XP Attracts Twice More Attacks than Windows 7 and Vista Combined for Microsoft Vulnerabilities

Attackers targeting vulnerabilities in Microsoft software have a definite preference for a decade-old operating system released in 2001. Windows XP, the platform that continues to own the lion’s share of the operating-system market, attracts twice as many attacks targeting Microsoft vulnerabilities, compared with Windows 7 and Windows Vista combined, according to statistics shared by the Redmond company via volume eight of the Microsoft Security Intelligence Report (SIRv8). XP accounted for 64.46% of the OS market at the end of March 2010, Net Applications revealed, while Vista had 16.01% and Windows 7 10.23%.

Microsoft analyzed exploits attempted through websites in the second half of 2009, and concluded that users were better off running Windows 7 or Vista, rather than XP. “Every browser-based exploit can be traced to a vulnerability in a specific piece of software. Comparing exploits that target Microsoft software to third-party exploits (those that target vulnerabilities in software produced by other vendors) suggests that the vulnerability landscape of Windows Vista and Windows 7 is very different from that of Windows XP,” an excerpt from SIRv8 reads.

Market share aside, both Vista and Windows 7 contain a number of security enhancements that lack in XP, making the OS Microsoft released in 2001 a better target for attacks. Not only have Vista and Windows 7 been built with the advantages of the Security Development Lifecycle, but they feature mitigations such as UAC, PatchGuard, DEP and ASLR, making vulnerabilities harder to exploit, even if they exist.

The vast majority of attackers targeting XP users are attempting to exploit Microsoft vulnerabilities. The same is not valid for Windows 7 and Vista. The Redmond company did warn that, as it was bulletproofing Windows, attackers would shift focus to third-party products as avenues to compromise computers.

“In Windows XP, Microsoft vulnerabilities account for 59.2 percent of all attacks in the sample. In Windows Vista and Windows 7, the proportion of Microsoft vulnerabilities is significantly smaller, accounting for just 24.6 percent of attacks in the sample. Although lower than the total for Windows XP, this total is up from 15.5 percent in 1H09,3 due to increased attacks on CVE-2009-0075/MS09-002, a vulnerability in Internet Explorer 7 that affects Windows Vista RTM and SP1 (but not Windows Vista SP2 or Windows 7),” the company adds.