Tag Archive for 2012

RB | August 21, 2014

Comments Off

MSFT Closing More Windows Support

MSFT Closing More Windows Support IT departments organizations are busy keeping up with XP replacements, Cloud migrations, BYOD implementations and now Microsoft has reminded everybody that there are other fires burning on the horizon. Microsoft (MSFT) is warning that they are ending mainstream support for more popular Windows products. Some of the key products ending mainstream support include; Windows 7, Window Server 2008, Exchange 2010, and SharePoint 2010.

So what does Redmond mean when it ends “Mainstream Support”?

Mainstream support is the typically five-year period when Microsoft provides free patches and fixes, including but not limited to security updates, for its products.
When a product exits the mainstream support phase, Microsoft continues to provide a period (also often five years) of extended support, which means users get free security fixes but other types of updates are paid and require specific licensing deals.
“End of support” means there will be no more fixes or patches — paid or free, security or non-security — coming for specific products. CNET says there are some temporary workarounds, as Windows XP users have discovered, but as a general rule, end of support means, for most intents and purposes, the end.

Here are some critical (or not so critical) dates. You may want to circle in red on your calendar and start planning now. Do you have funds in your 2020 capital budget for new hardware? Will cloudifying these be the answer? Are you up to speed on Azure? Are your apps up to speed on Azure?

September 14, 2014 mainstream support ends Windows Phone 7.8.

October 14, 2014, is a critical date, support ends for

Office 2010 (Including Viso and Project) with Service Pack 1 mainstream support ends.
SharePoint Server 2010 Service Pack 1 mainstream support ends

January 13, 2015, is a big day for Microsoft support

Windows 7, Mainstream, free support ends on for all versions of Windows 7 (Enterprise, Home Basic, Home Premium, Ultimate, and Starter) as well as Windows 7 SP1.
Extended support for Windows 7 lasts until January 14, 2020, so users can expect to continue to receive free security updates, but not feature updates, for Windows 7 until that point.
Some industry watchers have speculated that Microsoft will end up pushing out Windows 7’s support dates the way the company did for XP, given Windows 7’s popularity and pervasiveness, but so far, CNET says there is no evidence of it happening.

Windows Server 2008 – Mainstream support also ends on all versions of Windows Server 2008 and 2008 R2. Extended support remains in place until 2020.
Exchange 2010 – Mainstream support will also end on all versions of Exchange 2010. Extended support remains in place until 2020.

Other Microsoft products whose mainstream support ends on January 13, 2015 include :
- All editions of Windows Storage Server 2008,
- Dynamics C5 2010,
- NAV 2009 and NAV 2009 R2
- Forefront Unified Access Gateway 2010 with SP3
- Visual Studio 2012
Microsoft recommends its customers to get updated, “Customers should migrate to the next available Service Pack to continue to receive security updates and be eligible for other support options.”

July 14, 2015, Microsoft’s extended support period for Server 2003 cuts off (I covered the end of 2003 here). MSFT won’t be issuing patches, updates, or fixes of any kind for that operating system (unless users have pricey Custom Support Agreements in place). Redmond is hoping to move 2003 hold-outs to Windows Server 2012 R2 and/or Azure.

October 13, 2015, is another big deal day

Office 2010, Visio 2010, Project 2010 — Mainstream Support ends. Extended support should run into 2020.
SharePoint Server 2010 — Mainstream support ends. Extended support should run into 2020.

April 11, 2017 – Extended Support ends for Windows Vista ends. No more updates. Time to upgrade (rb- if you haven’t already moved on).

August 11, 2017 – Extended Support ends for Exchange Server 2007. No more updates. Time to upgrade.

January 10, 2018, Mainstream support for Windows 8.1 ends for all versions of Windows 8. Customers still running Windows 8 have until January 12, 2016, to update to Windows 8.1 in order to stay supported.

rb-

Remember this – running out-of-date software which no longer receives security updates is playing into the hands of online criminals and hackers.

Microsoft warns of pending support deadlines for Windows 7, Office 2010 SP1, Windows Server 2003 and more (zdnet.com)

Ralph Bach has been in IT long enough to know better and has blogged from his Bach Seat about IT, careers, and anything else that catches his attention since 2005. You can follow him on LinkedIn, Facebook, and Twitter. Email the Bach Seat here.

Category: Uncategorized | Tags: 2003, 2008, 2012, 2014, 7, 8, Azure, EOL, Exchange, Microsoft, MSFT, Patch Tuesday, Patching, Security, Server, SharePoint, Visio, Windows, XP

RB | July 29, 2014

Comments Off

Clock Ticking on Windows Server 2003 Deployments

Now that everybody has worked Windows XP out of the PC fleet (LOL), another Redmond deadline looms. Microsoft (MSFT) will be ending all support on the venerable workhorse of many organizations, Windows Server 2003. Windows Server 2003 (and R2) will cease to be supported by Microsoft on July 14, 2015. Yeap that is less than one year.

