XP退休可能危及ATM安全
????不過,防惡意軟件公司比特凡德(Bitdefender)的電子威脅高級分析師伯格丹?博泰扎圖卻非常不認同這個觀點。他把這個問題比作一個父親看著他十幾歲的孩子第一次獨自開車上路時的那種擔心。“他們沒慌,而就是這一點讓我非常恐慌。” ????為了考察可能的安全性風險,博泰扎圖經常出沒于地下的黑客論壇。他聲稱,等到微軟正式終止支持Windows XP那一分鐘一過,黑客們就會對不安全的XP機器發動突襲。他說:“當一個操作系統被宣布壽終正寢時,黑客們就會瘋狂地開發它,因為現在他們可以無限利用它,這就像惡意軟件的圣杯。” ????為了利用這種情況獲得最大利益,那些銷售XP攻擊程序的黑市廠商已經開始囤積這些程序,只等微軟不再監控和修補安全漏洞就開始發布它們。雖然第三方安全機構仍會繼續升級XP的防惡意軟件程序,但是沒有安裝這些軟件的用戶可能將持續存在越來越大的安全風險。水星支付系統公司的伯克利也說:“如果一個黑客在XP終止支持的一兩個月后發現了一個弱點,他們就會有更多的時間開發利用這個漏洞。” ????這些攻擊可能包括從小廠商那里竊取信用卡信息,甚至還包括更嚴重的盜竊方式。許多攻擊手法可以輕易地繞開諸如半封閉式的支付網絡等外部安全措施。博泰扎圖表示,已經有報告顯示黑客可以通過連接到ATM讀卡器的手機來攻擊ATM機。另外他還提到了2010年安全專家巴納比?杰克在黑帽安全大會上展示的一項“特技”,當時他輕而易舉地偷光了一個基于XP系統的ATM機里的所有現金。博泰扎圖表示,杰克(死于2013年)生前從來沒有透露這項攻擊手法的性質,這也就意味著這個漏洞可能仍然存在基于XP的ATM機里。 ????博泰扎圖認為,最令人擔憂的是,各種不安全的XP電腦可能會被黑客改造成新的僵尸網絡。在這種情況下,被攻擊的系統的處理器會被種下連電腦的所有人都不知道的任務,從發動大規模的阻斷攻擊,到竊取像比特幣這樣的數字貨幣,幾乎沒有什么不能做的事情,而且最終會大大加深對整個互聯網的風險。博泰扎圖警告道:“我看到很多麻煩。” ????4月9日到底會不會迎來一場ATM機的吐錢瘟疫,把許多電腦變成僵尸,或是竊取信用卡讀卡器,現在還不得而知。博泰扎圖似乎光是想想這些可能的情形就很惱火,他說:“這個操作系統是13年前發布的,大家應該從兩三年前起就開始升級了”,以避免現在微軟終止服務帶來的一窩蜂的升級。他希望今天的這一幕至少能讓用戶長遠地考慮一下未來。 ????博泰扎圖說:“這個問題很快也會在其它操作系統上發生,現在應該開始從Windows 7升級到其它系統了。”(財富中文網) ????譯者:樸成奎 |
????But Bogdan Botezatu, senior e-threat analyst for the anti-malware software company Bitdefender, couldn't disagree more. He talks about the issue with the barely suppressed terror of a father watching his teenage son drive solo for the first time. "They're not panicky," he says, "and actually that makes me panicky." ????Botezatu, who haunts underground hacking forums to keep an eye on looming security threats, claims that hackers are gearing up to raid suddenly insecure XP machines the minute Microsoft support ends. "When an operating system is announced as reaching its end of life, [hackers] are frantically looking for exploits, because then they can use it indefinitely," he says. "It's the holy grail of malware." ????To take fullest advantage of the situation, black-market vendors selling new XP exploits have been stockpiling them, waiting to release them until after Microsoft is no longer monitoring and repairing security flaws. Though third-party security firms will continue to update anti-malware programs for XP, users not running or updating such software could be permanently vulnerable to an ever-growing set of exploits. Mercury Payment Systems' John Berkeley confirms that "If a hacker discovers [a vulnerability] a month or two after the end of [XP support], they have more time to exploit that." ????These exploits could range from stealing credit card information from small vendors to even more dramatic forms of theft, many of them easily circumventing external security measures such as the semi-closed payments network. Botezatu says there have been reports of an ATM exploit through a mobile phone connected through an ATM's card reader. He also cites a legendary stunt by the security expert Barnaby Jack at the Black Hat security conference in 2010, where he demonstrated a "Jackpotting" hack that easily emptied an XP-based ATM machine. According to Botezatu, Jack, who died in 2013, never revealed the nature of this exploit, meaning that it could remain an unpatched vulnerability in XP-based machines. ????Most troubling of all, Botezatu predicts that unsecured XP machines of all kinds will be compromised by hackers to form new botnets. This kind of system, in which hacked systems' processors are put to new tasks unbeknownst to their owners, can be used for everything from massive Denial of Service attacks to mining cryptocurrency, and would add substantially to the insecurity of the Internet as a whole. "I see a lot of trouble," Botezatu warns. ????Whether April 9th brings a plague of cash-spewing ATMs, zombie PCs, and thieving credit-card readers remains to be seen. But Botezatu sounds exasperated that he even has to consider these scenarios. "It's an operating system that was released 13 years ago. Everyone should have started migrating two or three years ago" to avoid the mad rush and risks that come with the end of support. He hopes, at least, that this episode will motivate today's users to think about the future. ????"This is going to happen soon with other operating systems," Botezatu says. "You should start upgrading from Windows 7 now." |