XP Users Permanently Vulnerable to New Internet Explorer Exploit

Don't say we didn't warn you. Microsoft ended support for Windows XP earlier this month, meaning any new security holes won't be patched. Well, they've found one, and it's a doozy. Affecting Internet Explorer versions from 6.0 through 11, this bug lets the bad guys execute arbitrary code on your system. As soon as you visit a gimmicked website, you're pwned. Other Windows versions will get patched, but not XP.

You may remember that Windows XP never advanced beyond IE8. Researchers at FireEye say the attacks they've seen are targeting IE9 and later, but that doesn't mean earlier versions couldn't be hit.

How it Works
Microsoft has been building attack-resistance technology into Windows for years now. Data Execution Prevention (DEP) blocks a whole range of attacks that worked by sneaking code into data areas and forcing its execution. Address Space Layout Randomization (ASLR) foils attacks that rely on finding and subverting specific code segments in known applications. According to a Microsoft security advisory, attacks exploiting this vulnerability can bypass both DEP and ASLR.

According to a Bitdefender report, the attack "leverages a Flash exploitation technique that loads a SWF file to corrupt process memory and direct the program's flow to a memory location where malicious code is laid out." This suggests that an IE installation without Flash installed might be safe, but I wouldn't count on it. The Bitdefender report also points out that 20 percent of Windows users are stuck on XP, many of them in enterprise environments.

What Can You Do?
First and foremost, as we've said before, if you're still running XP you must stop using Internet Explorer! Any other browser will be better, and all of the alternatives are still updating XP users. You can't truly get rid of IE, because it's too enmeshed in the operating system. But you can at least delete all shortcuts that point to it, so you don't launch it accidentally.

The Microsoft report on this vulnerability includes a large collection of suggested actions, many of which are valid for XP users with sufficient technical skill. The report advises deploying the Enhanced Migitation Experience Toolkit 4.1, setting Internet and Local security zones to "high," and unregistering a particular DLL, among other things.

Those running a post-XP Windows will get an update, once Microsoft figures out the patch. In the meantime, if you're running 64-bit Windows you can tweak a couple of settings for protection. Open Internet Properties and click the Advanced tab. Check the box to Enable Enhanced Protected Mode, and also check the box to Enable 64-bit Processes for Enhanced Protected Mode. Once you reboot, you'll be safe.

Really, though, this should serve as a wake-up call for XP users. Things are only going to get worse. As the Bitdefender paper states, "Windows XP had a good run in its 12+ years on the market, but now it's time to say goodbye and move on."

About Our Expert

Neil J. Rubenking

Principal Writer, Security

My Experience

When the IBM PC was new, I served as the president of the San Francisco PC User Group for three years. That’s how I met PCMag’s editorial team, who brought me on board in 1986. In the years since that fateful meeting, I’ve become PCMag’s expert on security, privacy, and identity protection, putting antivirus tools, security suites, and all kinds of security software through their paces.

Before my current security gig, I supplied PCMag readers with tips and solutions on using popular applications, operating systems, and programming languages in my "User to User" and "Ask Neil" columns, which began in 1990 and ran for almost 20 years. Along the way, I wrote more than 40 utility articles, as well as Delphi Programming for Dummies and six other books covering DOS, Windows, and programming. I also reviewed thousands of products of all kinds, ranging from early Sierra Online adventure games to AOL’s precursor Q-Link.

In the early 2000s, I turned my focus to security and the growing antivirus industry. After years of working with antivirus, I’m known throughout the security industry as an expert on evaluating antivirus tools. I serve as an advisory board member for the Anti-Malware Testing Standards Organization (AMTSO), an international nonprofit group dedicated to coordinating and improving testing of anti-malware solutions.

The Technology I Use

Much of the testing I do, particularly testing with real-world ransomware, is just plain dangerous. To perform such tests safely, I sequester them inside virtual machines managed by VMWare Workstation. For cross-platform testing, I use a MacBook Air, a Google Pixel 4, and a 6th-generation iPad.

I rely on my Delphi coding skills to create and maintain small applications. These include programs to check whether an antivirus correctly handled the malware it detected, launch dangerous URLs and record the security program’s reaction, and analyze the malware that I collect for use in testing. I also wrote a tiny browser and text editor for use in testing security apps that have predefined reactions for known products.

I do my writing and research on a Dell OptiPlex desktop, relying on Microsoft Word (my fingers know all the shortcuts). Many of my articles include charts and analysis; Excel is my go-to for those. When work hours end, though, I escape the bounds of Microsoft and Windows. There’s an iPhone in my pocket, I relax with my oversized iPad, and my Kindle Oasis is always loaded with the best science fiction and fantasy.

Read the latest from Neil J. Rubenking

Read full bio