38

On my answer to a previous question (Can I run Windows 98 and games from the same era on an AMD Duron CPU?) I finished with a warning about using Windows 98 on the Internet, which received the following comment:

Windows 98 it so old that most attacks don't work, and most malware won't run.

That poses the question, are the 9x versions of Windows susceptible to modern Malware?

I have my own thoughts on this question, but I thought I'd query the community first.

6
  • 5
  • 3
    There may be some targeted attacks that make Windows 9x a risk. I work in healthcare software. There are a number of specialized systems in labs and imaging suites that may still run on older Windows boxes. These systems are rarely exposed to the internet and in any well-run hospital are even isolated from the network or even airgapped. If an attacker has specific knowledge of these systems they could be targeted as an entry point to a network or to get specifically valuable data. Similar cases may exist in other sectors where older OSs are the only ones that can run older hardware.
    – Freiheit
    Oct 5, 2016 at 18:37
  • 11
    Few years ago I connected old Win95 box (mainly used to play dos games) to internet, after few minutes of browsing some virus complained that .NET is missing ;)
    – PTwr
    Oct 6, 2016 at 10:20
  • 2
    Windows 2000 is still vulnerable to MS08-067 NET API. Poke it and you have system level access.
    – rpmerf
    Oct 6, 2016 at 13:54
  • 2
    Use DOS, no internet, no problems
    – Bálint
    Oct 11, 2016 at 18:50

5 Answers 5

24

The very first step of an attack is to probe the target for platform. Pentesting applications such as metasploit have much more numerous and varied techniques to breach Windows 98 as opposed to the newer Windows versions.

By extension, most malware in the wild will also check for platform. In fact, much of that malware has its origins in Metasploit, especially those malware deployed by script kiddies.

1
  • 5
    +1 For mentioning the part where script kiddies follow online tutorials to make malware with Metasploit.
    – I.Am.A.Guy
    Oct 5, 2016 at 17:30
16

(The question How could one say that older operating systems are more vulnerable? on Security Stack Exchange (linked by Stephen Kitt in the comments) provides a more in-depth answer, but I will try to provide a high-level answer here as well.)

Yes and no, mostly no.

Yes in the sense Windows 9x is vulnerable to most of the exploits patched by the various Windows XP (and above) service packs and security updates. The manufacturer has ended support for those OS versions and has no intention of providing any additional updates.

No in the sense that any executables targeting a version of Windows higher than Windows 9x will (or uses some then unavailable WIN32 API) will refuse to run on your system. See this example alert when trying to run a Skype executable designed for Windows XP and above.

Error Starting Program

0
15

Mostly no.

Pre-XP versions of Windows are certainly vulnerable to targeted attacks, such as you'd see from Metasploit -- if you're the sort of high-value target that attracts such attacks, don't run Windows 98.

However, most malware isn't that flexible. Instead, it's programmed to run on popular versions of Windows (typically XP or newer) and nothing else: the return on investment from targeting older versions just isn't there. For example, attempting to run what ClamAV calls "Win.Trojan.Fraudload-3348" on a Win98 system crashes with the following error:

Error message - Register dump

Other possible errors include missing DLLs

Error message - Missing DLL

DLLs that explicitly require a newer version of Windows (this one requires "5.0 or newer"),

Error message - incorrect version

errors that are just plain strange,

Error message - general failure

and one I haven't been able to trigger to get a screenshot of, where a system library is missing an expected function. The last is probably your greatest protection, in fact: most programmers will, deliberately or accidentally, target Unicode-based systems. If you haven't installed the optional unicow32.dll library on your Win9x system, Unicode-based programs can't run.

3
  • 2
    Nice tip about unicow32.dll.
    – Aaron
    Oct 5, 2016 at 17:37
  • The error message 'A device attached to the system is not functioning' corresponds to the Windows error code ERROR_GEN_FAILURE. It tends to occur when a DLL that the program depends on is found, but does not include the required function. The WinExec system call can only return error codes between ERROR_INVALID_FUNCTION and ERROR_GEN_FAILURE, so possibly the real error (eg: ERROR_MOD_NOT_FOUND or ERROR_PROC_NOT_FOUND) was mapped to ERROR_GEN_FAILURE?
    – john_e
    Oct 5, 2016 at 23:26
  • I think you want something like Windows 2003 x64 non-fatal error: rundll32.exe - Entry Point Not Found
    – user
    Oct 6, 2016 at 15:17
4

@Mark is on the right track with this when discussing targeted versus non-targeted attacks. To be more specific, this depends on the nature of the threat that you are trying to defend against.

If you are up against a hostile government, organized crime syndicate, or similar threat that is specifically targeting you and is actively engaged in gathering intelligence on your operations and infrastructure, running older operating systems isn't going to provide a meaningful defense as the hackers will just target you with exploits for whatever OS you use.

If you are defending against random opportunistic attackers who are looking for quick and easy victims, older operating systems will likely provide some defense as most opportunists are going to be targeting the most commonly used operating systems.

0
1

As things look in 2022:

Do differentiate between opportunist malware threats (something scanning around for whatever it could use for a botnet/spam/malware hub) and Advanced Threat Actors(tm)/targeted attackers.

Do assess whether your home network is really just for your own use ... or if you are either running infrastructure others use (eg a self hosted server) and/or also using it for machines involved in your own or somebody's business (home office/mobile office!). Eg, if somebody has no reason to really try and attack you, they might have a reason to do so to your customer or your boss' customer.

Opportunist software would USUALLY not bother ... but you can't be sure someone is not trying to take advantage of the proliferation of badly secured legacy systems in businesses.

Advanced threat actor - big problem anyway, bigger problem if you have obsolete systems.

Be aware of threats like ZuoRAT, which can turn home/home office routers into attack bridgeheads.

If in doubt, it is sensible to at the minimum isolate your vintage/experimental systems on a different subnet behind a sub-router/sub-firewall (VLANs and a router-on-a-stick topology are not perfect but far, far better than nothing for that). This would foil simple opportunist scanners, simply scanning the subnet behind your home router, unless they expect that kind of setup: either that sub-router uses NAT which acts as a default no-ingress policy, or it uses a plain routed subnet which would take more scanning effort. This would complicate things for a targeted attacker, probably making their action more evident. This would make it much more easy to you to start monitoring things in case you have suspicion something is going on. This will allow you to react by restricting access with firewall rules. This will keep obsolete and probably insecure protocols (eg AFP, SMBv1, pre-TCP/IP stuff) off your main network's broadcast domain. Also consider adding a separate, well secured and monitored, wifi access point into that network if you work with legacy/experimental wifi enabled devices.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .