Win 98's demise leaves questions about security

Days after software giant Microsoft Corp. announced that it will stop distributing the Windows 98 operating system, and weeks ahead of the scheduled end of support, industry experts warn that the OS (operating system), though long in the tooth, is still widely used within organizations.

However, the operating system's longevity could pose significant security challenges for organizations if Microsoft keeps to its promise to stop issuing security patches in January, prompting companies worldwide to weigh costly jumps to newer Windows versions, security experts and Microsoft customers report.

Microsoft said on Dec. 8 that it is halting further distribution of Windows 98, with the exception of Windows 98 Second Edition, by the end of this month to comply with a legal settlement with Sun Microsystems Inc. over a dispute about the Java programming language.

The Redmond, Washington, company ended no-charge incident support for Windows 98 on June 30 and has long warned that it will discontinue paid incident support on Jan. 16. After that date, Microsoft has no plans to continue producing security patches for Windows 98 even if a virus or worm outbreak targets that platform, according to a company spokeswoman.

Should such an outbreak occur, customers should upgrade to a supported Windows operating system, she said. For those who do not upgrade, information as well as firewall and antivirus software from third-party companies can help protect vulnerable Windows 98 systems, the spokeswoman said.

With more than 39 million copies of Windows 98 installed across the globe, according to research group IDC, the impact of Microsoft's policy on Windows 98 will be felt far and wide.

For Atmel Corp., a Colorado Springs, Colorado, maker of semiconductors, third-party software products are patching holes left by Microsoft's end of support for Windows 98, said Bill VonDane, a senior systems engineer at Atmel.

Atmel has about 1,200 desktop computers running Windows 98, most used by employees for e-mail, word processing and other office functions. The company also has hundreds of machines in the company's fabrication facility that run test equipment and machines used to create semiconductors, many of them performing critical functions, he said.

Atmel uses antivirus software by Sophos PLC at the network gateway and on user desktops and updates its virus definitions every hour. The company also has a plan to upgrade desktop users to Windows 2000 or Windows XP Professional machines, VonDane said.

But for many of the machines on the manufacturing floor, migration is not such a simple matter. Often, the software controllers that run the fabrication equipment only work on the Windows 98 operating system. In fact, Atmel still has a number of Windows 95 and Windows 3.1 machines running on its production floor for that reason, he said.

Viruses that affect Windows 98 are a concern, VonDane admitted. Despite that, he is resigned about the end of support for the OS, and does not consider it a major security issue.

"I don't see problems with running an older OS if it works. The bottom line is that we've had an end-of-life issue with Windows 98 for quite some time," he said. "I'm not looking from support from Microsoft. The only thing I'm concerned with is making sure Sophos (antivirus) is updated."