Windows XP support ends today

Support for Microsoft’s Windows XP operating system ends today, April 8.

It means that there will be no more official security updates and bug fixes for the operating system.

Some governments have negotiated extended support contracts for the OS in a bid to keep users protected.

Security firms said anyone else using the 13-year-old software would be at increased risk of infection and compromise by cyber-thieves.

Statistics suggest 20-25% of all users have stuck with XP despite the fact that there have been three major releases of Windows since its debut in 2001.

Some of those existing XP users have struck deals to get security fixes from Microsoft while they complete their migration away from the ageing code.

Anyone currently running Windows XP already faced a disproportionate risk of falling victim to malware, said Dave Emm, a senior research analyst at security firm Kaspersky.

“Our data indicates that less than one fifth of our customers run Windows XP but more than a quarter of infections are Windows XP-based,” he said.

That exposure ratio was only going to get worse after April 8, he said, once the last security patch for Windows XP had been released.

That final patch will fix a series of bugs, one of which is rated as critical and is already being actively exploited despite only being discovered in late March.

“Effectively, every vulnerability discovered after April 8 will become a zero-day vulnerability – that is, one for which there is not and never will be, a patch,” said Dave Emm.

Windows XP users topped the list of victims cyber-thieves targeted, said Maik Morgenstern and Andreas Marx from the German AV-Test group, which rates and ranks security software.

“Malware writers go for the low hanging fruits because it’s a lot easier to infect systems running on an old Windows XP operating system compared to brand-new Windows 8.1, with all its built-in security features,” they said.

“We think we will see a lot of attacks for Windows XP within the next few months, but attackers will also always add exploits for other Windows systems just to catch those systems as well.”

Orla Cox, a senior manager at cyber-defense firm Symantec’s security response unit, said criminals groups were likely to hoard the XP vulnerabilities they knew about rather than use them to bolster malware being spammed out to millions of people.

“The types of groups sitting on zero-days will tend to use them against high-end targets and for corporate espionage,” she said.

“Some organizations will have particular concerns because they find it so hard to move away from XP.”

However, she added, any zero-day that did get used against a corporate target was likely to be re-used later on.

“Once it’s out there it gets into the malware kits and then gets circulated and there will be no defense,” she said.

Mark O’Neill, a spokesman for data management firm Axway, said organizations were getting better at coping with software that had hit its end-of-life.

“Beyond high-profile programs like XP there are a lot of products that have gone out of support because the company behind them has gone out of business or was acquired,” he said.

In addition many other products were written in old programming languages that made them expensive to maintain and update.

As a result, many IT departments have put such ageing programs in the virtual equivalent of a “black box” and subsequently update the external code if security patches need to be applied.

“You can create a layer above the older application and that gives you a place to patch,” Mark O’Neill said.

“Companies are not defenseless even with the things they cannot patch.”