Software // Operating Systems
News
4/28/2014
01:30 PM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

Microsoft: No IE Patch For Windows XP

Hackers are already exploiting a new Internet Explorer flaw. Microsoft promises a fix -- but not for Windows XP.

Windows XP Game Over: 9 Upgrade Options
Windows XP Game Over: 9 Upgrade Options
(Click image for larger view and slideshow.)

Microsoft confirmed over the weekend that Internet Explorer (IE) versions 6 through 11 are susceptible to a newly discovered vulnerability, and that cyberattackers have already exploited the flaw. The company said it is investigating the bug, and it pledged to release a fix.

Microsoft will release the patch through either its monthly security update or a special out-of-cycle release. Whichever route Microsoft chooses, however, Windows XP users won't benefit. As of this month, the company no longer supports the OS. In March, XP still accounted for more than a quarter of Internet users, according to the web-tracking firm Net Applications.

In a blog post, Microsoft acknowledged that cybercriminals have already exploited the bug, but it said it is aware of only limited targeted attacks. The flaw allows remote code execution if a user visits a malicious website, which means an attacker could theoretically gain the same system privileges as the legitimate user.

[Wondering about your best option to replace WinXP? Read Windows XP Game Over: 9 Upgrade Options.]

"[Simply] looking at booby-trapped content such as a Web page or image file can trick IE into launching executable code sent from outside your network," Paul Ducklin, a researcher with the security vendor Sophos, wrote in a blog post.

In a second post related to the IE flaw, Microsoft detailed two methods to mitigate risk: enabling IE's Enhanced Protected Mode and using the company's Enhanced Mitigation Experience Toolkit (EMET) 4.1 and 5.0 Technical Preview products. Users can also, of course, use a different browser. Microsoft said accounts that are configured to allow fewer user rights could be less vulnerable than those that operate with full administrative rights.

The cybersecurity firm FireEye, which claimed credit for discovering the flaw, endorsed Microsoft's recommended precautions. In a blog post, the company said its testing found EMET versions 4.1 and 5.1 and Enhanced Protected Mode all successfully break or detect the exploit.

Homeland Security says to avoid IE until Microsoft issues a fix -- but even then, Windows XP users will be left in the cold.
(Source: cooling999, deviantart.com)
Homeland Security says to avoid IE until Microsoft issues a fix -- but even then, Windows XP users will be left in the cold.
(Source: cooling999, deviantart.com)

FireEye also noted that the vulnerability relies on Adobe Flash. "Disabling the Flash plugin within IE will prevent the exploit from functioning."

The United States Computer Emergency Readiness Team, a division of the Department of Homeland Security, recommends that users and administrators enable Microsoft EMET where possible and consider employing an alternative web browser until an official update is available.

FireEye said it is monitoring a group currently exploiting the flaw. The firm noted that the group has capitalized on zero-days in the past. The attackers are "extremely proficient at lateral movement and are difficult to track, as they do typically do not reuse command and control infrastructure."

The company nicknamed the group's campaign "Operation Clandestine Fire." However, citing the ongoing nature of its investigation, it declined to provide additional details, such as which companies or institutions have been targeted.

Though not as potentially widespread as the Heartbleed vulnerability disclosed this month, the new IE exploit could represent a significant threat. According to Net Applications, the browser family accounts for around a quarter of all Internet users

All versions of IE are affected, including those running on Windows 7, 8, and 8.1. But Windows XP users face the most serious threats. Brian Krebs, the security researcher who first reported last year's Target data breach, said in a blog post, "This is the first of many zero-day attacks and vulnerabilities that will never be fixed for Windows XP users." He noted that many of the exploit mitigation techniques that EMET brings do not work in XP.

Microsoft no longer supports XP, but many third-party security vendors do, which could give some IE-using XP holdouts another option. Ducklin suggested other workarounds, including disabling an IE extension called VGX.DLL, which is believed to be linked to the exploit.

Emerging standards for hybrid clouds and converged datacenters promise to break vendors' proprietary hold. Also in the Lose The Lock-In issue of InformationWeek: The future datacenter will come in a neat package (free registration required).

Michael Endler joined InformationWeek as an associate editor in 2012. He previously worked in talent representation in the entertainment industry, as a freelance copywriter and photojournalist, and as a teacher. Michael earned a BA in English from Stanford University in 2005 ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
<<   <   Page 2 / 3   >   >>
jgherbert
50%
50%
jgherbert,
User Rank: Ninja
4/30/2014 | 12:54:28 AM
Re: Re : Microsoft: No IE Patch For Windows XP

"Even though I do not use Windows XP, I still think that it is rather selfish to suddenly stop providing services to people who still use it."

 

XP is almost 13 years old; I think it's entirely fair for Microsoft to call EOL on it, given that there have been 3 major upgrades since then. How long should a company continue to support an old product in order to not be selfish, in your opinion?

We should share that number with, well, every other company who EOLs products, and see if they agree?

TeaPartyCitizen
50%
50%
TeaPartyCitizen,
User Rank: Apprentice
4/29/2014 | 11:17:44 PM
Re: Why does anyone use IE?
@TerryB said "But do all of you really believe that if Chrome, Firefox, etc was the dominant browser for consumers that malware guys would not be finding exploits in those browsers? ⋯ let's recognize this for what it is: malware guys have a long history and expertise at attacking MS because of it's dominant market share."

