Microsoft has been slamming the US Government over the global WannaCrypt cyberattack, but some would say it’s trying to deflect the blame. Former GCHQ head Sir David Omand has criticized the company for its withdrawal of Windows XP support.
Speaking to the The Times, Omand said Microsoft knew that the move would hurt users in 2014. Private and public bodies are still reliant on the OS, with between 5 and 8 percent, more than Vista or 8.
“Should Microsoft have stopped supporting Windows XP so soon, knowing that institutions had invested heavily in it?” Omar asked.
So far, the WannaCrypt ransomware has targeted more than 230,000 computers running Windows in 150 countries. It uses exploits stolen from the NSA such as ETERNALBLUE.
A particularly bad case was the UK’s National Health Service, which lost access to patient data in 47 trusts. 4.7% of NHS PCs are currently using XP, including MRI machines.
The NHS and Windows XP Licensing
There is a counter argument for Omar’s point, which is Microsoft’s offer to extended support agreements with organizations. Though costly, they do ensure computers get all of the relevant security updates.
The UK government made a decision not to renew support agreements, despite warnings that without migration the OS would be open to attack. Recent Sky News probes suggest the NHS spent nothing on cyber security in 2015.
However, Omand also criticizes the amount of time it took Microsoft fix the exploit on XP.
“It would have been better if it had been released a month earlier, when the company first became aware of the problem,” he said.
Though Microsoft fixed the vulnerability in newer systems in March, Omand claims Microsoft didn’t release protection for XP until after the attack began. Though proper support agreements may have mitigated the attack somewhat, it’s unclear if they would prevent it completely.
In a blog post on Monday, Vice President Brad Smith called for governments to stop stockpiling exploits at the expense of regular users. He called once more for a Digital Geneva Convention and an agreement to protect civilians from nation state attacks.
