Free Newsletters

   All InfoWorld Newsletters
Tech Watch | InfoWorld Staff » MS: Patching obsolete OSes gives 'false sense of security'

September 29, 2006 | Comments: (0)

MS: Patching obsolete OSes gives 'false sense of security'

Microsoft is responding to the latest effort by a group of security researchers to patch a hole it its products. As TechWatch reported earlier today, ZERT, the Zeroday Emergency Response Team, has released a patch for a Virtual Markup Language (VML) hole in unsupported versions of Windows, including Windows '98 and some versions of Windows 2000.

In an e-mail response to TechWatch, Microsoft said, through its PR agency, Microsoft said that the company "is aware of third party mitigations that attempt to block exploitation of vulnerabilities in Microsoft software." The company "appreciate(s) the steps these vendors and independent security researchers are taking to provide our customers with mitigations," but doesn't vouche for ZERT's patch. Duh.

On the issue of patching unsupported OS's, though, Microsoft is a bit more stern. "These products have reached the point of architectural obsolescence. It would be irresponsible to convey a false sense of security by extending public support for these older products," the company said in an e-mail.

Maybe so, but I'm guessing enterprise networks with vulnerable '98 and W2K boxes will choose false security over no security at all.

Posted by Paul Roberts on September 29, 2006 02:36 PM


RATE THIS ARTICLE:





 

  •  
  • COMMENTS




"These products have reached the point of architectural obsolescence."

How does that make Windows XP any different from Microsoft's unsupported OS's?

Posted by: steward at September 30, 2006 08:24 AM

"MS: Patching obsolete OSes gives 'false sense of security'"

And, judging by Windows XP's record since it was released, patching it also gives a false sense of security.

Posted by: Gary at October 1, 2006 05:47 PM

Microsoft is just too damned lazy to produce
patches for its older OS's and other products.
Just keep your finger crossed that they haven't
got any porous legacy code in the latest versions.

Oh, and your best bet? Buy all-new hardware with
the latest flavor of Windows, and MAYBE you might
have security patches available.

That's a REAL false sense of security!

Posted by: Jeff at October 1, 2006 05:53 PM

This is one of the primary factors influencing my decision to move all of my critical systems to open source operating systems (FreeBSD and Linux, primarily). With closed source, proprietary systems, you run the significant risk that the infrastructure you have built your company on will be made obsolete not because it fails to do its job, but simply because the company that sold it to you has decided it wants to force you to upgrade.

Posted by: Randall West at October 1, 2006 06:07 PM

Windows XP may have tighter security than the older systems, but I don't believe that Microsoft would go so far as to say that their own products are full of holes. Thats like saying that one of the very first releases of linux isn't secure, and full of holes. It's just not true. Any system, regardless of the architecture, can be patched to avoid security breaches. We are still using the same networking protocols we were 8 years ago. There may have been some refinements in areas, but these can be adapted to the old systems they were initially built for. Microsoft are just being lazy, as they were with the new filesystem that was supposed to be released with Vista. They want everyone to buy new computers with all the latest versions of their software. This is one of the many reasons why UNIX based systems are so much better. The architecture of their system is very open, and can be modified by anyone who can code in GNU C. If all software was open source, we wouldn't have many of the problems we have today. Although I'd like to see the day when Microsoft makes their flagship product open source.

Posted by: dust11 at October 1, 2006 06:08 PM

Amazing how people shell out cash to companies for operating systems and then dont get the support for as long as the OS is around for. If a person goes out and spends a lot of money on an architecture years ago and does not wish to upgrade then they are stuck with that system and that older OS. There should be some sorta support since the OS's did not come cheap intially. I am sure there are lots of people out there that can not just go out and purchase new stuff every time someone says do it, its unfortunate but true, and those are the people that wind up suffering while companies wheel the axe cause they made there billions off it! Sorry I made my money off it, poo poo on you!

Posted by: Will at October 1, 2006 06:12 PM

microsoft & bill gates are a product of happenstance and by luck of the draw we will have to live with. when you are dominant there is little incentive to address the needs of your customers.

