4

My office has about 20 PCs running Windows XP. I got a message saying that Microsoft is no longer releasing any security patches for Windows XP. However, we find that XP is very convenient for our work. Please suggest some possible ways to keep Using Windows XP for my PCs without any risk.

2
  • You would have to security so tight your users would revolt. If you blocked all internet access. You could sit with each user and have them tell you what to do and then you do only the safe parts of there request, 1 user at a time. Hire a team to analyze attachments, or just be an attachment free email company and delete attachments automatically. Basically, your company would have to be an IT prison camp.
    – cybernard
    Aug 27, 2015 at 3:54
  • I would suggest that the way you think about convenience may need to shift. It may appear convenient, but the fact that you are guaranteed to have permanently open security holes with a 100% certainty suggests that it may not be as convenient as you think.
    – Cort Ammon
    Aug 27, 2015 at 5:30

7 Answers 7

17

Disconnect from the Internet, don't allow any external devices to be connected to your network and physically guard your computers to make sure that nobody violates the no external devices rule, and you'd be fine.

Otherwise the only option is to upgrade. Since security updates are no longer provided, any newly discovered vulnerabilities would remain unpatched and an attacker (either external or internal) would have an easy time of using one of those unpatched vulnerabilities to access your systems if they can connect to them in any way. Keep in mind that a large portion of attacks originate from disgruntled internal workers and unpatched vulnerabilities will mean that tools will become easily available to let even a relatively unskilled user make use of complex vulnerabilities.

There is no way to secure against this cost effectively other than to upgrade to an OS that still receives patch support to counter security flaws as they are discovered. Honestly, if you are concerned about properly securing your business, it was past time to upgrade from XP even prior to the end of life. There are numerous performance and security enhancements in Windows 7 that rendered XP obsolete from a security perspective years before end of life was reached.

7
  • I am not bothering about cost. I am just looking for alternative ways to protect my system. Thanks for your reply and one more question Shall i use any system security products on my PC's? Will it gives complete protection similar to windows security patches? Jun 4, 2014 at 13:44
  • 2
    @Willamhendric - while it is a good idea to use security products, it will not protect your computer against a lot of threats. Many security flaws in Windows, when exploited, can bypass the protection of third party security software because they can force the OS to do things. Third party software works by looking for other user software that is causing issues and telling the OS to stop it. Security flaws in the OS allow the attacker to be the OS. So the third party security software would be asking the attacker to stop themselves. (That's oversimplified, but gets the basic idea.) Jun 4, 2014 at 13:51
  • @Willam hendric there is a way, but it would require researching security holes, reverse-engineering, and implementing a patch by yourself or paying for someone to do it for you. Depending on the country you are in you may need at least two people (the US has laws that pretty much require two or more people). This is not very cost effective as it could cost into the millions if not billions of dollars and you are not guaranteed to patch all holes. But, is really the only way to keep it "secure" without support from Microsoft patches. Jun 4, 2014 at 16:36
  • I don't know any people who provide security to my PC's with Windows XP. Shall i hire any security providing company? If so, please suggested some affordable security providers. Jun 5, 2014 at 12:37
  • @WilliamHendric the reason I didn't mention what Travis mentioned is that there is no cost effective long term option. Jun 5, 2014 at 12:44
4

This depends on why you aren't upgrading.

The vast majority of security holes in Windows XP are in Internet Explorer. If you can completely eliminate the use of IE to view external content (and this includes hidden uses such as reading HTML emails in Outlook), you can keep your computers reasonably secure from outside attack, at least in the short term. This is harder than it sounds, though, since a great many applications embed IE as an HTML renderer.

If you aren't upgrading because some task requires a specific version of Internet Explorer, there's nothing you can do.

