Thousands of Windows 7 computers could be at risk of cyber attack

The Windows 7 end-of-life date is January 14, 2020, meaning users and system administrators have just three months to upgrade their devices if they want to keep receiving patches and security updates from Microsoft.

After the Windows 7 end-of-life deadline, organizations and individuals who stick to the obsolete operating system will be at increased risk of being targeted by malicious hackers and cybercriminals. And according to usage data, many devices will be exposed to threats.

Following several statements and warnings from Microsoft, prompting users to upgrade to newer versions of Windows, the past months have seen a growth in Windows 10 adoption. However, Windows 7 still remains very popular.

According to data from NetMarketShare, 28% of computers were still running Windows 7 in September 2019. There are more than one billion Windows devices around the world, so this will put hundreds of millions of devices at risk.

Microsoft ended mainstream support for Windows 7 in 2015. After that, it entered the extended support period, where the operating system receives critical security updates, but no new features.

After January 2020, enterprises can still apply for extended support for the OS, but it will cost them $25 per device per year.

Support for Windows Embedded systems will continue

Microsoft still hasn’t declared an end-of-life deadline for Windows Embedded 7, the stripped-down version of the OS that runs on embedded systems such as point-of-sale terminals, ATMs and gas pumps.

Embedded systems typically have longer lifecycles than workstations, laptops, and other generic computing devices. As such, they are expected to run on the same hardware and software for many years, so an upgrade might be out of the question.

This is important since embedded systems are often the targeted in ransomware attacks.

According to Microsoft, extended support for Windows Embedded Standard 7 Service Pack 1 will end in October 2020, while it will continue to support other Embedded versions into 2021 and beyond.

Sysadmins have just three months to upgrade to Windows 10

Old OSes die hard

In May 2017, criminal hackers exploited EternalBlue, a vulnerability in the Windows SMB file sharing service, to spread the WannaCry ransomware to more than 230,000 computers in over 150 countries.

Microsoft had issued a patch for the vulnerability in April for all supported versions of Windows.

But at the time of the WannaCry outbreak, many computers were still running Windows XP, which had expired its extended support cycle in 2014. (Luckily for Windows XP owners, the worm that spread WannaCry caused their computers to crash before installing the ransomware.)

Microsoft had to issue critical updates to XP and other obsolete Windows versions to protect their owners against EternalBlue.

More recently, in August, Microsoft issued another critical update for Windows XP to patch a critical security bug in the Remote Desktop service.

Old OSes die hard, especially popular ones. Windows 7 will retire in three months, but if past is prologue, it won’t be the last we hear about it.