Posted by: Prentiss M. Seymour at October 1, 2006 06:27 PM

If you still run windows 98 and connect your enterprise to the net at this moment I don't care how big or small an enterprise you are you should get whatever is coming to you. C'mon it's almost a 10yr old OS you can even get ubuntu or any other linux distribution for free that are far more efficient, up-to-date and secure than win98,95 etc
I'd understand if it were a home pc you use for your casual e-mail and net browsing. Even then it'd be irresponsible. I never thought i'd say this but yes I do agree with MS take on this matter. It's 2006, don't want to pay for new windows xp? great get a good linux distribution, they've come a loong way since the old says and are really easy to use now. Otherwise if you're up to your neck in viruse it's your fault.

Posted by: Nitrokid at October 1, 2006 06:29 PM

"These products have reached the point of architectural obsolescence"

PR speak for "reached their profitability obsolescence".
"We make software for sale. When it comes
to a choice between stockholders and
customers, the stockholders come first;
between security and profitability,
the profits must come first."

Posted by: SunnyB at October 1, 2006 06:32 PM

I still use Win2000, with a 6 month new board cpu... works great.

Why can't MS make a paired down OS with all the power, and only the crap I really need? I work on 3D. I just want the darn thing to maximise my application's strengths. It'd be simpler, and more efficient, and cost, what, 1/4 the price of full os, with all this crap my super fast machine is still pausing to load. JEEZ. Make an optimized business solution. Light, fast, strait to the point. Gigantic blubbery OS SUCKS. its a time suck, and it gives far to many entry points to exploit. Trim the fat already. And a 3D interface is not really usefull. It just wastes system resources. click. run. work. done. THATS IT. Its like having DVD players and satelite GPS, with full auto everything in a SUV... if you need to sedate yourself with that much crap... fine, but I don't, so don't assume everyone wants your over-wrought stuff. Oh, look, Linux. "oh, its not eaaaaasy to use". Uh no. Not at first. But it gets REALLY usefull after the learning hump. And its fast. Nice for the price.

Posted by: Derek at October 1, 2006 06:37 PM

Windows XP is obsolete and so is Vista. All of the are about 5 years behind the current OSX and like 10 years behind the upcomming leopard OS by apple. Microsoft doesn't need to worry since the world is going to buy into their vista os, even though it is only a repackaged version of XP and hardly has and changes. It also stole about every concept from mac OS 10.1 which is 5 years old. Vista has been delayed for years while apple has realeased 4 major updates to its opperating system. Also, as time goes on Vista get less and less features, wile mac os 10.5 leopard get more and more. I only wish that vista will crash and burn like all other microsoft products should have. It is truly the biggest scam in modern history

Posted by: James Soutern at October 1, 2006 07:18 PM

Before you go crying let's appreciate the amount of manpower it takes to manage a huge software company as Microsoft. Many of you have never worked in a technical field and have no earthly idea of how hard it is to maintain stability under any tech environment. I would rather all of MSFT's efforts continue on newer products than even bother supporting 98 anymore. As consumers it is cheaper to use new technology than old. Just look around and you will see old patches and upgrades is just throwing good money after a bad cause.
Wake up people man up buy new software.

Posted by: regular user at October 1, 2006 07:28 PM

If someone is still running win98, they deserve to be burned and burned hard. If you're running an OS that's almost a decade old, how can you expect modern security!? It's rediculous. Is Apple patching MacOS 8? Is Linus patching the linux kernel 2.0.35? The answer is No. Just a bunch of hypocritical fanboy's.

The cliche Microsoft bashing is just so lame. Give me a break. I refuse to troubleshoot someones PC with anything less than windows 2000 (and win2k is 7 years old...), so I can hardly blame Microsoft for telling people to get with the times. If you're going to insult Microsoft's decade-old OS's, I suggest you look at MacOS 8/9; now that was a pathetic OS - it didn't even have a ping utility.

I say go Microsoft for forcing people to upgrade. I think you got your $109 dollars worth of win98 over the last 9 years; upgrade for Christ's sake.

Posted by: Bob at October 1, 2006 08:37 PM

I am not a supporter of everything Microsoft does but I have to say that the comments above show a clear lack of understanding of what windows is and the true magnitude of features and software it supports.

Sure, there are more problems with Windows than other operating systems, mainly because it is used by more people and thus has to stand up to much harder testing.

Its always good fun to see miss informed "Mac" lovers writing crap in forums like this. If Mac OS anything was as good as your claim, it would have taken over the world by now. Instead, the operating system that is apparently 10 years ahead of anything Microsoft has still uses clunky menu navigation at the top of the screen and has such a low market share it doesn't even represent a blip on the radar.

Considering there are very few differences left between the operating systems, and windows has done pretty much all MacOS can do for years now, and the latest release of Mac OS (the operating system) contains upgrades to highly important app's such as iChat and iPhoto it is starting to become clear who makes real operating systems and who is just making the pretend ones.

Posted by: Andrew at October 1, 2006 08:48 PM

It figures...MS says we'll support older OS, & then you get hit by the crash. Vista is more hype, just like XP was. Now more hype & more$$$ for MS, problems for the end user.

Posted by: Don Blake at October 1, 2006 09:16 PM

Microsoft, a company that instead of taking care of its core business, is too busy chasing Google, Sony, YouTube, Apple and any other company you see out there making a buck. With the X Box, the Zune and oher technologies, the company has spreaded too thin, and plays only second banana to the much stronger originals.

Posted by: Somebody at October 1, 2006 11:18 PM

To JS... You can't just slam the OS's as "being older then another". I use Solaris 10 x86, OS-X, and Windows XP on my desktops at work. They all have vastly different skill sets and all three of them are incredibly competent. While I regularly refer to my XP machine as a "Wintendo" as it is the most competent hardware/software for playing games, it is also blisteringly fast for running a single business application at the best possible speed. I also use OS-X on a G5 as it is reliable (to a point) and is comfortable but it still lacks the pure speed of a Windows machine (I haven't played with the Intel version). While OS-X avoids all the issues that beffudle the Windows machines from running their best, it also doesn't have nearly the built-in versatility or utility of Windows. Then there is Solaris which doesn't function great as a desktop, but it is always there and does whatever I tell it to do with great speed and without complaints. At the end of the day I chose to use my PC as my "main" machine because it has the fastest and best 3d card/drivers of either machine so I can host synergy to access the mac, and X to access Solaris.

Point is each of these operating systems is incredibly competent at what it does.

Posted by: A E at October 1, 2006 11:34 PM

Oh, that's just great, Microsoft! So they're basically admitting all their patches were never enough and will never be enough. Using their product is just one big spin on the roulette wheel. Wheeeeeeeeeeeeeeeeeeee!!!!!!!!! Fun, eh? All this and we get Vista to look forward to.

*plunk!*

Posted by: SkylerGisondo at October 2, 2006 12:45 AM

Well, there were plenty of features in Win95 for most business purposes and, at nearly $200 a pop, there is a lot of reason for tight-budgeted businesses to ignore Vista. The only way MS sells new versions is to scare businesses and strong-arm SI's and manufacturers into moving up. Atfer 95, there certainly has not been a compelling functional reason to change.

Posted by: Don Turnbull at October 2, 2006 03:53 AM

It's a business, part 1:

Maintaining a large product line is expensive. Even Apple does not support OS 8 anymore.

It's a business, part 2:

Consider people that use older computers. Installing XP or Vista is not an option, Office 97 works still fine and they do not need any of the new features. Because these people do not spend money they can be abandoned.

Conclusion:

Patching old bugs and "features" does not create capital. The only way to make money in software business is to write new software.

To maximise profit you have to minimize support and maximize new product sales.

If someone does not like it, they can always go and install some open source operating system.

Posted by: Tero Niemi at October 2, 2006 05:02 AM

I'm no MS lover but a little bit of sanity could be used in these threads:

> Microsoft is just too damned lazy to produce
> patches for its older OS's

are they? Or are admins just to lazy to upgrade? Windows 98 is 8 years old, it's dead, move on. Even a large business like MS can't patch all it's products forever

> With closed source, proprietary systems, you run
> the significant risk that the infrastructure you
> have built your company on will be made obsolete
> not because it fails to do its job, but simply
> because the company that sold it to you has
> decided it wants to force you to upgrade.

