Infections for Windows XP

Microsoft warned many of its customers that they were on their own earlier this month when it stopped supporting XP, an older but still widespread version of its Windows operating system. The software remains functional, but Microsoft won’t fix its newly discovered security holes, leaving those who haven’t upgraded to a newer version vulnerable to a future hacking attack. It didn’t take long to find one.

Over the weekend, computer security company FireEye said it had noticed a number of attacks on U.S. firms via a vulnerability in various versions of Microsoft’s Internet Explorer. If successful, the attacks can force a computer to run code of the attacker’s choosing, which could extract data or send spam. More than 26 percent of desktop computers used the affected browsers last year, according to NetMarketShare. FireEye gave the attack a name—Operation Clandestine Fox—but wouldn’t say much about the extent or targets of the attacks.

Microsoft is working on fixing the IE problem. The fix, though, will not be sent to machines running XP. As of the beginning of this month, XP was the world’s second-most-popular operating system in terms of Internet usage, according to StatCounter, and was the OS of choice of more than 18 percent of Internet users. In an e-mail to Reuters, the company suggested that people update their systems.

There are other things that could protect XP users from attacks. The vulnerability exists in a Web browser, which means that it can only be exploited if victims use that browser to visit a website designed to attack them. “An attacker would have no way to force users to visit these websites,” wrote Microsoft in a security advisory. “Instead, an attacker would have to convince users to visit the website, typically by getting them to click a link in an email message or Instant Messenger message.”

This almost certainly means that this won’t lead to the kinds of devastating attacks on ATMs some security experts wrung their hands about earlier this year. Many ATMs and other industrial computers have been built around their operating systems, making it a difficult task to upgrade to a new OS. As a result, many continue to run XP even though their makers had ample warning to switch to a newer version of Windows.

Aravinda Korala, the chief executive of KAL ATM Software, wrote earlier this month that any ATM Armageddon is a ways off. “Most bank ATMs are very well protected,” he wrote in ATM Marketplace, a trade publication. “They are connected on a private network with no Internet access. They are locked down tightly so that only the minimum functionality necessary for the ATM to operate is allowed.” For one thing, ATMs don’t click on suspicious links.

For more help and tips, check out www.MooreITHelp.com