As Windows XP support ends, are 'XPocalypse' reports overblown?

Microsoft has officially stopped providing support and security updates for XP, its ubiquitous 13-year-old operating system.

The "XPocalypse" officially began on Tuesday 8 April when support officially ended, but security companies have repeatedly warned of the inevitability of a zombie army of hacked XP machines that will stalk the internet, dooming us all.

Except that nobody seems particularly worried. The businessman Derek Olsen wasn't even aware that Windows XP had reached the end of its life, and the computers running it at his company, Olsen Environmental in Perth, Australia, still seem fine. "We've got four or five running it, and six or seven PCs running Windows 7," he says.

Nor are the ones running XP antiquated: "All our PCs are less than four years old. We grabbed some ahead of them stopping selling models with XP." There are no compatibility issues, he says.

The 18-strong company is typical of hundreds of thousands – perhaps millions – of small businesses around the world. There are an estimated 430m PCs still running some version of Windows XP, first released in 2001, and whose last formal Service Pack 3, released in April 2008, is approaching its sixth birthday.

Olsen says the only difference he's noticed is that "the spam levels have picked up a bit, but we haven't seen anything else relating to XP." The programs the company is using – AutoCAD, Microsoft Office 2003 and 2007 – to provide engineering and technical services are still functioning fine. "There's no call to update," says Olsen. "Windows 7 doesn't offer any particular features we need. We're looking for stability and reliability. This stuff runs seamlessly. The only annoying thing is the dialogue boxes telling us to update our version of Office. That's annoying." But in general, he says, the approach is that "if it ain't broke, don't fix it."

Removing the limpet

Another corporate user who got in touch with the Guardian, from a much larger organisation with tens of thousands of PCs around the world, said that despite a long-running effort it still has hundreds of machines.

They're used in complex manufacturing and calibration systems: "the equipment is not old but the software is," they said. But it would be "complex to upgrade" the remaining systems, and persuading the company to make the investment has been hard: "Business users do not generally understand the IT risk to business continuity."

And XP is limpet-like. Netmarketshare puts XP's share this month at more than 27% of all desktop operating systems (compared with 48% for Windows 7, 6.4% for Windows 8 and 4.9% for Windows 8.1); Statcounter, which uses a slightly different methodology, puts it at 54.9% for Windows 7, 17.8% for XP, 7.9% for Windows 8 and 5% for 8.1.

Many of those are probably in businesses: a survey by Spiceworks found that 76% of IT professionals run Windows XP on some devices today, and of those, 36% will leave Windows XP on at least one device as the operating system EOLs; 96% of IT professionals said they’re running Windows 7 on their network today; of those IT professionals who still run Windows XP on company desktops and/or laptops, 49% plan to upgrade at least some of their devices to Windows 7. Only 7% of these IT professionals plan to upgrade to Windows 8 or 8.1. (This leaves 8% apparently undecided about what they will do, or perhaps migrating to Mac OSX or Linux - though the former seems more likely.)

When asked why they haven’t already migrated their company’s XP devices, the IT professionals cited lack of budget (55%), lack of time (39%), and lack of resources (31%) - the latter being the problem that the person quoted above had found.

Cheapest option

Some are moving: "our company stuck with XP because it was the cheapest option," said Richard Blechinger, who works at ncm.at, in Salzburg, Austria. Now the 30-odd machines, mostly around three or four years old, are being upgraded to Windows 8.1. "The move is mostly painless," Blechinger reports. "The people are complaining about the user interface, but otherwise it all worked out well so far."

Even so, XP's resilience has Microsoft, and security researchers, worried: they argue that the end of support means that XP users are now wide open to the next security vulnerability discovered in XP's base code, or Internet Explorer, or the widely-used Adobe Flash software. With Microsoft no longer patching the OS, the effects could be dramatic. Couldn't they?

"For home users, it comes down to a lack of awareness around the fact that sticking to Windows XP effectively opens a backdoor to their PCs," says Paul Martini, chief executive at Iboss Network Security. "This means, hackers can gather their data, such as email, bank details and use that data at their own will.

“For enterprise, the delay comes down to five core things; cost of the upgrade, activation of the migration path, risk of data loss during the migration and lack of security awareness and in some cases security inertia.

“While updating security hot fixes are a core component of cyber security protection today, they are not a silver bullet. Cloud and mobile opened up thousands of new ways to break security defences, so the shift to closing specifically known holes isn’t as attractive as before."

