However, even if these systems are, for whatever reason, running a consumer version of XP which is slated to end extended support on April 8, 2014, they are most likely not connected to the internet and therefore safe from external threats.
That's just the best case scenario anyway. As we saw with the Target breach, they obviously did not have the required network segmentation in place. Any PCI compliant company is going to have their POS terminals running on an isolated network. This is hardly a reason to justify not upgrading though.
When the cost of staying is greater than the cost of moving. For many embedded scenarios, the cost of staying is generally small (just occasional maintenance) and the cost of moving is huge (probably a whole new set of hardware).
One of my clients has a set of 7 or so touchscreen POS systems at a restaurant. They are all older XP embedded machines and the software they run has no upgrade path to a newer OS. It will take somewhere around $20k to put in new computers and do the initial inventory setup.
They do have a good idea of what they would go to if they needed to upgrade tomorrow. It's just currently a no sale, supporting a new system will cost more at this time then the old system.
Can you say if that system would be any more maintainable than the current one, especially e.g. 7-8 years after installation? Do these restaurants update e.g. prices or sales tax rates without outside help? Could they radically change their menu if they needed to do so? Are there forests of sticky notes sprouting from the sides of the machines reminding users how to make the system do what they want? How long does it take for new waitstaff to use the POS without supervision?
Is the current setup PCI-compliant, and will it still be a couple of months from now?
It will hurt everyone with an Internet connection.
MS has filled the World with machines which are full of security holes and which only they can patch, and they've made a mint doing it. I would say it's their responsibility (ethically, not legally) to patch those machines until they stop being a massive threat to the stability of the Internet. I realise that this wont happen though.
But running a company is not about doing the right thing, and Microsoft is not in a good diplomatic position to force an update on people after Vista and Windows 8 have been publicity disasters. I won't blame MS whatever they do, but if I were them, I would try to fix the Windows 8 mess first before risking negative headlines.
Their surface area was "just enough" - they're online in order to run credit cards and early versions of the POS software kept the card details in local files. Once he was into their system, he had access to thousands of cards... when the cards were used fraudulently, it was very difficult to know how it'd been stolen because it was via lots of small breaches that never made the news.
Appropriately for this post... the POS software vendors eventually rushed to be compliant with new security standards (PCI?) and not store those details locally. But the store owners were reluctant to upgrade because the new software versions had an upgrade fee or, even when the upgrade was free, they'd have to pay thousands to their local consultant to actually perform the upgrade.
[1] - http://amzn.com/0307588696 ... Twitter-sized review: Pretty good book and it read like a technology novel at times. Will definitely get you re-thinking where/when your cards are used.
Blaming the Target break-in on the OS security is like having unprotected sex in the back of a Buick, and blaming GM for the STD you contracted because it would've happened if the car hadn't had such a roomy backseat.
[1] http://www.computerworld.com/s/article/9246074/Target_breach...
I don't know how much this will hurt MS with its core users. XP is largely kept alive by users in the East, not the West, and by businesses. The businesses will either pay for additional security or upgrade, and many of the users in Eastern countries don't pay for XP as it is, so what exactly is MS risking here?
MS needs to move on. There is no money in continuing to support a 13-year-old OS. You could argue that MS should make available paid support and security updates, but even OSes like Redhat aren't kept going for 13 years. I just don't get the outrage here.