Many PC users are content to let their hardware and software become outdated and obsolete if only because it still runs, so why update it; or as the old adage goes: “If It Ain’t Broke, Don’t Fix It”. Unlike a refrigerator or a washing machine, outdated computer components leave you vulnerable to attacks by various internet threats. In this blog post, I will be discussing the potentially dangerous things that can happen to a user when they do not take the time and effort to update and upgrade their systems and how it can leave them vulnerable and unprotected. In addition, I will discuss the importance of keeping an updated system and how by updating your system, you give Malwarebytes Anti-Malware the power it needs to keep you safe.
Threat
There is nothing wrong with being afraid of change. New updates and new operating systems with new hardware means that you may need to setup another system “just the way you like it” and that can seem like a daunting task to some users. The thing to realize is that every single day that goes by without updating or upgrading your system increases your vulnerability to and likelihood that you will be infected with malicious software. The threat is very real and while it might seem like attackers are only going after sensitive data for high profile targets on modern operating systems, there is actually more malware out there that is designed to infect legacy systems belonging to the average user. As said by our Product Manager, Samuel Lindsey:
“The recent Blackhole exploit is a prime example of such an attack. It deliberately only targets machines which have an outdated version of Internet Explorer (version 6) and if the PC has a newer browser, it looks for exploitable, outdated versions of Java or Flash to exploit. The malware makers have deliberately crafted this threat to only target those systems, so PC’s with newer versions of their browser (IE 7 or later) and fully up to date plugins won’t even be targeted. The exploit will literally skip them, not even attempting to run on those machines.”
If you have been following the news at all, you would know that the Blackhole Exploit pack is one of the most commonly used tools to infect user systems by exploiting the browser, being found not only on shady websites but also through malicious ads shown on legitimate pages or used in conjunction with phishing scams through e-mail or social media. As Samuel said, the attackers are targeting those users who are using the out dated software because there are so many of them. Using Windows XP with service pack 2 (an outdated version of Windows no longer supported by neither Microsoft or Malwarebytes Anti-Malware) and IE 6 makes you nothing but another potential victim living in the sea of targets which these attackers fish from.
Even your hardware and networked devices are at risk, since attackers can target older systems that have known vulnerabilities at the hardware level, making it possible for them to install malware at a level below what the Operating System and therefore Anti-Malware/antivirus products can see. In addition, vulnerabilities found in older routers can be used to monitor the traffic of the user and steal information or even reroute the user to use malicious DNS servers and visit malicious web sites or give up their sensitive data without ever knowing they are being monitored. This particular type of attack happened with the recent DNSChanger malware which accomplished a similar goal by modifying a users DNS settings, routing everything they did online through malicious servers.
Businesses face the same problems as the users, when they usually buy in bulk and do not factor in the costs of upgrading their systems every few years. The use of an IT department to update each client with of the most up to date software helps, however, the fact still remains that a company which might have hundreds or thousands of systems located on their network might still using an outdated or unsupported operating system and legacy hardware, making them prime targets for attackers to beak in and steal information not only about the employees but about the customers as well.
Answer
The answer to this problem can be very simple and cheap or difficult and costly, it really depends on how outdated your system is. Software vendors do their best to support users who use older operating systems and provide them updates to patch holes that might not even exist with newer products, however they cannot do that forever and will eventually stop supporting those users. As Samuel Lindsey puts it:
“…their old Windows XP machine has been chugging along just fine without Service Pack 2 (or Service Pack 3) and their old version of IE or Firefox works just fine, as does the ancient version of Flash, MS Office, Java and any number of other dated software they might have installed on their systems. They also often feel that newer software only offers ‘bells and whistles’ that they don’t need, not understanding that the malware landscape is constantly evolving, and their software, especially their operating system, needs to evolve with it in order to be safe.”
If your system is powerful enough to run the most modern operating system, go out and purchase it. If it isn’t, then you should go down to your local computer store or shop online and buy a new system, when that happens you will most likely get the newest operating system and any updates you might need with the new computer you just purchased.
You might be thinking that it is too expensive to spend money on something like updating, think of it from a cost/risk point of view. You could drive an older car that predates safety standards and does not have airbags or seat-belts and you might not ever get into an accident, however you still take the risk of getting into an accident every time you drive and you would not be protected by the safety tools used by modern vehicles. In the same way, computer hardware and new software is always being developed with new types of “safety tools” which keep your information safe and your computing experience secure from malware and attackers. So would you rather spend your time and money keeping you and your family protected from threats or run the risk of your personal information, login credentials and bank information being compromised or even having your identity stolen?
The Power
Updating and upgrading your system gives Malwarebytes Anti-Malware the power to keep your system safe. Do not think that since it is only a piece of software that it matters what operating system running it. Operating systems that are more modern allow Malwarebytes Anti-Malware to fight malware at deeper levels than say Windows XP. In addition, security holes and low resources are common within older and outdated OS’s, so much so that it allows malware to undermine any attempts to get rid of it by hiding at deeper levels and being able to control the operating system like a sock puppet. Here is a graphic I created to help illustrate this point:
Thank you http://ragemaker.net
Also, there is no scientific link between the use of outdated software and handlebar mustaches.
This principal applies not only to just Malwarebytes Anti-Malware but also to any protection software you may employ. The threats are very real and while it might seem right to put the safety of your information in the hands of software only, the security industry relies upon you, the user, to use a platform that allows security products to do their jobs well.
Conclusion
If you have kept up with my blog posts, you might see a recurring theme popping up, which is the fact that computer security does not just mean security software but also the employment of security practices by the user. Some companies might tell you that their product is the “end-all-be-all” in computer security, that you will never be infected with malware or attacked by crackers and scammers. Here at Malwarebytes, we want to keep our users safe and in doing so we advise our users to use more than just our product for their Anti-Malware needs, in addition we want our users to learn about how to keep themselves safe beyond the reaches of just software; we encourage the use of common sense and vigilance to stop threats before they even have a chance to reach the system and in doing so, reduce the possibility of becoming a target.
