The Dangers of Using Windows XP

This article in the August edition of the Oldie Magazine (Yes - I subscribe to the Oldie magazine) makes interesting reading.

Lock your doors against ransomware

By The Webster

I hope you weren’t affected by the “ransomware” attack on the NHS computers in May (a possibility I mentioned in 2014, if you will permit a brief gloat), but now the dust has settled, who was to blame?  I think that the American National Security Agency (NSA) has a lot to answer for; I’ll explain.

Ransomware is usually invited into a computer by clicking a link in an apparently innocuous email.  That infects one computer; however, this attack differed from most by taking advantage of a flaw in an obsolete operating system, Windows XP, to infect all the other machines on the same network; throughout a hospital, perhaps. Such flaws are akin to an unlocked door through which criminals can sneak.  All software has such flaws, but as they are noticed, they are mended, or “patched”, in the jargon.  That’s what’s happening when your computer updates itself.

Windows XP was installed on millions of computers before 2010 and had just such an unlocked door. However, as Microsoft stopped updating XP in 2014, it was never patched.  Unfortunately, despite Microsoft giving over seven years notice that XP would become obsolete in 2014, many computers in the NHS still use it.

This is where it gets murky.  When most computer experts spot a security flaw, they tell Microsoft privately, who thank them, often pay them and fix the problem.  In this case, it was the NSA that found the unlocked door, but they kept it to themselves.  They even developed a software tool (called Eternal Blue) to exploit the unlocked door, presumably for security related purposes.  

Then disaster struck; the NSA computers were broken into by a gang of hackers called The Shadow Brokers; they stole much, including Eternal Blue.  The cat was now out of the bag.  Microsoft heard about it and in March they patched the problem for their current software but not for the deceased Windows XP. 

In April, The Shadow Brokers made Eternal Blue public, and inevitably the crooks behind the NHS ransomware attack spotted its possibilities. They built Eternal Blue into their ransomware, which meant that once inside any network, it could worm into any connected computer that uses Windows XP.  No one had to do anything; no more clicking on infected emails required. 

Microsoft, to its credit, immediately issued a patch for Windows XP, even though XP is pushing up the daisies.

So, back to who is to blame for this massive inconvenience.  I suppose that Microsoft share a little blame for not spotting the weakness themselves ages ago, but when they did know about it they patched it quickly, and anyone with a modern operating system was unaffected.

In my view, the NSA is much more liable. Keeping mum about what they found for security purposes is one thing, but allowing it to be stolen is inexcusable. 
They share the blame equally with any organisation (like the NHS) that has been knowingly using out of date, vulnerable software and hence taking a huge risk with their data; they have no right to complain at all.

I like an analogy used by Dr Michael Pound, a computer expert from Nottingham University.  He said that grumbling about the attack is like having an accident in a car from the 1940s and complaining that the airbag didn’t inflate.  There is no airbag to protect you in a 1940s car, and unless you go to a garage and have one fitted, or replace the car with more modern one, there never will be.

So, if you still use XP:  take heed.  If you escaped this time, don’t be surprised if you get hurt next time. It has no airbag.

.....or switch to LINUX ! ! !

A lot of the Bank's are still using Windows 98 on their ATM's. These Bank's have been told to move over by May next year. Move over to what I don't know.

Linux is fine if you are computer literate and can fight your way through the problems of getting your peripherals to be recognised.  I tried it and was unable to get my OKI Printer to work - despite googling and Linux forum hunting. In addition - I have a Garmin sat-nav I use on holidays abroad and download waypoints to it from the PC using the Garmin mapping software which will not work on anything but Windows or Apple.

If you are just the average person who wants to buy a computer, plug in a printer and perhaps sync with their smartphone - Windows is the way to go.  In 99% of cases it works for those with limited computer skills and requires no "tweaking".

True that XP was vulnerable to Wannacry but it wasn't the most affected OS. This turned out to be Windows 7 according to Kaspersky and corroborated by a security company call 'BitSight'. I'm not sure why Window 7 was the most affected since, if Windows updates are performed, this system would have been protected. Perhaps it's because companies and organisations are mostly using Windows 7 and they have not been applying updates for one reason or another.

I'd expect it must be more involved to update a network of computers, maybe necessitating interruption of the system. All in all, perhaps not so easy for hospitals to update all computers as it is for individual home users.

Home users were maybe not in too much danger from Wannacry ransomware. It certainly seems prudent to get protection in case it can be picked up by drive-by methods but other than that, the infection would most likely rely on opening an e-mail attachment ..and many of us are quite wary of that these days (or should be).

The target for Wannacry was organisations and I'm fairly sure that some unwary person within the organisation could have opened an e-mail attachment. Wannacry then relied on computers being networked together to spread. As home users, we don't usually have that arrangement but large organisations such as the NHS do. All of their computers and servers are on large networks, so the worm was able to quickly spread throughout the system causing the chaos and problems it did.

