On my answer to a previous question (Can I run Windows 98 and games from the same era on an AMD Duron CPU?) I finished with a warning about using Windows 98 on the Internet, which received the following comment:
Windows 98 it so old that most attacks don't work, and most malware won't run.
That poses the question, are the 9x versions of Windows susceptible to modern Malware?
I have my own thoughts on this question, but I thought I'd query the community first.
The very first step of an attack is to probe the target for platform. Pentesting applications such as metasploit have much more numerous and varied techniques to breach Windows 98 as opposed to the newer Windows versions.
By extension, most malware in the wild will also check for platform. In fact, much of that malware has its origins in Metasploit, especially those malware deployed by script kiddies.
(The question How could one say that older operating systems are more vulnerable? on Security Stack Exchange (linked by Stephen Kitt in the comments) provides a more in-depth answer, but I will try to provide a high-level answer here as well.)
Yes and no, mostly no.
Yes in the sense Windows 9x is vulnerable to most of the exploits patched by the various Windows XP (and above) service packs and security updates. The manufacturer has ended support for those OS versions and has no intention of providing any additional updates.
No in the sense that any executables targeting a version of Windows higher than Windows 9x will (or uses some then unavailable WIN32 API) will refuse to run on your system. See this example alert when trying to run a Skype executable designed for Windows XP and above.
Mostly no.
Pre-XP versions of Windows are certainly vulnerable to targeted attacks, such as you'd see from Metasploit -- if you're the sort of high-value target that attracts such attacks, don't run Windows 98.
However, most malware isn't that flexible. Instead, it's programmed to run on popular versions of Windows (typically XP or newer) and nothing else: the return on investment from targeting older versions just isn't there. For example, attempting to run what ClamAV calls "Win.Trojan.Fraudload-3348" on a Win98 system crashes with the following error:
Other possible errors include missing DLLs
DLLs that explicitly require a newer version of Windows (this one requires "5.0 or newer"),
errors that are just plain strange,
and one I haven't been able to trigger to get a screenshot of, where a system library is missing an expected function. The last is probably your greatest protection, in fact: most programmers will, deliberately or accidentally, target Unicode-based systems. If you haven't installed the optional unicow32.dll library on your Win9x system, Unicode-based programs can't run.
@Mark is on the right track with this when discussing targeted versus non-targeted attacks. To be more specific, this depends on the nature of the threat that you are trying to defend against.
If you are up against a hostile government, organized crime syndicate, or similar threat that is specifically targeting you and is actively engaged in gathering intelligence on your operations and infrastructure, running older operating systems isn't going to provide a meaningful defense as the hackers will just target you with exploits for whatever OS you use.
If you are defending against random opportunistic attackers who are looking for quick and easy victims, older operating systems will likely provide some defense as most opportunists are going to be targeting the most commonly used operating systems.
