How Windows patching leaves security exposed

A day they’ll never forget

Speaking at a Gresham College lecture, Tarah Wheeler, a fellow at New America and Fulbright scholar, described the WannaCry attack as something many IT professionals would never forget. She said: “The IT personnel that I’ve spoken to at the NHS who remember that day, remember it like someone in the United States would remember where they were when Kennedy got shot, or when they first heard on 11 September of the World Trade Center coming down.”

Wheeler’s research into the aftermath of WannaCry has found that over a quarter of organisations that recognised they were vulnerable to WannaCry in 2017 are still at risk. She found that many organisations still rely on unsupported and outdated Windows 7 software and have not updated their PC equipment. “Many people don’t understand that the nature of updating a computer is something that needs to be constant in the background,” she said.

Wheeler said organisations sometimes deliberately choose not to update their computers specifically because they may be running things like critical infrastructure. “This is a terrifying conversation to have,” she said. 

According to Wheeler, many of these machines cannot simply be rebooted because organisations rely on the services they provide. “You can’t afford the time to repair it, which is why we end up with these kinds of cyber attacks,” she said.

Embedded older versions of Windows

Roel Decneut, chief marketing officer at Lansweeper, said: “Companies run legacy devices and systems that are maybe not supported any longer, but are still absolutely necessary for the business because purchasing new models just isn’t feasible for some reason. It might be that they can’t easily upgrade the operating system because it could potentially mess with the software. This is seen as a cost saving due to the effort involved in not just migrating the OS, but the entire application it supports.”

Decneut said operational technology and other environments tend to be isolated from both the internal IT network and the internet, which can potentially reduce the risk of an operating system exploit getting into the system. “The security aspect is deemed mitigated,” he said. “It’s all reinforced by the fact that these kinds of environments are subject to high uptime as they are vital to the output of a business.”

Beyond operational systems running older versions of Windows, IT departments in large businesses can often struggle to keep track of all the versions of an operating system they have running, which can lead to cyber attacks.

Looking back at what Microsoft president Brad Smith wrote about WannaCry in a blog post, the attackers were able to find an attack vector by exploiting a vulnerability that Microsoft had patched a month earlier.

In the post, published on 14 May 2017, Smith discussed why Microsoft had released the patch: “On 14 March, Microsoft released a security update to patch this vulnerability and protect our customers. While this protected newer Windows systems and computers that had enabled Windows Update to apply this latest update, many computers remained unpatched globally. As a result, hospitals, businesses, governments and computers at homes were affected.”

Risk of critical vulnerability and exposure alerts

From a security perspective, Smith’s statement shows that vulnerabilities in newer versions of Windows may also exist in previous and unsupported versions of the operating system. This is the vector the attackers behind WannaCry used. Publishing details of the patch gave the attackers the information they needed to target unpatched older versions of Windows. 

Given the nature of Windows software, and Microsoft’s commitment to backwards compatibility, unless a patch fixes functionality that is only present in Windows 10, the vulnerability the patch plugs is highly likely to exist in older versions of Windows desktop and server operating system software.

The risk posed by legacy or unsupported operating does not go away with continuous updates, as in Windows 10, which receives a major update every six months. Windows 10, version 1909, which was issued in 2019, reaches end of service on 11 May 2021. Microsoft said that after that date, devices running the Home, Pro, Pro for Workstation and Server SAC (semi annual channel) editions of this operating system build will no longer receive monthly security and quality updates that contain protection from the latest security threats.

However the company said it would continue to provide patches and updates for the Enterprise, Education, IoT Enterprise and Nano Container image versions of Windows 10, version 1909.