Certainly governments are taking the end of support seriously: the UK and Dutch governments are paying millions of pounds while they shift their systems to something newer – almost certainly Windows 7, which offers better security while also having compatibility with pretty much anything that runs on XP.

But for many small businesses, the process of shifting from XP is too much hassle. Ditto for users, who don't like the idea of spending on a new computer and then having to shift their files over from an old machine.

What about the ATMs?

One of the commonly heard warnings is that huge numbers of bank ATMs run on Windows XP. This, a number of security companies have suggested, means that everyone who uses an ATM might be at risk of being hacked - or that banks might be, by some clever hacker typing code into an ATM.

But that theory is quickly shot down by Ian Byrne, head of UK banking for Wincor Nixdorf, which makes ATMs. "Working with Microsoft, the industry has embedded a version of XP particularly for ATMs," he explains. "We have a security set for locking down access." Have there ever been any instances of an XP ATM being hacked? "Not that I'm aware of," he says.

Byrne says that the fears about ATM hacking are overblown. "Look at the context. On a normal PC, people are doing email and Office and web browsing. An XP ATM doesn't have common external connections, and it's pretty well locked down." Only three or four of the 65,536 "ports" that Windows XP offers to the world are typically open on an ATM, he says: "So that exposure, to start with, is much, much more limited." And they don't connect to banks over the open internet; they use dedicated leased lines.

As for upgrading to Windows 7 (or even 8), Byrne says "there's no business driver or external functionality in Windows 7 to make it a compelling case. The only thing here is that the software vendor has announced the EOL. We haven't seen any business benefit in shifting." Banks need to see a business reason – not just vague worries – to invest in an expensive, time-consuming and potentially customer-frustrating upgrade.

Even so, Byrne reckons that they will move to an embedded version of Windows 7 for ATMs over the next 18 months or so. But he doesn't think criminal gangs will be hacking into them.

Even so, the risk of a flaw being found in XP exists; and the fact that there are so many machines out there, ostensibly without support, means that hackers are sure to be targeting them more rigorously.

Extended support - but no extension to consumers

Of course the governments and businesses which are paying Microsoft thousands of pounds per machine for "extended support", which lasts another year, should be secure. But this raises a moral hazard for Microsoft.

As one business user commented to me, "This, I think, presents an interesting PR challenge for Microsoft. In the event of an XP flaw which is exploited they will be developing and releasing patches to large corporates who pay them big sums of money while letting home users and small business hang out to dry. They are bound to come under pressure to release patches they have already coded to the general public. But that would not play well with the corporates funding the custom support program."

Asked about this head of the end-of-life date for Windows XP, Microsoft told the Guardian: "After 8 April Windows XP users will no longer receive new security updates, non-security hotfixes, free or paid assisted support options, or online technical content updates from Microsoft.

"PCs running Windows XP after 8 April, 2014 should not be considered to be protected, and it is important that consumers migrate to a current supported operating system such as Windows 8.1 so they can receive regular security updates to protect their computer from malicious attacks.

"Custom Support is provided to large customers whose migration from Windows XP will not be complete by 8 April, 2014. It is not an extension of support. It is a temporary measure designed to help large customers with complex migrations. It should be considered as a last resort for customers in the process of migrating from Windows XP to a modern operating system.

"Our guidance to consumers is to move from Windows XP as soon as they can and ideally before support ends on April 8 2014. We provide a range of resources and tools for consumers, include an upgrade advisory tool to see if their current PC can be upgraded, a free tool to move their files and settings from Windows XP to Windows 7 or Windows 8.1 and other resources and tutorials to ease the migration."

It's hard to square the expectation that large organisations and governments have that any security flaw will be patched with the phrase that they are not getting "an extension of support". But the message is clearly: those who pay will get the fix; you will not.

As the business user commented, "Microsoft can't win either way." Another concern is that up to 200m of those Windows XP machines are based in China, using faked licences; there might not be any way of upgrading them legally, or of persuading the people using them that they have a problem.

But maybe the message is going to permeate through to some at least. The day after we spoke by phone, Olsen said that the top banner on The Australian's digital edition was a banner ad from Microsoft about the end of XP (and Office 2003) support. Is he going to update? That's still not decided. But at least he knows what's happened.

Which computer should I buy to replace a Windows XP PC?