5
  • +1 for hidden uses such as reading HTML emails in Outlook
    – elsadek
    Jun 5, 2014 at 15:06
  • In response to the last paragraph: If your need for XP is only because of old IE versions, you should definitely try Enterprise Mode on newer versions of Windows, or simply using the compatibility <meta> tags on your internal webpages. (You can tell it to simulate as far back as IE7 for particular pages. It's not perfect, but pretty good)
    – Katana314
    Jun 26, 2014 at 13:37
  • I down voted this answer because not using Internet Explorer will not protect your XP machine as asked in the original question. If a service in the machine becomes exploitable even simply being connected to the internet can compromise you. An example of this is the Blaster worm which affected the RPC service running on Windows XP and 2000.
    – Bacon Brad
    Aug 28, 2015 at 15:37
  • @BradMetcalf, during the life of XP, Microsoft disabled or firewalled all Internet-listening services by default (Windows Firewall became active by default with SP2), leaving only user-assisted vectors (such as browsing a site in Internet Explorer). A fresh install of XP SP3 that has been connected to the Internet isn't at risk of infection until the user starts using it, and IE (including hidden uses) is the primary source of user-assisted attack vectors.
    – Mark
    Aug 28, 2015 at 19:36
  • @Mark I am actually seeing the opposite. I just nMap'd a fresh install of XP SP3 with updates and it revealed three service ports are open. 125 which is an RPC port, 445 which is a SMB port, and 3389 which is the remote desktop service port. Which would mean if either service becomes vulnerable the XP machine itself becomes vulnerable.
    – Bacon Brad
    Aug 28, 2015 at 20:16
2

Windows XP is not secure and you do risk running into getting hacked. I do believe you can pay for XP support like the banks are doing. But it would be a much better switch if you jump to at least windows 7.

1
  • Microsoft doesn't offer an extended support agreement for XP officially. They only do it "under the counter" for very large and security-relevant customers like banks and governments. The official stance of Microsoft towards business customers is "stop your whining and upgrade".
    – Philipp
    Jun 5, 2014 at 8:30
2

Microsoft has a special support for XP for large companies, but I think it is expensive for smaller ones http://gcn.com/blogs/pulse/2013/09/xp-support-for-a-price.aspx .

There is one way how to receive XP updates until 2019, but it is not advised by Microsoft. The info is from this site http://www.sebijk.com/community/board15-other/board73-tutorials/2985-getting-xp-updates/ and I have to say that there is a warning on that page:

ATTENTION: Use at your own risk! These updates are not tested on a regular XP system and could damage your system.

Microsoft have released a warning, too.

You have to write to a text editor the next few lines of code:

Windows Registry Editor Version 5.00


[HKEY_LOCAL_MACHINE\SYSTEM\WPA\PosReady]


„Installed"=dword:00000001

and save it as a .Reg file. You have to save it exactly as it is, with the blank lines. Than just double click on it and allow it to save to Windows XP registry. I tried it and it worked, I began to receiving new updates. But it is not my only one PC so if something happens it is not such a big problem for me and I am not running a business on it.

2
  • This is one answer where we need some sort of extra formatting to indicate the danger. Yes, it might work (and it's an awesome find!), but gosh, I'd never implement this for a business. The risks are undefined. That said, I'm going to try it on a test system ...
    – schroeder
    Jun 12, 2014 at 15:17
  • 4
    This method will get you updates for the Embedded Edition of Windows XP, which is a very stripped-down version. These patches will be unlikely to fix any vulnerabilities in any components not included in the embedded edition.
    – Philipp
    Jun 12, 2014 at 16:02
1

I heard that Horizon Datasys (the makers of Rollback RX) is developing a freeware version of Rollback exclusively for XP users to stay protected.

1

There has been a deal with Microsoft and the UK Government that has enabled the government's Windows XP machines to be patched for another year - so if you want continued patching and support then this is the only secure way to go if you refuse to move from XP assuming you don't want to isolate your machines (but you will still be forced to upgrade after the period ends in a year). No general deal has yet been announced to make this available to private companies and end users.

Also, there have been hacks posted that allow updates to continue, such as this one. Whether the hack will allow you to receive the same updates is another matter, but it could provide short term protection to buy you a little more time to rollout an upgrade ASAP. As @elsadek notes in the comments this could result in broken or reduced functionality.

2
  • Microsoft has made a warning for the hack you mentioned, read this "..Windows XP customers also run a significant risk of functionality issues with their machines.." zdnet.com/…
    – elsadek
    Jun 5, 2014 at 15:19
  • Yes - as with all hacks, never guaranteed to work. Jun 5, 2014 at 15:24
0

I have a Windows XP machine that is being used due to some legacy software. In order to protect it- I put in multiple layer of protection. Av, Malwarebytes and monitor my network as well. Of course keep an updated back up.

Recently I have come across this freeware known as RollBack XP. This definitely helps in protecting Windows XP by allowing you to revert back to a previous state before the system crashed or got infection.

I am still testing the RollBack XP. So far so good.

More info on RollBack XP:http://www.horizondatasys.com/en/RollBack_XP.ihtml

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .