Office Computers Still on Windows XP

Two years without a fix

Microsoft stopped releasing security fixes for Windows XP in April 2014, two years ago this month.

Plenty of small offices still have an XP computer. It sits at the front counter, in the back office or beside a piece of equipment, and it starts every morning exactly as it always has.

Working is not the same as safe. Every weakness found in XP since then is still open on every machine running it.

And this month Chrome, the browser many of those machines moved to when Internet Explorer stalled, stopped updating on them as well.

What changed this month

Chrome 50, released on April 13, no longer runs on Windows XP or Vista. Chrome on those computers stays at version 49 and gets no further fixes.

Internet Explorer on XP stopped at version 8, and its fixes ended along with XP's own.

Switching to a browser that still installs on XP buys little. A current browser cannot repair the system underneath it, and the holes in Windows itself stay open.

Banks and payment pages are also moving to newer standards for secure connections, which Internet Explorer on XP cannot use, so those sites will gradually stop opening in it.

Where the old machines are

They are rarely the main computer any more. More often they are one of these.

• The counter computer that runs an old till or invoicing program.
• The equipment computer that drives a machine in the workshop.
• The bookkeeper's desk, kept old for an old accounting version.
• The spare switched on whenever the main computer fails.
• The home computer where the owner does the banking at night.

The second is the one that cannot simply be thrown out. Its software came with the equipment, was never updated for a newer Windows, and the equipment cost far more than the computer.

Why XP is the easy way in

Microsoft still fixes holes in Windows 7, 8.1 and 10 every month, and many of those holes exist in XP too.

Each fix shows attackers where to look on machines that will never receive it, so the list of known ways into XP grows every month.

The route in is usually ordinary: an attachment posing as an invoice or a parcel notice, or a booby-trapped advertisement on a legitimate website.

Antivirus helps, but it cannot patch Windows, and its makers will wind down support for XP on their own schedules.

Email, banking and the website login

What an infected computer can reach matters more than what is stored on it.

Email comes first, because it is where password resets for everything else arrive. Whoever reads your inbox can take over your other accounts one at a time.

Banking comes next. Malicious software that records keystrokes waits for a login, and money moved with your own password can be very hard to recover.

Then the website. Passwords for the site's admin, the hosting account and the file transfer program are often saved on the office computer, where malicious software can read them.

A stolen one is how many small sites end up serving spam pages or quietly redirecting phone visitors somewhere else.

A worked example

A quilt shop in a small town sells fabric, runs classes and quilts customers' tops on a computer-guided long-arm frame in the back room.

The frame is driven by a computer bought with it nine years ago, still on XP, because the quilting software was never released for a newer Windows.

Over the years that computer became the office as well: the shop's email, the online banking and the login for posting class dates on the website, all saved in the browser.

Nothing had gone wrong on it. The risk came from convenience: a machine that had to stay old for one job had been trusted with every other job too.

The shop bought a laptop for the office work and changed every password from it. The old computer came off the Wi-Fi, lost its browser shortcuts and now drives the frame and nothing else.

The frame's maker offers current software as a paid upgrade, which is now in next year's budget.

When a machine has to stay

Some XP computers cannot go yet. They drive equipment, run a program with no successor or hold records nobody has moved.

Those carry far less risk if they do one job and nothing else. Disconnect them from the internet, remove the email program and never browse on them.

Move files with one USB stick kept for that purpose, and give the machine a login of its own, with no saved passwords for anything else.

Replacing the rest

Every other XP computer is better replaced than repaired. The free Windows 10 upgrade offered this year applies to Windows 7 and 8.1, not XP, and hardware that old rarely runs current software well.

Before buying, list the programs each machine runs and ask their makers about versions for Windows 10. Accounting programs, label printers and anything attached to equipment are the usual surprises.

When the old computer leaves, have its drive wiped or destroyed. It holds years of saved passwords and customer details.

New passwords, from the new computer

Treat every password ever typed on the XP machine as possibly known to someone else.

Change them from the replacement, never from the old computer. Start with email, then the bank. After those come the registrar that holds your domain, the hosting account, the site's admin login and any supplier portals.

Where a service offers a second step at login, such as a code texted to your phone, switch it on at the same sitting.

The counter-case

An XP computer that never touches the internet and does one job carries far less risk, and one unplugged in a cupboard carries none until someone plugs it in.

Offices already on Windows 7, 8.1 or 10, or on current Macs, have nothing to do about XP, though the same thinking will apply to Vista when its support ends next April.

For everyone else the rule is short: from this week, no email, banking or website logins on Windows XP.

Every office computer

1. Check which Windows each office computer runs.
2. Include the spare and the home computer.
3. Write down what each XP machine is used for.
4. Move email and banking to a supported computer.
5. Change every password from that computer.
6. Disconnect the machines that have to stay.
7. Budget replacements for the rest.

Step four is the one to do today rather than this week. It takes an afternoon, needs no new software, and removes the two things an attacker on the old machine wants most.

The browser side of the same problem is covered in old Internet Explorer stops getting fixes today.

Frequently asked questions

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.