



  10. Someone Is Very Desperate to Knock My Account Off Twitter

    Many reports against me — some successful — are putting my free speech (and factual statements) at risk



  11. Links 18/1/2022: Deepin 20.4 and Qubes OS 4.1.0 RC4

    Links for the day



  12. Links 18/1/2022: GNOME 42 Alpha and KStars 3.5.7

    Links for the day



  13. IRC Proceedings: Monday, January 17, 2022

    IRC logs for Monday, January 17, 2022



  14. Links 17/1/2022: More Microsoft-Connected FUD Against Linux as Its Share Continues to Fall

    Links for the day



  15. The GUI Challenge

    The latest article from Andy concerns the Command Line Challenge



  16. Links 17/1/2022: digiKam 7.5.0 and GhostBSD 22.01.12 Released

    Links for the day



  17. IRC Proceedings: Sunday, January 16, 2022

    IRC logs for Sunday, January 16, 2022



  18. Links 17/1/2022: postmarketOS 21.12 Service Pack 1 and Mumble 1.4 Released

    Links for the day



  19. [Meme] Gemini Space (or Geminispace): From 441 Working Capsules to 1,600 Working Capsules in Just 12 Months

    Gemini space now boasts 1,600 working capsules, a massive growth compared to last January, as we noted the other day (1,600 is now official)



  20. [Meme] European Patent Office Space

    The EPO maintains a culture of illegal surveillance, inherited from Benoît Battistelli and taken to a whole new level by António Campinos



  21. Gemini Rings (Like Webrings) and Shared Spaces in Geminspace

    Much like the Web of 20+ years ago, Gemini lets online communities — real communities (not abused tenants, groomed to be ‘monetised’ like in Facebook or Flickr) — form networks, guilds, and rings



  22. Links 16/1/2022: Latte Dock 0.11 and librest 0.9.0

    Links for the day



  23. The Corporate Cabal (and Spy Agencies-Enabled Monopolies) Engages in Raiding of the Free Software Community and Hacker Culture

    In an overt attack on the people who actually did all the work — the geeks who built excellent software to be gradually privatised through the Linux Foundation (a sort of price-fixing and openwashing cartel for shared interests of proprietary software firms) — is receiving more widespread condemnation; even the OSI has been bribed to become a part-time Microsoft outsourcer as organisations are easier to corrupt than communities



  24. EPO's Web Site Constantly Spammed by Lies About Privacy While EPO Breaks the Law and Outsources Data to the United States

    The António Campinos-led EPO works for imperialism, it not only protects the rich; sadly, António’s father isn’t alive anymore and surely he would blast his son for doing what he does to progress his career while lying to staff and European citizens



  25. Links 16/1/2022: Tsunami and Patents

    Links for the day



  26. IRC Proceedings: Saturday, January 15, 2022

    IRC logs for Saturday, January 15, 2022



  27. Links 16/1/2022: Year of the GNU/Linux Desktop and Catch-up With Patent Misinformation

    Links for the day



  28. Patrick Breyer, Unlike Most German Politicians, Highlights the Fact That Unified Patent Court (UPC) and Unitary Patent Are Incompatible With EU Law

    A longtime critic of EPO abuses (under both Benoît Battistelli and António Campinos leadership), as well as a vocal critic of software patents, steps in to point out the very obvious



  29. Links 15/1/2022: Flameshot 11.0 and Libvirt 8.0

    Links for the day



  30. Blogging and Microblogging in Geminispace With Gemini Protocol

    Writing one’s thoughts and other things in Geminispace — even without setting up a Gemini server — is totally possible; gateways and services do exist for this purpose


RSS 64x64RSS Feed: subscribe to the RSS feed for regular updates

Home iconSite Wiki: You can improve this site by helping the extension of the site's content

Home iconSite Home: Background about the site and some key features in the front page

Chat iconIRC Channel: Come and chat with us in real time

Recent Posts