MS has consistently supported it's software with patches for *much* longer than Open Source companies. In general, Open Source moves along at a faster pace than proprietary, so how does this help you? Sure you can roll your own patches but do you really have time to do that?

> Windows XP is obsolete and so is Vista. All of
> the are about 5 years behind the current OSX and
> like 10 years behind the upcomming leopard OS by
> apple.

At what point in life did you give up formulating opinions on your own and just start believing everything Steve Jobs says?

> Microsoft doesn't need to worry since the world
> is going to buy into their vista os, even though
> it is only a repackaged version of XP and hardly
> has and changes

Ah, ignorance at it's best. Have you actually used Vista? Are you aware of the amount of new code in Vista? Have you actually seen how many new features are included in Vista? Come on people, there's plenty of legit reasons to bash MS, using the same old FUD just makes you sound lame.

Posted by: Jay Lee at October 2, 2006 05:42 AM

Hackers and script kiddies tend to attack the largest audience, which at the moment is WinXP/IE6. Attacks targeted at WinXP usually don't work on Win98. So actually using an obsolete OS IS safer - you're not a target.
Same goes for MacOS (whatever version). It's safe because too few people use it. A script kiddie is not going to attack Macs, not enough impact, no fun.
Script kiddies WILL try to attack Linux, which usually is better secured than Windows. Reason - if you want to use Linux, you have to know about computers, so you also know about security. Linux users know how to secure their systems and do so. The majority of Windows users don't - they just know how to use their browser, mail and word processor.

Linux also needs patches now and then. Hunting down the correct patches and figuring out the correct sequence to apply them is not easy. Windows has the advantage of being an automated 'one stop shop', patching is as easy as it can get for the end user. I don't know about the Mac, probably something like Windows when it comes to patches and upgrades.

MacOS has always had a slick user interface, but it took until 2000 (OSX) before they put a decent kernel into the system - long, long after Microsoft did so with NT 3.51 in the early '90s, which again is long, long after Unix did so (from its conception, in the '70s).

Vista? I'll see. Downloaded RC1 this weekend. Hope I can turn off the visual goodies and revert back to the fast and slick Win2K interface. I need those CPU cycles!

Posted by: Steven at October 2, 2006 01:14 PM

Let’s not forget that Apple is the king of abandoned systems. Apple III, Apple IIC, Apple Lisa, Apple IIGS – these were discontinued almost as soon as they hit the stores. People who bought these would have been better off spending their money on lottery tickets. Apple has a sad history of deleting its user base by forcing users to do things Apple’s way or no way – upgrade your Apple system and you have to buy all new software, new printers, scanners, etc. Much of the pain that we have experienced with MS systems stems from the fact that MS maintained excellent backward compatibility – this has allowed MS to pull their customer base along with each OS change. NT (aka son of OS2) was a solid OS – I just finally retired my last NT box not because it was not performing flawlessly, but because it needed USB. All software vendors face the same problem – how do you keep making money after the market is saturated with your current offering?

Posted by: Robert Otwell at October 2, 2006 02:05 PM

I think there is a logical disconnect at work here. For some products, a life span of 3 or 4 years is long, while other products have much longer life spans. In the world of manufacturing assembly lines, and in the world of broadcast radio and television, there are many expensive products in use today, with life spans of 20 years or longer. If an equipment manufacturer of such equipment were to decide they no longer want to make a particular product, they publicly state that they are going to continue supporting their products in the field for eight years after their last date of manufacture. Less support than that is bound to generate a lot of negative talk among their customer base, many of whom meet each other at least annually at industry trade shows.

I think a responsible position for MS to take would be for them to recognize that SOME users of MS products have incorporated them into hardware like I described above, so for MS to cut off support for older MS products leaves those equipment manufacturers hanging, because their equipment must continue to be supported long after MS calls it quits.

My suggestion, which might not be practical, but which I am offering here for discussion, is this: MS could release the source code for their discontinued products (which they do not want to support any longer), to the general public, free of charge. That way, third parties can take over from MS, and provide (for a fee) the support MS no longer wants to provide. By making their source code available, MS will be helping those third party support organizations to know exactly what they need to do to maintain MS's obsolete products, while MS is free to move on to newer and better things.

