32

On my answer to a previous question (Can I run Windows 98 and games from the same era on an AMD Duron CPU?) I finished with a warning about using Windows 98 on the Internet, which received the following comment:

Windows 98 it so old that most attacks don't work, and most malware won't run.

That poses the question, are the 9x versions of Windows susceptible to modern Malware?

I have my own thoughts on this question, but I thought I'd query the community first.

  • 3
  • 2
    There may be some targeted attacks that make Windows 9x a risk. I work in healthcare software. There are a number of specialized systems in labs and imaging suites that may still run on older Windows boxes. These systems are rarely exposed to the internet and in any well-run hospital are even isolated from the network or even airgapped. If an attacker has specific knowledge of these systems they could be targeted as an entry point to a network or to get specifically valuable data. Similar cases may exist in other sectors where older OSs are the only ones that can run older hardware. – Freiheit Oct 5 '16 at 18:37
  • 4
    Few years ago I connected old Win95 box (mainly used to play dos games) to internet, after few minutes of browsing some virus complained that .NET is missing ;) – PTwr Oct 6 '16 at 10:20
  • Windows 2000 is still vulnerable to MS08-067 NET API. Poke it and you have system level access. – rpmerf Oct 6 '16 at 13:54
  • Use DOS, no internet, no problems – Bálint Oct 11 '16 at 18:50
20

The very first step of an attack is to probe the target for platform. Pentesting applications such as metasploit have much more numerous and varied techniques to breach Windows 98 as opposed to the newer Windows versions.

By extension, most malware in the wild will also check for platform. In fact, much of that malware has its origins in Metasploit, especially those malware deployed by script kiddies.

  • 2
    +1 For mentioning the part where script kiddies follow online tutorials to make malware with Metasploit. – I.Am.A.Guy Oct 5 '16 at 17:30
12

(The question How could one say that older operating systems are more vulnerable? on Security Stack Exchange (linked by Stephen Kitt in the comments) provides a more in-depth answer, but I will try to provide a high-level answer here as well.)

Yes and no, mostly no.

Yes in the sense Windows 9x is vulnerable to most of the exploits patched by the various Windows XP (and above) service packs and security updates. The manufacturer has ended support for those OS versions and has no intention of providing any additional updates.

No in the sense that any executables targeting a version of Windows higher than Windows 9x will (or uses some then unavailable WIN32 API) will refuse to run on your system. See this example alert when trying to run a Skype executable designed for Windows XP and above.

Error Starting Program

11

Mostly no.

Pre-XP versions of Windows are certainly vulnerable to targeted attacks, such as you'd see from Metasploit -- if you're the sort of high-value target that attracts such attacks, don't run Windows 98.

However, most malware isn't that flexible. Instead, it's programmed to run on popular versions of Windows (typically XP or newer) and nothing else: the return on investment from targeting older versions just isn't there. For example, attempting to run what ClamAV calls "Win.Trojan.Fraudload-3348" on a Win98 system crashes with the following error:

Error message - Register dump

Other possible errors include missing DLLs

Error message - Missing DLL

DLLs that explicitly require a newer version of Windows (this one requires "5.0 or newer"),

Error message - incorrect version

errors that are just plain strange,

Error message - general failure

and one I haven't been able to trigger to get a screenshot of, where a system library is missing an expected function. The last is probably your greatest protection, in fact: most programmers will, deliberately or accidentally, target Unicode-based systems. If you haven't installed the optional unicow32.dll library on your Win9x system, Unicode-based programs can't run.

  • Nice tip about unicow32.dll. – Aaron Oct 5 '16 at 17:37
  • The error message 'A device attached to the system is not functioning' corresponds to the Windows error code ERROR_GEN_FAILURE. It tends to occur when a DLL that the program depends on is found, but does not include the required function. The WinExec system call can only return error codes between ERROR_INVALID_FUNCTION and ERROR_GEN_FAILURE, so possibly the real error (eg: ERROR_MOD_NOT_FOUND or ERROR_PROC_NOT_FOUND) was mapped to ERROR_GEN_FAILURE? – john_e Oct 5 '16 at 23:26
  • I think you want something like Windows 2003 x64 non-fatal error: rundll32.exe - Entry Point Not Found – a CVn Oct 6 '16 at 15:17
4

@Mark is on the right track with this when discussing targeted versus non-targeted attacks. To be more specific, this depends on the nature of the threat that you are trying to defend against.

If you are up against a hostile government, organized crime syndicate, or similar threat that is specifically targeting you and is actively engaged in gathering intelligence on your operations and infrastructure, running older operating systems isn't going to provide a meaningful defense as the hackers will just target you with exploits for whatever OS you use.

If you are defending against random opportunistic attackers who are looking for quick and easy victims, older operating systems will likely provide some defense as most opportunists are going to be targeting the most commonly used operating systems.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.