Paul Mah at FierceCIO explains that Windows Server 2003 will be end-of-support phase on July 14, 2015, and will no longer be updated with security patches and bug fixes. He points out that companies that continue to run Windows Server 2003 July 14, 2015, will start to fail standard compliance audits. Regulations such as HIPAA, PCI, and SOX require regulated industries to run on supported platforms. Michael Cobb at SearchSecurity reminds us that most compliance and regulatory standards consider running end-of-life software as a control failure.

FierceCIO estimates that custom support agreements for Windows Server 2003 will have a hefty price tag of $200,000 per year. The article quotes Brad Anderson, Microsoft corporate vice president of Windows Server and System Center, “If new issues do happen to be found, the only way to receive additional updates will be through a custom support agreement.”

Compliance considerations aside Windows Server 2003 would have been in operation for 12 years at that point. The article says companies that continue to use an unsupported platform could find support for some server applications suspended–including all Microsoft applications.

Microsoft is expecting a large number of existing deployments to be migrated to its latest Windows Server 2012 platform. This mandatory migration could help MSFT with its market share against is virtual nemesis VMware (VMW). Mr. Anderson says a lot of Server 2003 machines need to be upgraded.

The fact of the matter is that there is a significant amount of Windows Server 2003 to upgrade around the world. We estimate that there are more than 15 million physical servers that are likely to be upgraded over the next 12 months.

Migrating millions of servers to Windows Server 2012 gives Microsoft’s virtualization technology, Hyper-V, a big boost, noted eWeek. This is because Windows Server 2003 doesn’t have any virtualization technology baked in, unlike Server 2012 which comes with Hyper-V for support for up to 1,024 active virtual machines (VM) and up to 1TB of memory per VM.

The clock is ticking though for companies looking to make the switch. The FierceCIO article reports the average Windows Server migration takes 200 days. This means that organizations looking to get started very soon, or risk running out of time.

Over at SearchSecurity, Michael Cobb, CISSP, offers a starting point for migrating from Windows Server 2003.

Start now – Mr. Cobb warms that phasing out Windows Server 2003 will be a complicated process there are choices that must be made that will affect infrastructure strategies for the foreseeable future.

Hosted Services – Organizations using hosted services will have no choice but to update their legacy software. Mr. Cobb says providers will ultimately force customers to upgrade from Windows Server 2003 so that they can continue to provide the support and security promised in their service-level agreements.

Enterprises have a couple of upgrade options when it comes to retiring Windows Server 2003 according to Mr. Cobb.

Changing from Windows to a Unix-based OS won’t really be an option for many enterprises, as their key applications will only run on a Windows machine. Because application compatibility and a lack of in-house skills are likely the overriding issues, Unix is not an option for most companies.

application compatibility and a lack of in-house skills

Going to Windows Server 2012 – While it is the latest Microsoft server OS, it can’t run 16-bit Windows-based applications, and 32-bit applications must be run in an emulator, making this option also unattractive because of compatibility issues according to the author of www.hairyitdog.com.

Windows Server 2003 x64 Edition – Enterprises already running 64-bit applications should consider upgrading their hardware and moving straight to Windows Server 2012.

Windows Server 2008 – Since Windows Server 2003 servers are likely to be running on old hardware, this upgrade route — while cheaper short-term — will probably just delay legacy hardware and software issues to a later date as both will need replacing prior to 2020 when Windows Server 2008 reaches the end of its extended support period.

SearchSecurity offers these starting points:

Start rewriting old applications now so the inevitable problems and errors can be sorted out. It is also a great opportunity to not only improve security and stability but also add much-needed new features to enterprise systems.

Contact vendors now about 64-bit versions of key application software. If vendors have no plans to offer application upgrades, it’s time to start searching for replacements. Legacy software is always an attractive target for hackers, particularly if it is no longer supported by the original vendor.

Rewriting applications and upgrading licenses and hardware is complex, time-consuming, and costly, but vulnerable systems and data could ultimately be even more expensive. CISSP Cobb warns that doing nothing is not an option. Enterprises must start planning their migration strategies now to avoid making hasty decisions once the reality of unsupported software has already disrupted operations.

rb-

Will the last-minute scramble to migrate from the Windows XP repeat itself all over again? To quote the immortal Yogi Berra, will it be déjà vu all over again.