What do you think of this idea? I know that if I wanted to install some robotic assembly machines in a factory, I would certainly want support for the hardware and software in them for at least 10 years (or even more), because I would expect to be using those machines that long.

email to rgetsla [at] yahoo {dot} com

Posted by: Bob Getsla at October 2, 2006 02:21 PM

For those who expressed their agreement with Microsoft on this issue. WHAT exactly do you agree with? Microsoft already discontinued support for Windows 98. So what the heck do they care if someone else releases security patches? Microsoft's PR messages here are not about security - they are about politics and money.

And continue to tell me to burn.. I am using Windows 98 on my 7-year old computer and I do not plan to upgrade it anytime soon. I don't have an AV scanner or firewall installed either. I have also never gotten any virus or spyware infections. I don't think I'll be rushing to install this third-party zero day vulnerability fix either.

I am not asking for anything from Microsoft - but please stop brainwashing people and sending bullshit PR messages, because it just about makes me sick.

Posted by: Ivan Butora at October 2, 2006 05:32 PM

Another thing some of you might have missed: the VML issue has to do with Internet Explorer, NOT Windows 98 itself!!

Posted by: Ivan Butora at October 2, 2006 06:28 PM

Windows 98 Second Edition is needed for our public schools. The public schools do not have a lot of money and investing in lots of new software is much more expensive than the cheap hardware nowadays. I suggest having a Windows Classic Edition that will replace 98 Second Edition. This operating system would be mainly 9x source code but it could provide elements of the NT (New Technology) source code and open source code for some modern day compatibility. The primary purpose of this new operating system would not be to compete with XP or Vista but would be provided for our public schools and parents remember all the children who you send to public school. The public schools need a true successor to 98 Second Edition that will run MS-DOS (Microsoft Disk Operating System) and especially Windows 3.1 programs well. These older educational programs run poorly or not at all in Windows XP. Therefore, logical reasoning concludes Microsoft would make lots of money selling this Classic Operating System to the public schools and the public schools would win also by saving money on having to upgrade all their older educational software which is really expensive. In addition, then the public schools could run a product that was currently supported by Microsoft and be able to have updates to keep their operating system safe and current. This operating system would also appeal to homeusers who have loads of older programs like myself stored away in storage. In addition, I work at a public school in Albuquerque, New Mexico and we use lots of 98 Second Edition PCs for the students and XP Professional computers mainly for the teachers. The school is in a dilemma because it simply does not have the funds to replace both the hardware and all the software of the older 98 Second Edition computers.

Posted by: Dan W. at October 2, 2006 08:19 PM

Sorry, but I give Microsoft the nod on this one.

Even by the old rules, a technology generation is 5 years long. Sending the message that patching old Win9x OS's is somehow valid, appropriate, and protective, is simply the wrong message. It's like fixing a leaky tap when the entire room is collapsing.

I have supported several large systems. Vendors in those environments often adopt a highly structured support and upgrade methodology. They typically follow a rule that the supported versions are the current version, plus the one immediately prior to current. Everything else is not on normal support (although they may create special support plans at a premium cost).

Furthermore I am a programmer and have created numerous complex systems. Doing this highlighted the vendor's dilemma. Do you want to continue to support old versions, when the bugs and functional shortcomings in them are already addressed in a new version?

You can continue to run your old systems. Just recognize that it's not reasonable to expect continued vendor support forever. Nor is it reasonable to expose those old systems to a lot of new requirements and conditions.

It's not like Microsoft has asked us to upgrade Windows, outside of free patches and Service Packs, on some unreasonably short and frequent timeline. In fact it's been too long between the release of XP and Vista.

Posted by: Brian at October 4, 2006 11:56 AM

Technology White Papers

 

InfoWorld Technology Marketplace

» Technology White Papers Library

Technology White Papers by Topic

Technology White Papers E-mail Alert

Find out when the latest white paper is available:
 
 
» BUY A LINK NOW

Sponsored Technology Links