NEW YORK - Microsoft will end support for Windows XP today, and with an estimated 30 percent of businesses and consumers still using the 12-year-old operating system, the move could put everything from the operations of heavy industry to the identities of everyday people in danger.
A computer running on the XP operating system “now has a big neon bull’s eye on it,”said Patrick Thomas, a security consultant at the San Jose, Calif.-based firm Neohapsis.
Microsoft has released a handful of Windows operating systems since 2001, but XP’s popularity and the durability of the computers it was installed on kept it around longer than expected. Analysts say that if a personal computer is more than 5 years old, chances are it’s running XP.
Microsoft said it will no longer provide security updates, issue fixes to nonsecurity-related problems or offer online technical content updates. The Redmond, Wash.-based company said it will provide anti-malware-related updates through July 14, 2015, but warns that the tweaks could be of limited help on an outdated operating system.
Most industry observers say they recognize that the time for Microsoft to end support for such a dated system has come, but the move poses both security and operational risks for the remaining users. In addition to home computers, XP is used to run a variety of businesses including water treatment facilities, power plants and doctor’s offices.
Thomas said XP appealed to a wide variety of people, and businesses that saw it as a reliable workhorse; many chose to stick with it instead of upgrading to Windows Vista, Windows 7 or Windows 8.
Thomas said companies that don’t like risk generally don’t like change. As a result, companies most likely to still be using XP include banks and financial services companies, along with health-care providers. He also pointed to schools from the university level down, saying that they often don’t have enough money to fund equipment upgrades.
Marcin Kleczynski, chief executive officer of Malwarebytes, said that without patches to fix bugs in the software, XP computers will be prone to freezing up and crashing, while the absence of updated security-related protections makes the computers susceptible to hackers.
He said future security patches released for Microsoft’s newer systems will serve as a way for nefarious people to reverse engineer ways to breach now-unprotected Windows XP computers.
“It’s going to be interesting to say the least,” he said. “There are plenty of black hats out there that are looking for the first vulnerability and will be looking at Windows 7 and 8 to find those vulnerabilities. And if you’re able to find a vulnerability in XP, it’s pretty much a silver key.”
Those weaknesses can affect businesses both large and small.
Mark Bernardo, general manager of automation software at General Electric Co.’s Intelligent Platforms division, said moving to a new operating system can be extremely complicated and expensive for industrial companies. Bernardo, whose GE division offers advisory services for upgrading from XP, said many of the unit’s customers fall into the fields of water and waste- water, along with oil and gas.
“Even if their sole network is completely sealed off from attack, there are still operational issues to deal with,” he said.
Meanwhile, many small businesses are put off by the hefty cost of upgrading or just aren’t focused on their information technology needs.
Barry Maher, a salesman trainer and motivational speaker based in Corona, Calif., said his computer consultant warned him about the end of XP support last year. But he was so busy with other things that he didn’t start actively looking for a new computer until a few weeks ago.
“This probably hasn’t been as high a priority as it should have been,” he said.
He got his current computer just before Microsoft released Vista in 2007. He never bought another computer because, “As long as the machine is doing what I want it to do, and running the software I need to run, I would never change it.”
Mark McCreary, a Philadelphia-based attorney with the firm Fox Rothschild LLP, said small businesses could be among the most affected by the end of support, because they don’t have the same kinds of firewalls and in-house computer technology departments that larger companies possess. And if they don’t upgrade and something bad happens, they could face lawsuits from customers.
But he said he doesn’t expect the widespread malware attacks and disasters that others are predicting - at least for a while.
“It’s not that you blow it off and wait another seven years, but it’s not like everything is going to explode on April 8, either,” he said.
McCreary pointed to Microsoft’s plans to keep providing malware-related updates for more than a year and said that he doubts hackers are actually saving up their malware attacks for the day support ends.
But Sam Glines, CEO of Norse, a threat-detection firm with major offices in St. Louis and Silicon Valley, disagreed. He said hackers have been watching potential targets for some time now.
“There’s a gearing up on the part of the dark side to take advantage of this end of support,” Glines said.
He said he worries most about doctors like his father and others in the health-care industry, who may be very smart people but just aren’t focused on technology. Healthcare-related information is 10 to 20 times more valuable on the black market than financial information, he said, because it can be used to create fraudulent medical claims and illegally obtain prescription drugs, making doctor’s offices tempting targets.
Microsoft shares fell 7 cents to close Monday at $39.80.
Information for this article was contributed by Joyce M. Rosenberg of The Associated Press.
Business, Pages 23 on 04/08/2014