Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

As we all know, Microsoft stops developing security patches for Windows XP very soon. If a bug in the kernel was to be found that would allow an attacker to take control by, say, sending a specially crafted UDP packet, this would not be patched.

But what if the system is a desktop behind a common NAT router and the only internet application is a browser? Exploiting any bugs will have to happen exclusively through the browser. By running the latest version of Firefox or Chrome, wouldn't the system be reasonably secure?

Of course no suspicious attachments should be opened, but that is the case with any system. Perhaps in XP you can ruin the entire system with a virus whereas on a 7 machine you can only mess with the user's account, but userspace contains enough juicy stuff that I wouldn't say this makes much of a difference on a single user system.

For now I see no immediate risk in running XP for another few months on a desktop when Google Chrome is the only internet connected application. It saves someone buying a new computer. I have already advised the owner not to do online banking on it (better do that on the newly bought work laptop), but besides that...

Did I miss anything obvious in my reasoning, or is XP secure enough for casual use in this case?

share|improve this question
    
Just to be clear: Windows will still develop the patches for 'Critical' and 'Important' vulnerabilities. However, you have to be on an extended contract to get the updates –  Rubber Duck Apr 3 at 18:20

2 Answers 2

It's a risk. XP has had enough holes over the years that it's hard to imagine there aren't some un-found holes in what remains.

I'd recommend getting off XP if possible. If not, at least keep your ear to the ground. If a researcher finds more vulnerabilities that Microsoft is now unwilling to fix, you can bet they're going to hit the tech news media.

Tell your client it's time to consider changing, and to save a few dollars for a new system. You can also consider alternative operating systems that won't require a new computer: an installation of linux should be able to run on anything that currently runs XP. This might be a fine choice for someone who isn't dependent on Windows native apps.

share|improve this answer
    
"XP has had enough holes over the years that it's hard to imagine there aren't some un-found holes in what remains." I understand that, but you'll need to somehow reach the system to exploit it. So if the browser is the only way, and it's a modern and up-to-date browser... That's what I'm asking about. "an installation of linux" I've thought of that, but Windows 8 on her work laptop is a huge change already. I'll use this as a last resort. Thanks for the suggestion though! –  Luc Apr 3 at 8:27
1  
@Luc For example, there might be a flaw in XP's TCP stack that a crafted packet from the server could exploit. Slim chance, but the possibility is there. –  Bob May 4 at 8:53

Although running Google chrome on top of Windows XP seems secure but the reason it isn't is that exploiting vulnerabilities on Windows XP is easy (many orders of magnitude) compared to Windows 7. Windows XP is lacking common memory corruption protections such as DEP and ASLR. This means that a vulnerability that might be just a denial of service for the browser on Windows 7 will be very reliable for code execution on Windows XP due to the static address available.

Also, Microsoft Security Essentials will stop receiving updates which means you are going to use a separate AV solution for your protection as well.

I would recommend that you shift to a more recent version of Windows such as Windows 7/8. However, if that is not possible immediately, you should patch XP to the latest, use Google chrome or firefox, have a third party AV that is going to give you protection beyond the end of life date, and seriously think about installing Microsoft EMET.

share|improve this answer
    
Third party anti-virus already installed for the same reason as a third-party browser. EMET may be a good idea though, thanks! –  Luc Apr 3 at 8:23

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.