Windows XP 21 Times More Likely to be Exploited Than Windows 8

Discussion in 'other security issues & news' started by Brandonn2010, Jun 11, 2013.

Thread Status:
Not open for further replies.
  1. Brandonn2010

    Brandonn2010 Registered Member

    Joined:
    Jan 10, 2011
    Posts:
    1,849
  2. SweX

    SweX Registered Member

    Joined:
    Apr 21, 2007
    Posts:
    6,429
    My prio is to keep those "apps" updated, and not moving to a new OS. :)
     
  3. EASTER

    EASTER Registered Member

    Joined:
    Jul 28, 2007
    Posts:
    5,634
    Location:
    U.S.A. (South)
    No. That's not entirely accurate. While yes, MS has finally addressed some of the most critical long standing security limitations compared to it's predecessors, XP properly configured and supported with just the right combination from hundreds of solid security solutions fashioned more or less exclusively for that platform including but not limited to Virtualization apps, Limited Rights, HIPS, and the list goes on to infinity IMO.

    It's only a matter of time before malware makers, to test their expertise yet again, start up their campaign to crack Patchguard and God knows what else they'll drive MS nuts with, and security developers will be back in the money again. LoL
     
  4. mechBgon

    mechBgon Registered Member

    Joined:
    Mar 2, 2013
    Posts:
    68
    Location:
    USA
    The top overarching vulnerability in apps on WinXP is simple: they're run with unrestricted Admin rights because WinXP can require considerable work to run as a low-rights user (and I would know) and doesn't have a Protected Admin option either. So a compromise can have dramatic consequences due to the lack of OS mitigations.

    Anyway, the stats seem plausible enough, given how far Windows has come since WinXP RTM, aka "Win2000 with fog lights" was released. It'll be interesting to see how things go after security support for WinXP expires.
     
  5. siljaline

    siljaline Former Poster

    Joined:
    Jun 29, 2003
    Posts:
    6,619
    Last edited: Jun 12, 2013
  6. fax

    fax Registered Member

    Joined:
    May 30, 2005
    Posts:
    3,731
    Location:
    localhost
    Thats the key point, moreover many users are still on SP2 for which support has expired long ago (i.e. no security patches for them) ;)
     
  7. Mrkvonic

    Mrkvonic Linux Systems Expert

    Joined:
    May 9, 2005
    Posts:
    8,702
    Not correct.
    Mrk
     
  8. EASTER

    EASTER Registered Member

    Joined:
    Jul 28, 2007
    Posts:
    5,634
    Location:
    U.S.A. (South)
    The statements in that article is nothing more then redundancy. Of course windows 8 is more secure, at least until it's rip apart and disected like all their other platforms eventually were.

    They have took measures to seal off easy tampering with the kernel at least for the time being. I noticed it is much more stable then any of it's other systems before in that when applications hang as they always will, your entire desktop doesnt crash aka: explorer doesn't exhibit such severe pressures that it caves in so readily as before.

    XP is still a very workable model that many including myself will continue to exhaust until it's last breath lol. It remains immensely customizable as well as easily configurable to suit the users personal desktop needs.
     
  9. guest

    guest Guest

    That is according to how you have it setup, it can be just as secure as "other" OS if it is setup right, but in "STOCK" form I will agree with you

    I will be using it far beyond it's so called end of life
     
  10. funkydude

    funkydude Registered Member

    Joined:
    Apr 5, 2004
    Posts:
    6,856
    It's entirely correct.

    Security has, and always will be, a cat and mouse game. People criticize the hell out of governments and companies that use old OS's (including 5year old Linux distros) then end up in the news about being hacked, user credentials leaked, etc. Yet it's fine for consumers to do so? The teaching needs to begin somewhere and that's with keeping your software updated, including your OS.

    5 years from now hackers will find ways past anti exploit measures that are available now, but 5 years from now we'll also have new anti exploit measures to beat them. Fortunately restricted environments like AppContainer introduced in Windows 8 makes successful exploitation unrewarding.
     