 

⋱⋰⋱⋰⋱⋰⋱⋰⋱⋰⋱⋰⋱⋰⋱⋰⋱⋰⋱⋰⋱⋰⋱⋰⋱⋰⋱⋰⋱⋰⋱⋰⋱⋰⋱⋰⋱⋰⋱⋰⋱⋰⋱⋰


 

But not using the dominate browser is still the solution !!!  If one had to choose a field to cross and all choices had land mines in them, would you not choose to cross the field which had the least number of land mines in it rather than crossing the one which was most familiar to you but had the most number of land mines in it ???

It scares me how people can have thoughts but these thoughts are totally illogical.
asksqn
100%
0%
asksqn,
User Rank: Ninja
4/29/2014 | 4:06:23 PM
Another MS steaming pile of fail
Funny, but the CERT message I read that was issued today stated, "We are currently unaware of a practical solution to this problem," the Department of Homeland Security's United States Computer Emergency Readiness Team said in a post Monday morning.  That means there will be no resolution to this issue.  Users should immediately cease using IE and head directly to one of the others ASAP.  I highly recommend Chrome.  
BillW334
50%
50%
BillW334,
User Rank: Apprentice
4/29/2014 | 3:40:50 PM
Re: Why does anyone use IE?
Linux, in one of it's many varieties.
SachinEE
50%
50%
SachinEE,
User Rank: Ninja
4/29/2014 | 3:19:44 PM
Re : Microsoft: No IE Patch For Windows XP
Even though I do not use Windows XP, I still think that it is rather selfish to suddenly stop providing services to people who still use it. I wonder what that means for users of Windows 7 (myself included) when Microsoft decides that it is time to render this operating system obsolete. And this trend is not only limited to internet explorer, even the regular updates to the operating system that were once so frequent have almost stopped. I think it would be more prudent to let users know the time duration over which an operating system will be 'valid' (meaning profitable to Microsoft) whenever they are selling their operating systems.
TerryB
IW Pick
100%
0%
TerryB,
User Rank: Ninja
4/29/2014 | 12:50:03 PM
Re: Why does anyone use IE?
Many of you are regular commentators I recognize and usually agree with. But do all of you really believe that if Chrome, Firefox, etc was the dominant browser for consumers that malware guys would not be finding exploits in those browsers? It reminds me of the people who swear the Mac o/s can't get malware because no one seems to report any incidents.

I'm no defender of Microsoft or IE but let's recognize this for what it is: malware guys have a long history and expertise at attacking MS because of it's dominant market share. It will take awhile before those attacks shift across other o/s and browsers. Or do all you really believe the code in other browsers is perfect?

But I agree this is worst case scenario for XP users. You knew it was matter of time but never thought it would hit this quick. That smart thing for XP users to do is quit using Flash. Unless it's that same Flash game you've been playing forever and you have link right to it. But browsing around to new sites with Flash enabled? Just a matter of time...
Shane M. O'Neill
50%
50%
Shane M. O'Neill,
User Rank: Author
4/29/2014 | 9:49:25 AM
Re: Why does anyone use IE?
It doesn't take much to get someone to switch browsers: slowness, a security scare, even just one annoying feature. IE has made some big advances in recent versions, but this new vulnerability on the heels of XP's end-of-life will turn a lot of people to Chrome, Firefox or Safari (if they're on a Mac). And once they leave IE, they don't tend to come back.
Quantum PC Support
100%
0%
Quantum PC Support,
User Rank: Apprentice
4/29/2014 | 3:22:16 AM
Microsoft will release a patch for IE fault
This blog post explored bad news. I did not have the news about the problem which is occurring in IE. Recently i updated IE to IE11. It is really frustrating. The second bad news is no support or fix for windows xp. I am waiting for a quick remedy from MICROSOFT. 
PaulS681
IW Pick
100%
0%
PaulS681,
User Rank: Ninja
4/28/2014 | 7:13:11 PM
Re: Why does anyone use IE?

I wrote an article in my company's newsletter pointing out that XP is not safe to run. I did point out some ways to run it, such as disconnected from the internet, but stressed that if you have an XP machine you should really start thinking about replacing it. I had a few people say I scared them. That wasn't my intent but I couldn't just tell them not to worry, it will be all fine. XP is unlike any other MS OS in that is still widely used in business. That is exactly why it will be a target hor hackers.

PaulS681
50%
50%
PaulS681,
User Rank: Ninja
4/28/2014 | 7:07:14 PM
Surprise Surprise

I bet everyone is surprised about this one. Well, it didn't take long for XP to be exploited, or more precisely, IE on XP. IE on all the supported OS's will be patched but I agree with just about everyone who has responded. Use another browser.

<<   <   Page 2 / 3   >   >>
Register for InformationWeek Newsletters
White Papers
Current Issue
InformationWeek Tech Digest - August 27, 2014
Who wins in cloud price wars? Short answer: not IT. Enterprises don't want bare-bones IaaS. Providers must focus on support, not undercutting rivals.
Flash Poll
Video
Slideshows
Twitter Feed
InformationWeek Radio
Archived InformationWeek Radio
Howard Marks talks about steps to take in choosing the right cloud storage solutions for your IT problems
Sponsored Live Streaming Video
Everything You've Been Told About Mobility Is Wrong
Attend this video symposium with Sean Wisdom, Global Director of Mobility Solutions, and learn about how you can harness powerful new products to mobilize your business potential.