What are the real risks of End of Life support for Win 7?

[Silky]

I have a really naïve question. Without security updates to patch "holes" what is my real risk in Windows 7? What kind of "attacks" are so imminent? In my experience, most historical attacks occur when a user does something that they should have been more cautious about. That is to say, the best defense is an educated user being prudent with downloads, web sites, scripts, and the like. Other than that, what are the risks of not getting security updates/patches?

Let's start with this. I have a Win7 SP1 HP Pavilion that I use for select purposes. I run my old version of Photoshop, and maybe a legacy program here and there. It is connected to my home LAN with VPN to monitor home security cameras (dedicated IP's on the LAN) and occasionally, but rarely, open a Firefox browser page.

I have Norton Internet Security installed.

So basically, it's a machine on the LAN with shared resources, but not used for downloading or general web browsing.

For those uses, how concerned should I be about end of life support?

 

[file3456]

For those uses, how concerned should I be about end of life support?

I wouldn't worry at all.

Here's my opinion on this updates fallacy. https://www.sevenforums.com/tutoria...ort-full-screen-notification.html#post3456436

 

[Silky]

After reading the link, I'm inclined to agree with your opinion. I'm interested in what dissenters, if any, have to say as well.



Appreciate the input.

 

[Barman58]

Windows 7 is no less secure than it was yesterday - the Microsoft security updates were only issued Monthly,

As time passes there will be several things that will be different. ...

• New threats will appear, due to programming issues that have always been there, unknown in the software. As these become known they may be exploited by criminal or just stupid "hackers" who crawl out of their mom's basement occasionally
  
  
• The scum that write malware for personal gain will be aware that the OS will no longer be patched by Microsoft so will be more susceptible to their attempts so we can expect an increase in these attacks, the next few months may see a rise in Windows 7 targeted malware attacks, as some users will simply not prepare for change and leave their systems open to attacks that Microsoft would have formally protected them from .
  
  
• There will be no updates, officially, to Microsoft security options or applications specifically supplied with Windows 7 such as Internet Explorer, these can always be covered by 3rd party software, a lot of Windows 7 Users already use alternatives, History with other operating systems after end of life suggests that the 3rd Party software developers will, after the initial rush to secure Windows 7 systems, and make a profit, move on to other markets.
  
  
• The same issue with 3rd party software applications means that support for EOL software will reduce support over time as the markets are always likely to be for the supported OS
  
  
• Hardware manufacturers will wind down driver support for Windows 7 over time so that eventually although the OS may still work it will not have any systems suitable to run it

This will not happen overnight, windows Vista is just feeling the pinch, XP is further along the line, no OS will last forever. We are already seeing games and software "Requiring" windows Ten to work and the same is starting to happen for Hardware

My main OS was Windows 7 before it was released to the public, the same applies to Windows 10

A lot of users only have experience with Window 7 Change is never easy, but is inevitable in the IT world

I've been a Pro in the IT Business for many years so am used to change and progress

 

[Silky]

I've been a computing enthusiast since 1985. My first computer was an AST Premium 286 which was the sh*t back then (3.5 in Floppy Drive and all). I've been a part of the whole transition from DOS to every OS released right up to current day. So I get that some people will be terrified at the prospect of "end of life" if they've only used Win7. Myself, I am not. I'm just trying to suss out the real risks of maintaining an older OS.

I hear "new threats are out there" and "systems become vulnerable". But I guess the premise I'm exploring by posting this thread is: Don't go into dangerous neighborhoods if you don't want to risk getting mugged or robbed or worse.

So if someone says, hey, by even being on your own LAN with firewall and router protection, you are still at risk of a malicious security exploit because....(fill-in-the-blank), that's helpful information. But it seems to me that vulnerability is more about behavior. I guess I'm asking, is there anything else?

If you don't mind a little digression, as I was reading F22 Simpilot thread reference I started looking into Sandboxie. I started some research to find out it's capabilities and can it do "this or that". In my research, I saw a few YouTube videos where some of the features were demonstrated. They were showing how you could use Sandboxie to go to these sites, download software, and install it willy nilly, and use Sandboxie to test install. But as I'm watching how these folks work, I see careless approaches to what web sites they visit, what software they download and careless installation. All of this points to behavioral issues - I would never approach computing that way. I also contend that there isn't a security patch in the world that could overcome irresponsible behavior.

I'm not saying anything about Sandboxie or its utility, that's not the point.

So it seems to me that given the posture a person like me takes when it comes to interfacing with the outside world, in concert with the limited use of my Win7 machine, there aren't any real security risks by not migrating that machine to Windows 10.

If the more experienced folks here, or other pundits suggest otherwise, I'm all ears.

 

[file3456]

I said sandbox the browser, not a program. And I probably also said upload ALL downloads to VirusTotal. Along with periodic disk clones you should be good to go. I don't even use an anti-virus. Haven't now for at least 4 years.

You may also want to use Sandboxie for the email client as well. But Sandboxie needs to be congigured correctly so that the browser's profile stays intact and the email client's profile. Otherwise on application close all is deleted. Nothing sticks. That's why if malicious scrips or something gets in your browser or email, it's deleted on exit. It's not perfect, but it's better than nothing.

I use Thunderbird as an email client and I also have it set never to load images by default or parse HTML content. If I get an attachment, depending on what it is, I'll scan it at VirusTotal. If it's a Windows scrip, etc do not download it. It will automatically execute. Files like .zip, etc can be downloaded and uploaded to VirusTotal. Email will look like hell without parsed HTML content and images, but in the long run your safe from a canary token or if you use PGP that won't get comprised, etc.

 

[Silky]

@F22 Simpilot I totally understand what you're saying and how you use sandboxie. And I appreciate the conversation.


What I take from this exchange so far is that in my particular use of the Win7 machine, in concert with my "behavior" with that machine, the end of life issue shouldn't affect me for some time to come.

 

[file3456]

Not really. But if you download something without scanning it and then move that download to this computer you could open a can of worms.

 

[edassange]

There's no reason why you can't continue to get security updates (for free). They are still available for W7 Business and Enterprise users who are willing to pay for them, but it is fairly easy to obtain them for home users at no cost.

 

[Barman58]

I do see an issue with the use of Virus total for checking everything, the way it works is that the user uploads a suspicious file - no problem with the activity, just that a potentially destructive piece of code has to be downloaded to the local system before it is checked and found to be clean, this is a risk, (sandboxing helps ), but not all malware needs to be in the form of an executable, other delivery options are possible,.

I would personally suggest for true protection an antimalware suite should be considered, even the more support that comes with such software when it is not a free giveaway. With a suite more than one form of attack is covered, but most importantly any downloads are checked ans scanned on the way into a system, not on the way out

AS they used to say on TV, "be careful out there"