I'm not sure what proportion of XP and Windows 7 operating systems are used within the NHS but if those findings are right, it would seem most are on Windows 7 ..since that was the most affected OS.

As regard Linux. It is indeed good. A person doesn't have to be as techie as was once necessary. However, some software won't run on it. The best advice I've seen for getting Garmin software to run on Linux is to install 'Wine' or 'PlayOnLinux' but it seem this has variable results. I've used these two ways of running Windows programs on Linux and it wasn't too successful. So no, Linux isn't an option sometimes. A protected Windows system is.

This is not the fault of Linux in a way but that of the software developers. They see writing a version of their software for Linux as being not worth the effort because of the comparatively low userbase it has. This might hopefully change one day if they see that Linux has become popular enough to write for.

Other than this situation though, Linux can be a good alternative to Windows for a lot of what people want to do on their computers.

My GP doctor's practice uses XP and nowadays they are linked to the local hospital network. My Gp can call up my hospital records and vice versa.

I wonder how many GP practices are still on XP?

I never get to see the Doc's computer screens but sometimes manage a glimpse of the ones at the hospital. I expected to see XP (quite distinctive in appearance) but was quite surprised to see it was Windows 7.

I don't think our hospital was affected too much by Wannacry, so maybe the computers had the patch installed.

I have run Linux for quite a while.
Maybe a dozen years ago I looked at a number of the various "types" being pushed and found nothing that I could understand let alone use.
I revisited a few years later and found Ubuntu which had made progress in leaps and bounds and was understandable even to my tired old brain. So I switched my allegiance (and my computer)
2 or 3 years ago Ubuntu started to "modernise" and started to ape Windows in presentation etc, So I decided to do another jump.
I ferreted about and found Mint.
I do hope that those holding the tiller do not beach it.

Mart - I asked one of the practice nurses, when the recent problem occurred, what OS was being used and she didn't know. She booted her computer - and it was XP.

AlanHo wrote:

Mart - I asked one of the practice nurses, when the recent problem occurred, what OS was being used and she didn't know. She booted her computer - and it was XP.

It just shows how forward looking and technically advanced our National Health Service is, even on the wards.

Are you using Mint version 18.2 Catgate?

I suppose these Windows vulnerabilities is one reason why updates for Windows 10 don't rely on people instigating or accepting them. The majority of computer users on previous Windows operating systems mostly just use their computers and maybe haven't bothered with (or always rejected) patches for the OS? With Windows 10, updates will happen automatically. No bad thing I reckon. It means that those not bothering about security and other patches will get them anyway.

It just has to be hoped that the updates installing on the computer systems of large organisations (if they ever go to W.10) would not upset their systems. It would be awful if a Windows patch deploying was the cause of a damaged system.

On the home front, automatic updates irks some people but I read ways can be found to stop the updates installing if needs be. I always let updates go ahead and even check for them occasionally. No problems so far.

The trouble I find on the Laptop with automatic updates is: You don't know what is being updated and what subtle changes has been made to the OS, if any. I know you can go into the updates section and look at the KB but it's a bit of a pain in the proverbial to do it that way. Fair enough if it is only security vunerabilities that has been patched.

It is possible to know what the updates contain but I think they are a bunch of updates that cover how all people use their computers. In other words, an update might be designed to patch a problem that we'd never come across within our own normal usage of the computer. There might be no benefit from such a patch but then again, it doesn't do any harm either. Just a general overall update.

I suppose we need security patches but even then we might never come across the malware that can exploit the hole that has been discovered and patched. Just best to have the update because the hole is known about and 3rd party software may not protect from it. Good security probably comes from a few different approaches. Perhaps involving an updated system, some 3rd party software and other measures.

The page linked to below shows what the updates contain as they are released:

https://support.microsoft.com/en-gb/help/4034674

..and this one describes how some updates can be chosen to be installed or hidden. Windows doesn't install hidden updates (see the post by 'Brink'):

https://www.tenforums.com/windows-updates-activation/11851-how-choose-individual-updates-install.html

The average user who doesn't worry or give much attention to care of the computer probably benefits from having their computer updated without any input from them. Not everyone is good with computer maintenance and/or security and I think this is what Windows 10 tries to address with its automatic updates. There are bound to be people this doesn't suit but I don't suppose an OS can ever be all things to all people.

Thanks for those two links Mart.

I knew about the support.microsoft.com link but found the ten forums one interesting. 

I don't have the windows Laptop switched on very often but when I do all it seems to do is update and takes an hour or so. That's probably because I don't switch it on very often and there is a back log of updates. I will be halfway through doing something on it and will get a message to say the machine needs to close down and restart, then the updates kick in and start installing themselves. Bloody pain in the proverbial. 

No wonder you keep buying apples......my wife has an iPod, phone and tablet all stuffed with iTunes which all seem to run Ok. It's a good job because I know bugger all about them