Windows XP support ends April 8, RBI warns banks on ATM operations

Banking operations, including ATM services ,may

 be hit as support from Microsoft for Windows

 XP operating system will end from April 8.

MUMBAI: Banking operations, including ATM services, may be hit as support from Microsoft for Windows XP operating system will end from April 8, the RBI has said asking banks to take immediate steps to control this.

The end of support for Windows XP is likely to increase the probability of attacks on such a system and may affect ATM operations as well, RBI said.

"The probability of attacks on such a system may increase and it may be difficult to defend such attacks in the absence of Microsoft support," RBI said in a notification addressed to the banks.

Microsoft will stop issuing updates and patches for bugs in its Windows XP operating systems, which was released in 2001, from April 8, 2014.

"As some of your systems, including ATMs, may still be working on Windows XP, you are advised to take immediate steps to implement appropriate systems and controls in this regard," it added.


More than six out of 10 ATM machines in the country will be running on an obsolete operating system when Microsoft pulls the plug on Windows XP support on April 8, raising serious security and compliance issues for the systems' operators.

According to the ATM Industry Association (ATMIA), about 38% of the nearly 425,000 ATMs in the U.S. that are powered by Windows XP will have migrated off the OS by next month's deadline.

Operators of the remaining quarter million or more machines will have an increasingly hard time supporting their systems and ensuring sufficient software security after that date.

The Payment Card Industry Security Standards Council (PCI SSC), which is responsible for overseeing security standards in the payments industry, has already noted that ATMs still on Windows XP after April 8 will need to have certain compensating controls in place to be considered PCI compliant. The PCI SSC estimates that Windows XP powers 95% of ATMs in the world.

"The vast majority [of ATM operators] are aware of the deadline," said David Tente, executive director USA of the ATMIA.

Several financial institutions have worked out, and at great cost, arrangements with Microsoft to keep Windows support available for a while longer, he said.

In many cases, upgrading an ATM's operating system involves physical access to the machine and about one hour's worth of labor. Not all ATMs will be ready to migrate to Windows 7 and may need hardware upgrades as well, Tente said.

According to Tente, independent operators run about half the ATMs in the U.S., while large financial networks operate the rest. A "fair number" of installed ATMs are powered by Windows CE and embedded versions of Windows XP, which are not affected by the April 8 deadline, he said.

Microsoft has said that it will cease support for Windows XP after April 8. After that date, the company will stop providing security updates or technical support for Windows XP, an operating system that still has a huge installed base around the world.

Microsoft has pointedly stated that PCs running Windows XP after the end-of-support date should not be considered protected and has urged users of the operating system to move to a newer version as soon as possible.

According to Tente, it's possible that malicious hackers are waiting until after April 8 to attack ATMs and other systems running Windows XP. But just because a system remains on Windows XP after that date does not automatically make it more vulnerable.