5

As we all know, Microsoft stops developing security patches for Windows XP very soon. If a bug in the kernel was to be found that would allow an attacker to take control by, say, sending a specially crafted UDP packet, this would not be patched.

But what if the system is a desktop behind a common NAT router and the only internet application is a browser? Exploiting any bugs will have to happen exclusively through the browser. By running the latest version of Firefox or Chrome, wouldn't the system be reasonably secure?

Of course no suspicious attachments should be opened, but that is the case with any system. Perhaps in XP you can ruin the entire system with a virus whereas on a 7 machine you can only mess with the user's account, but userspace contains enough juicy stuff that I wouldn't say this makes much of a difference on a single user system.

For now I see no immediate risk in running XP for another few months on a desktop when Google Chrome is the only internet connected application. It saves someone buying a new computer. I have already advised the owner not to do online banking on it (better do that on the newly bought work laptop), but besides that...

Did I miss anything obvious in my reasoning, or is XP secure enough for casual use in this case?

Improve this question
1

3 Answers 3

Reset to default
2

Although running Google chrome on top of Windows XP seems secure but the reason it isn't is that exploiting vulnerabilities on Windows XP is easy (many orders of magnitude) compared to Windows 7. Windows XP is lacking common memory corruption protections such as DEP and ASLR. This means that a vulnerability that might be just a denial of service for the browser on Windows 7 will be very reliable for code execution on Windows XP due to the static address available.

Also, Microsoft Security Essentials will stop receiving updates which means you are going to use a separate AV solution for your protection as well.

I would recommend that you shift to a more recent version of Windows such as Windows 7/8. However, if that is not possible immediately, you should patch XP to the latest, use Google chrome or firefox, have a third party AV that is going to give you protection beyond the end of life date, and seriously think about installing Microsoft EMET.

Improve this answer
1
  • Third party anti-virus already installed for the same reason as a third-party browser. EMET may be a good idea though, thanks!
    – Luc
    Commented Apr 3, 2014 at 8:23
4

It's a risk. XP has had enough holes over the years that it's hard to imagine there aren't some un-found holes in what remains.

I'd recommend getting off XP if possible. If not, at least keep your ear to the ground. If a researcher finds more vulnerabilities that Microsoft is now unwilling to fix, you can bet they're going to hit the tech news media.

Tell your client it's time to consider changing, and to save a few dollars for a new system. You can also consider alternative operating systems that won't require a new computer: an installation of linux should be able to run on anything that currently runs XP. This might be a fine choice for someone who isn't dependent on Windows native apps.

Improve this answer
2
  • "XP has had enough holes over the years that it's hard to imagine there aren't some un-found holes in what remains." I understand that, but you'll need to somehow reach the system to exploit it. So if the browser is the only way, and it's a modern and up-to-date browser... That's what I'm asking about. "an installation of linux" I've thought of that, but Windows 8 on her work laptop is a huge change already. I'll use this as a last resort. Thanks for the suggestion though!
    – Luc
    Commented Apr 3, 2014 at 8:27
  • 1
    @Luc For example, there might be a flaw in XP's TCP stack that a crafted packet from the server could exploit. Slim chance, but the possibility is there.
    – Bob
    Commented May 4, 2014 at 8:53
-1

Is the client willing to tolerate high risk? If Microsoft is warning us about an OS and we don't act, it is risky. I don't care what secure control you have running on top of the kernel, you have a castle of sand. Know the risk, save money by upgrade if possible. Otherwise , it is just fomenting trouble and adding pollutive elements to the CyberBiota.

Improve this answer
2
  • 2
    It is correct that running an out-of-support OS adds risk, but that should be self-evident. Other than that, I'm not sure what you're trying to say with this answer.
    – Xander
    Commented Jan 15, 2015 at 20:46
  • I am saying it is risky and should be avoided . If it is self-evident, then why pose the question?
    – Gregg Dotoli
    Commented Jan 16, 2015 at 14:14

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .