Windows XP users face end to Microsoft support

As the hours tick away Microsoft has been encouraging people to ditch Windows XP

Support for the venerable Windows XP operating system ends this Tuesday.

It means that there will be no more official security updates and bug fixes for the operating system from Microsoft.

Some governments have negotiated extended support contracts for the OS in a bid to keep users protected.

Security firms said anyone else using the 13-year-old software would be at increased risk of infection and compromise by cyber-thieves.

Old code

Statistics suggest 20-25% of all users have stuck with XP despite the fact that there have been three major releases of Windows since its debut in 2001.

Some of those existing XP users have struck deals to get security fixes from Microsoft while they complete their migration away from the ageing code.

The UK government has signed a £5.5m deal for extended support. Similarly the Dutch government has signed a "multi-million euro" deal to obtain help for the 40,000 PCs running XP used by the nation's civil servants.

Anyone currently running Windows XP already faced a disproportionate risk of falling victim to malware, said David Emm, a senior research analyst at security firm Kaspersky.

Many of the world's cash machines are still believed to be running Windows XP

"Our data indicates that less than one fifth of our customers run Windows XP but more than a quarter of infections are Windows XP-based," he said.

That exposure ratio was only going to get worse after 8 April, he said, once the last security patch for Windows XP had been released.

That final patch will fix a series of bugs, one of which is rated as critical and is already being actively exploited despite only being discovered in late March.

"Effectively, every vulnerability discovered after 8 April will become a zero-day vulnerability - that is, one for which there is not and never will be, a patch," said Mr Emm.

Windows XP users topped the list of victims cyber-thieves targeted, said Maik Morgenstern and Andreas Marx from the German AV-Test group, which rates and ranks security software.

"Malware writers go for the low hanging fruits because it's a lot easier to infect systems running on an old Windows XP operating system compared to brand-new Windows 8.1, with all its built-in security features," they said.

"We think we will see a lot of attacks for Windows XP within the next few months, but attackers will also always add exploits for other Windows systems just to catch those systems as well."

Patch plan

Many have stuck with XP and ignored newer versions of Windows

Orla Cox, a senior manager at cyber-defence firm Symantec's security response unit, said criminals groups were likely to hoard the XP vulnerabilities they knew about rather than use them to bolster malware being spammed out to millions of people.

"The types of groups sitting on zero-days will tend to use them against high-end targets and for corporate espionage," she said. "Some organisations will have particular concerns because they find it so hard to move away from XP."

However, she added, any zero-day that did get used against a corporate target was likely to be re-used later on.

"Once it's out there it gets into the malware kits and then gets circulated and there will be no defence," she said.

Mark O'Neill, a spokesman for data management firm Axway, said organisations were getting better at coping with software that had hit its end-of-life.

"Beyond high-profile programs like XP there are a lot of products that have gone out of support because the company behind them has gone out of business or was acquired," he said.

In addition many other products were written in old programming languages that made them expensive to maintain and update.

As a result, many IT departments have put such ageing programs in the virtual equivalent of a "black box" and subsequently update the external code if security patches need to be applied.

"You can create a layer above the older application and that gives you a place to patch," Mr O'Neill said.

"Companies are not defenceless even with the things they cannot patch."