  11. Mrkvonic

    Mrkvonic Linux Systems Expert

    Joined:
    May 9, 2005
    Posts:
    8,702
    Enlighten me with hard, mathematical proof, not speculations, spins by would-be technologists or companies with vested interest in selling products directly related to XP's demise.
    Mrk
     
  12. Peter2150

    Peter2150 Global Moderator

    Joined:
    Sep 20, 2003
    Posts:
    17,058
    I am afraid all of this XP support ends is a big yawner for me. About 2 years ago I had one of those ah ha moments. MS came out with an update and said if you didn't install this immediately you were at grave risk. It occured to me that yesterday, before they released the update, I was fine, and now suddenly I was at grave risk. Phooey. I haven't done a windows update on my XP machines since then.

    I do run a security setup, that covers all my threat vectors, and that is kept update. I've had no issues or infections. About about 1 1/2 months ago I spent a weekend and scanned all 4 machines with 3 different scanners. Not one hit.

    So let support end, I don't care. All the software, I want and need runs fine. My OS upgrade will be dictated when the hardware replacement becomes an issue.

    Pete
     
  13. Rmus

    Rmus Exploit Analyst

    Joined:
    Mar 16, 2005
    Posts:
    3,943
    Location:
    California
    There are solutions that don't require a lot of work, that will restrict exploits against vulnerabilites in applications from installing their payload.

    [​IMG]



    ----
    rich
    WinXP SP3
    Runnining as Administrator
     
  14. Hungry Man

    Hungry Man Registered Member

    Joined:
    May 11, 2011
    Posts:
    9,148
    The issue here is that saying "21x more likely" is meaningless. What he should be explaining is how simple it is to attack an XP machine.

    If you think that Vista+ are more secure because they aren't analyzed as much, you're incorrect. Exploiting vulnerabilities in XP is just simpler.

    Explaining that to people properly is the issue, because understanding why that's the case actually takes work, and most people would rather just dance around that.
     
  15. culla

    culla Registered Member

    Joined:
    Aug 15, 2005
    Posts:
    504
    agree totally pete

    scare tactics once again :D
     
  16. fax

    fax Registered Member

    Joined:
    May 30, 2005
    Posts:
    3,731
    Location:
    localhost
    Yes, but you know how to setup XP and secure it, you cannot expect that 99% of users out there will do the same or understand how to do it and even if you do it for them then at the first problem with legit new software (e.g. missing permissions, limited access, etc.) they will be lost again ;) .
     
  17. SirDrexl

    SirDrexl Registered Member

    Joined:
    Apr 14, 2012
    Posts:
    545
    Location:
    USA
    I was wondering something about XP's end of life. When will they shut down the activation servers? I realize the relevant data can be backed up, but could it get to a point where people still using XP would no longer be able to activate a reinstallation (at least without calling on the phone, I suppose)?
     
  18. Peter2150

    Peter2150 Global Moderator

    Joined:
    Sep 20, 2003
    Posts:
    17,058
    True, but regretfully, I can't take care of everyone, just myself.
     
  19. funkydude

    funkydude Registered Member

    Joined:
    Apr 5, 2004
    Posts:
    6,856

    Enlighten me with hard, mathematical proof, not random statements from would be technological "bloggers" with vested interests in pushing their point of views on others.

    Well said.
     
  20. safeguy

    safeguy Registered Member

    Joined:
    Jun 14, 2010
    Posts:
    1,718
    Who cares about the exact no. of times more likely? You know it's based on statistics so it's a rough figure/estimation. Look at it as just that and not to the point of decimal perfection. At worst, accept it as a form of exaggeration to get the message across.

    If you manage to keep your setup from malware without updates....good for you. It's no surprise especially if one knows how to avoid being socially engineered and is running a setup that's different from the majority of XP or even Win8 users out there. The element of security by diversity plays a huge role there.

