On Tuesday, Microsoft took the highly unusual step of issuing security patches for XP and other unsupported versions of Windows. The company did this in a bid to protect the OSes against a series of “destructive” exploits developed by, and later stolen from, the National Security Agency. (emphasis is mine)
But why? I thought Windows XP is already unsupported? Wouldn’t that hurt Microsoft more?
According to this updated Microsoft post, Tuesday’s updates include fixes for three other exploits that were also released by the Shadow Brokers. A Microsoft blog post announcing the move said the patches were prompted by an “elevated risk of destructive cyberattacks” by government organizations.
“In reviewing the updates for this month, some vulnerabilities were identified that pose elevated risk of cyberattacks by government organizations, sometimes referred to as nation-state actors, or other copycat organizations,” Adrienne Hall, general manager of crisis management at Microsoft, wrote. “To address this risk, today we are providing additional security updates along with our regular Update Tuesday service. These security updates are being made available to all customers, including those using older versions of Windows.
Preventing another WCry outbreak
In a separate blog post, Eric Doerr, general manager of the Microsoft Security Response Center, said the move was designed to fix “vulnerabilities that are at [heightened] risk of exploitation due to past nation-state activity and disclosures.” He went on to urge users to adopt new Microsoft products, which are significantly more resistant to exploits, and not to expect regular security fixes in the future.
“Our decision today to release these security updates for platforms not in extended support should not be viewed as a departure from our standard servicing policies,” he wrote. “Based on an assessment of the current threat landscape by our security engineers, we made the decision to make updates available more broadly.”
The only other time in recent memory Microsoft has patched an unsupported version of Windows was in 2014, when it issued a critical update for Windows XP during the same week it decommissioned the version. Tuesday’s move suggests Microsoft may have good reason to believe attackers are planning to use EsteemAudit, ExplodingCan, and EnglishmanDentist in attacks against older systems. Company officials are showing that, as much as they don’t want to set a precedent for patching unsupported Windows versions, they vastly prefer that option to a potential replay of the WCry outbreak.
You think that Microsoft is doing this for the benefit of their customers, I beg to differ. I see this as indecisiveness. Apple is true to their word when they declare a device to be unsupported. Here’s a commentary from Peter Bright from Ars Technica as well:
Microsoft’s decision to keep patching Windows XP is a mistake
Microsoft officially ended support of the twelve-and-a-half-year-old Windows XP operating system a few weeks ago. Except it apparently didn’t, because the company has included Windows XP in its off-cycle patch to fix an Internet Explorer zero-day that’s receiving some amount of in-the-wild exploitation. The unsupported operating system is, in fact, being supported.
The decision to release this patch is a mistake, and the rationale for doing so is inadequate.
A one-off patch of this kind makes no meaningful difference to the security of a platform. Internet Explorer received security patches in 11 of the last 12 Patch Tuesdays. Other browsers such as Chrome and Firefox receive security updates on a comparable frequency.
Web browsers are complex. They’re necessarily exposed to all manner of potentially hostile input that the user can’t really control, and as such, they’re a frequent target for attacks. They need regular updates and ongoing maintenance. The security of a browser is not contingent on any one bugfix; it’s dependent on a continuous delivery of patches, fixes, and improvements. One-off “exceptions” do not make Internet Explorer on Windows XP “safe.” There’s no sense in which this patch means that all of a sudden it’s now “OK” to use Internet Explorer on Windows XP.
And yet it seems inevitable that this is precisely how it will be received. The job of migrating away from Windows XP just got a whole lot harder. I’m sure there are IT people around the world who are now having to argue with their purse-string-controlling bosses about this very issue. IT people who have had to impress on their superiors that they need the budget to upgrade from Windows XP because Microsoft won’t ship patches for it any longer. Microsoft has made these IT people into liars. “You said we had to spend all this money because XP wasn’t going to get patched any more. But it is!”
Bosses who were convinced that they could stick with Windows XP because Microsoft would blink are now vindicated…
But the option Microsoft took is the worst of all worlds. It undermines efforts by IT staff to ditch the ancient operating system, and undermines Microsoft’s assertion that Windows XP isn’t supported, while doing nothing to meaningfully improve the security of Windows XP users. The upside? It buys those users at best a few extra days of improved security. It’s hard to say how that was possibly worth it. (emphasis is mine)
Not to mention, they’re not doing their latest OS Windows 10 any favors. Windows XP is a 32-bit operating system released in 2001 and it makes no sense at the moment to keep patching it. Just look at Apple, when they decide to stop supporting an OS or an old device, they do. Do you see Apple still releasing patches for an old iPhone 3GS or a 2008 polycarbonate MacBook running Mac OS X Snow Leopard at the latest? No.