5 ms·

I suppose its fine as long as its not connected to the internet.

owenmarshall 6y ago
Do you suspect there are any 0day/worms still targeting Windows 95 systems? I wonder if an unpatched Win95 box is actually safer than an unpatched modern Windows box.
- PopsiclePete 6y ago
  >Do you suspect there are any 0day/worms still targeting Windows 95 systems? You'd be surprised how much malware is "legacy" 32-bit and works without issue on WinXP. A lot of malware even shies away from Unicode API's and specifically calls out the *A Win32 API functions. Considering the Win32 API is backwards compatible to a fault, I don't see why modern malware couldn't absolutely wreck a Win9x box.
  - owenmarshall 6y ago
    Sure – once the malware lands. But I doubt anyone is going after any Win95 vulnerabilities, so how does it get on the box to start chomping?
    - jasomill 6y ago
      Loaded from the boot sector of any floppy that happens to be present when the system is restarted, unless the boot order has been changed from factory defaults and the (possibly very old) coin cell powering NVRAM holds sufficient charge to retain these changes when (if) the system is ever powered off.
    - PeterisP 6y ago
      In general, attacks (e.g. most ransomware campaigns) are not automated malware spreading on its own, they involve people. If it's accessible on a network (which is the big 'if'), then it's obvious on any scan that it's a Win95 machine, and then you can try to look up a vulnerability for any exposed service. For example, if file sharing is running, then all the SMB vulnerabilities (e.g. EternalBlue and friends) apply also to Win95 systems, and I'm not sure if Windows 95 had a patch made, backported and issued for them.
  - badsectoracula 6y ago
    Yes, but Windows XP was in widespread use until recently and is still in use in a lot of places. I don't know where "netmarketshare.com" takes their user statistics (Google just used them when i searched for that) but it reports "1.26%" for Windows XP, which i think is still a large number. There are still so many users of Windows XP that Microsoft released a critical security patch last year despite XP being official EOL for years now.
  - TillE 6y ago
    Windows XP (NT kernel) and 9x are totally different OSes, using totally different kernels. They share some API, but not really the interesting parts. I work on software that still supports XP with only a little pain. Visual Studio 2019 will still install the necessary toolchain if you ask nicely. Targeting Windows 95/98 in 2020 sounds like a nightmare.
    - Snitch-Thursday 6y ago
      > Visual Studio 2019 will still install the necessary toolchain if you ask nicely Could I get a link to how to do this and/or web search terms? Is this just something targeting visual C runtime 20xx or older?
  - anthk 6y ago
    Eh, no. Not by a chance. I have some old as heck games which don't even work even under W2k with w9x compat mode (it's hidden, you need a command to enable it), so a total nope under XP.
- goalieca 6y ago
  That floppy disk controller is the only way into the box and isn't nearly as vulnerable as a modern usb controller since there's no smarts!! The windows 95 system is going to be safer than a patched windows 10 on the network for their use case.
  - vlovich123 6y ago
    For the common-case en masse compromises, not a concern. For targeted attacks it can still be an issue. Stuxnet is an example of this where they compromised an air-gapped system. Stuxnet was obviously extremely sophisticated, technically and for the overall operation, but the principles still apply. Also people frequently misjudge how big of a target they may be & what their risk profile really is (not saying for this use-case specifically, just in general).
- projektfu 6y ago
  Win95 is running as root by default. Any process can open another's memory. It has the same registry entry as Windows NT for running a program on startup. The keylogging API is basically the same. The IShellFolder and IWebBrowser interfaces are identical, so as long as the malware didn't request specific classes or features that are outside the realm of Windows 95, it can probably do pretty well. Luckily, Internet Explorer 3 doesn't support TLS.
  - anthk 6y ago
    Except for the Ex functions. I wonder if a malware can be run under KernelEx.
ajford 6y ago
IIRC, the machine was on an isolated equipment network with no external access for some time, but the network drivers would often cause some kind of conflict with the ISA interface card (and custom driver) so the network interface was disabled. So yeah, should be safe (and is likely no longer hardwired to the network).

Do you suspect there are any 0day/worms still targeting Windows 95 systems? I wonder if an unpatched Win95 box is actually safer than an unpatched modern Windows box.

PopsiclePete 6y ago
>Do you suspect there are any 0day/worms still targeting Windows 95 systems? You'd be surprised how much malware is "legacy" 32-bit and works without issue on WinXP. A lot of malware even shies away from Unicode API's and specifically calls out the *A Win32 API functions. Considering the Win32 API is backwards compatible to a fault, I don't see why modern malware couldn't absolutely wreck a Win9x box.
- owenmarshall 6y ago
  Sure – once the malware lands. But I doubt anyone is going after any Win95 vulnerabilities, so how does it get on the box to start chomping?
  - jasomill 6y ago
    Loaded from the boot sector of any floppy that happens to be present when the system is restarted, unless the boot order has been changed from factory defaults and the (possibly very old) coin cell powering NVRAM holds sufficient charge to retain these changes when (if) the system is ever powered off.
  - PeterisP 6y ago
    In general, attacks (e.g. most ransomware campaigns) are not automated malware spreading on its own, they involve people. If it's accessible on a network (which is the big 'if'), then it's obvious on any scan that it's a Win95 machine, and then you can try to look up a vulnerability for any exposed service. For example, if file sharing is running, then all the SMB vulnerabilities (e.g. EternalBlue and friends) apply also to Win95 systems, and I'm not sure if Windows 95 had a patch made, backported and issued for them.
- badsectoracula 6y ago
  Yes, but Windows XP was in widespread use until recently and is still in use in a lot of places. I don't know where "netmarketshare.com" takes their user statistics (Google just used them when i searched for that) but it reports "1.26%" for Windows XP, which i think is still a large number. There are still so many users of Windows XP that Microsoft released a critical security patch last year despite XP being official EOL for years now.
- TillE 6y ago
  Windows XP (NT kernel) and 9x are totally different OSes, using totally different kernels. They share some API, but not really the interesting parts. I work on software that still supports XP with only a little pain. Visual Studio 2019 will still install the necessary toolchain if you ask nicely. Targeting Windows 95/98 in 2020 sounds like a nightmare.
  - Snitch-Thursday 6y ago
    > Visual Studio 2019 will still install the necessary toolchain if you ask nicely Could I get a link to how to do this and/or web search terms? Is this just something targeting visual C runtime 20xx or older?
- anthk 6y ago
  Eh, no. Not by a chance. I have some old as heck games which don't even work even under W2k with w9x compat mode (it's hidden, you need a command to enable it), so a total nope under XP.
goalieca 6y ago
That floppy disk controller is the only way into the box and isn't nearly as vulnerable as a modern usb controller since there's no smarts!! The windows 95 system is going to be safer than a patched windows 10 on the network for their use case.
- vlovich123 6y ago
  For the common-case en masse compromises, not a concern. For targeted attacks it can still be an issue. Stuxnet is an example of this where they compromised an air-gapped system. Stuxnet was obviously extremely sophisticated, technically and for the overall operation, but the principles still apply. Also people frequently misjudge how big of a target they may be & what their risk profile really is (not saying for this use-case specifically, just in general).
projektfu 6y ago
Win95 is running as root by default. Any process can open another's memory. It has the same registry entry as Windows NT for running a program on startup. The keylogging API is basically the same. The IShellFolder and IWebBrowser interfaces are identical, so as long as the malware didn't request specific classes or features that are outside the realm of Windows 95, it can probably do pretty well. Luckily, Internet Explorer 3 doesn't support TLS.
- anthk 6y ago
  Except for the Ex functions. I wonder if a malware can be run under KernelEx.

ajford 6y ago

IIRC, the machine was on an isolated equipment network with no external access for some time, but the network drivers would often cause some kind of conflict with the ISA interface card (and custom driver) so the network interface was disabled. So yeah, should be safe (and is likely no longer hardwired to the network).