The rule of thumb for successful migrations is to plan ahead, be thorough, and don’t wait until the last minute if it can be avoided. Despite this fact, a survey by AppZero found that:

57% of Microsoft customers are still running WS 2003
94% of those running WS 2003 intend to migrate, but only 24% are ready to do so
40% not sure of upgrade path

Microsoft Warns of “Weird Things” When Moving Away from Windows Server 2003 (news.softpedia.com)

Category: Uncategorized | Tags: 2003, 2008, 2012, 2014, EOL, Hyper-V, Microsoft, MSFT, Security, Server, VMware, Windows

RB | December 29, 2012

Comments Off

Smart TVs Dumb Security

When a device gets connected to the web without any security it leaves the users vulnerable. This is a trend as the Internet of Things evolves. In this case, Samsung Smart TVs seem to have no security, a dumb TV. Dailywireless.org reports that 40% of Americans have connected their TV to the Internet.

At the same time, The Security Ledger is reporting that a “Security Hole in Samsung Smart TVs Could Allow Remote Spying.” The Malta-based firm ReVuln, says it has uncovered a remotely exploitable security hole in Samsung Smart TVs. If left unpatched, the vulnerability could allow hackers to make off with owners’ social media credentials. Attackers could also spy on those watching the TV using compatible video cameras and microphones.

ReVuln is a security research firm that offers information on security holes it discovers only to subscribers. However, it did confirm the previously unknown (“zero-day”) hole with Security Ledger. The zero-day affects Samsung Electronics Co. (005930) Smart TVs running the latest version of the company’s Linux-based firmware. It could give an attacker the ability to get access to any file on the remote device, As vulnerable are external devices (such as USB drives) connected to the TV.

In an Orwellian twist, the hole could be used to use cameras and microphones attached to the Smart TVs. Granting remote attackers the ability to spy on those viewing a compromised set. Luigi Auriemma of ReVuln told ComputerWorld via email, “If the attacker has full control of the TV … then he can do everything like stealing accounts to the worst scenario of using the integrated webcam and microphone to ‘watch’ the victim.”

Security Ledger says that the Smart TVs offer no native security features, such as a firewall, user authentication, or application whitelisting. More critically: there is no independent software update capability, Which means that, barring a firmware update from Samsung, the exploitable hole can’t be patched without “voiding the device’s warranty and using other exploits,” ReVuln said.

The company posted a video of an attack on a Samsung TV LED 3D Smart TV online. It shows an attacker gaining shell access to the TV. Copying the contents of its hard drive to an external device and mounting them on a local drive. This gave them access to photos, documents, and other content. ReVuln said an attacker would also be able to lift credentials from any social networks or other online services accessed from the device.

rb-

There is no patch for people. Until there is, Smart TV users will have to wait for Samsung to fix this huge security hole or fix it for themselves and risk voiding their warranty. Smart TV with a complete lack of security features, Smart TV Dumb Security.

Samsung Developer Conference Showcases New Smart TV Tools and Policies for Developers (news.samsung.com)

Category: Uncategorized | Tags: 2012, Internet of Things, Linux, Samsung, Security, Smart TV, Vulnerability

RB | December 27, 2012

Comments Off

F-Secure Top Security Predictions for 2013

As the new year looms, all kinds of firms start making predictions, mostly to boost their sales next year, I will be looking at a number of firm’s predictions for next year, a let’s see how smart they are this time next year. Here are the top security predictions for 2013 from Finland-based F-Secure Labs shared with Help Net Security.

1. The end of the Internet as we know it? – Secure Labs predicts that the ITU WCIT in Dubai could mean the end of the Internet (which I covered here and here). Sean Sullivan, Security Advisor at F-Secure Labs says that the World Conference on International Telecommunications could have a major impact on the Internet as we know it. “The Internet could break up into a series of smaller Internets,” Sullivan says. “Or it may start to be funded differently, with big content providers like Facebook and Google/YouTube having to pay taxes for the content they deliver.”

rb- WCIT has concluded with the U.S. and most of Europe refusing to sign the treaty due to language backed by Russia and China that could have large-ranging impacts on Internet freedom.

2. Leaks will reveal more government-sponsored espionage tools – “It’s clear from past leaks about Stuxnet, Flame, and Gauss that the cyber arms race is well underway,” says Mikko Hypponen, Chief Research Officer at F-Secure Labs. While we may not always be aware of nation-states’ covert cyber operations, we can expect that governments are more and more involved in such activity.

3. Commoditization of mobile malware will increase – The Google (GOOG) Android operating system has solidified in a way that previous mobile operating systems haven’t, extending from phones to tablets to TVs to specialized versions of tablets. The more ubiquitous it becomes, “the easier to build malware on top of it and the more opportunities for criminals to innovate business-wise,” Sullivan says. Mobile malware will become more commoditized, with cyber-criminals building toolkits that can be purchased and used by other criminals without real hacking skills. In other words, malware as a service, for Android.