Retrocomputing Stack Exchange is a question and answer site for vintage-computer hobbyists interested in restoring, preserving, and using the classic computer and gaming systems of yesteryear. It only takes a minute to sign up.
Sign up to join this community
On my answer to a previous question (Can I run Windows 98 and games from the same era on an AMD Duron CPU?) I finished with a warning about using Windows 98 on the Internet, which received the following comment:
Windows 98 it so old that most attacks don't work, and most malware won't run.
That poses the question, are the 9x versions of Windows susceptible to modern Malware?
I have my own thoughts on this question, but I thought I'd query the community first.
The very first step of an attack is to probe the target for platform. Pentesting applications such as metasploit have much more numerous and varied techniques to breach Windows 98 as opposed to the newer Windows versions.
By extension, most malware in the wild will also check for platform. In fact, much of that malware has its origins in Metasploit, especially those malware deployed by script kiddies.
(The question How could one say that older operating systems are more vulnerable? on Security Stack Exchange (linked by Stephen Kitt in the comments) provides a more in-depth answer, but I will try to provide a high-level answer here as well.)
Yes and no, mostly no.
Yes in the sense Windows 9x is vulnerable to most of the exploits patched by the various Windows XP (and above) service packs and security updates. The manufacturer has ended support for those OS versions and has no intention of providing any additional updates.
No in the sense that any executables targeting a version of Windows higher than Windows 9x will (or uses some then unavailable WIN32 API) will refuse to run on your system. See this example alert when trying to run a Skype executable designed for Windows XP and above.
Mostly no.
Pre-XP versions of Windows are certainly vulnerable to targeted attacks, such as you'd see from Metasploit -- if you're the sort of high-value target that attracts such attacks, don't run Windows 98.
However, most malware isn't that flexible. Instead, it's programmed to run on popular versions of Windows (typically XP or newer) and nothing else: the return on investment from targeting older versions just isn't there. For example, attempting to run what ClamAV calls "Win.Trojan.Fraudload-3348" on a Win98 system crashes with the following error:
Other possible errors include missing DLLs
DLLs that explicitly require a newer version of Windows (this one requires "5.0 or newer"),
errors that are just plain strange,
and one I haven't been able to trigger to get a screenshot of, where a system library is missing an expected function. The last is probably your greatest protection, in fact: most programmers will, deliberately or accidentally, target Unicode-based systems. If you haven't installed the optional unicow32.dll library on your Win9x system, Unicode-based programs can't run.
@Mark is on the right track with this when discussing targeted versus non-targeted attacks. To be more specific, this depends on the nature of the threat that you are trying to defend against.
If you are up against a hostile government, organized crime syndicate, or similar threat that is specifically targeting you and is actively engaged in gathering intelligence on your operations and infrastructure, running older operating systems isn't going to provide a meaningful defense as the hackers will just target you with exploits for whatever OS you use.
If you are defending against random opportunistic attackers who are looking for quick and easy victims, older operating systems will likely provide some defense as most opportunists are going to be targeting the most commonly used operating systems.
As things look in 2022:
Do differentiate between opportunist malware threats (something scanning around for whatever it could use for a botnet/spam/malware hub) and Advanced Threat Actors(tm)/targeted attackers.
Do assess whether your home network is really just for your own use ... or if you are either running infrastructure others use (eg a self hosted server) and/or also using it for machines involved in your own or somebody's business (home office/mobile office!). Eg, if somebody has no reason to really try and attack you, they might have a reason to do so to your customer or your boss' customer.
Opportunist software would USUALLY not bother ... but you can't be sure someone is not trying to take advantage of the proliferation of badly secured legacy systems in businesses.
Advanced threat actor - big problem anyway, bigger problem if you have obsolete systems.
Be aware of threats like ZuoRAT, which can turn home/home office routers into attack bridgeheads.
If in doubt, it is sensible to at the minimum isolate your vintage/experimental systems on a different subnet behind a sub-router/sub-firewall (VLANs and a router-on-a-stick topology are not perfect but far, far better than nothing for that). This would foil simple opportunist scanners, simply scanning the subnet behind your home router, unless they expect that kind of setup: either that sub-router uses NAT which acts as a default no-ingress policy, or it uses a plain routed subnet which would take more scanning effort. This would complicate things for a targeted attacker, probably making their action more evident. This would make it much more easy to you to start monitoring things in case you have suspicion something is going on. This will allow you to react by restricting access with firewall rules. This will keep obsolete and probably insecure protocols (eg AFP, SMBv1, pre-TCP/IP stuff) off your main network's broadcast domain. Also consider adding a separate, well secured and monitored, wifi access point into that network if you work with legacy/experimental wifi enabled devices.