    Arbitrary code execution. The majority of exploits likes to drop a payload on disk and create a new process to gain better persistence and be able to cause a higher level of damage. White-listing (AE, HIPS, etc) stops the payload execution (on disk) but what about in-memory execution? Memory is the greatest challenge for white-listing as mentioned here:

    Application Whitelisting: Panacea or Propaganda

    Key point here is that that XP is missing anti-exploit features found in Vista on-wards which is improved upon in Win7 and now Win8. Examples:

    Exploit Mitigation Improvements In Windows 8
    https://www.wilderssecurity.com/showthread.php?t=335602

    Windows 8 Security Improvements
    http://technet.microsoft.com/en-US/windows/jj983723.aspx

    Sure, you can run LUA in XP but you're still missing out on the benefits of Integrity Levels. Even EMET which is highly recommended (and more so for XP since it back-ports some modern security features) can't bring ASLR and SEHOP onto XP.

    Vested interest in selling products - that's like saying the obvious. The seller always has his own bias. However that doesn't mean the facts mentioned are necessarily untruthful - people like to make marketing look evil.

    Basically, "More likely" doesn't mean "would be". It just signals that provided all others factors are constant, XP is easier to exploit than Win8. The argument here is Windows 8 simply makes it much harder in terms of scale of exploitability...not about whether someone's PC gets infected or not.
     
  21. Gullible Jones

    Gullible Jones Registered Member

    Joined:
    May 16, 2013
    Posts:
    1,461
    This works fine until someone invokes a privilege escalation vulnerability before launching the payload; e.g. using a vulnerable system call, or invoking an exploit in a privileged service. Whitelisting obviously makes things a little trickier since you can't just launch the payload, but that doesn't really cut it as the sole layer of defense.

    EXE blockers work (for now) but using them IMO boils down to a reliance on bad engineering - namely, bad engineering on part of malware authors, who are too lazy to do the extra work to bypass your defenses (because there are millions of people with even more vulnerable setups). Even granted that "make things expensive for the attacker" is a big part of security, this doesn't strike me as sensible.

    Hate to break it to you but this is classic magical thinking. The OS was vulnerable for as long as the flaw existed. If users were lucky, the hole was unknown; if they weren't, it was known to some blackhats but not to Microsoft.

    Even in the former case, for MS it would be a matter of preempting the blackhats - the hole could have been discovered independently. Probably would have, given how much of a market there is for vulnerabilities. Staying a few steps ahead of the criminal element is an unfortunate fact of life in this field.
     
  22. Rmus

    Rmus Exploit Analyst

    Joined:
    Mar 16, 2005
    Posts:
    3,943
    Location:
    California
    I did not say, nor imply, that it is or should be the sole layer of defense.


    ----
    rich
     
  23. Mrkvonic

    Mrkvonic Linux Systems Expert

    Joined:
    May 9, 2005
    Posts:
    8,702
    The burden of proof is on you - or microsoft - because you want users to spend money. Therefore, show that their investment will be well spent.

    As to my proof, it's simple:

    Running default windows xp boxes, no infection.
    Running default windows 7 boxes, no infection.
    Hence, no infection.

    Mrk
     
  24. Nebulus

    Nebulus Registered Member

    Joined:
    Jan 20, 2007
    Posts:
    1,582
    Location:
    European Union
    Your proof is mathematically incorrect! 21 times zero is still zero, that means that even in your case Windows XP was 21 times more likely to be exploited than Windows 8! :D (of course in your case you could also say that Windows 8 was 100 times more likely to be infected that XP, but that's another issue alltogether) :)
     
  25. Mrkvonic

    Mrkvonic Linux Systems Expert

    Joined:
    May 9, 2005
    Posts:
    8,702
    No, because that 21 x 0 is not 21 more than 0, it's zero :)
    Mrk
     
Loading...
Thread Status:
Not open for further replies.