5 ms·

How vulnerable was Windows 95 to computer viruses?

deleted 6y ago
[deleted]
kristopolous 6y ago
You gotta more carefully define "vulnerable" and "computer virus" here, otherwise answers can only have equal hand-waving vagueness. There's security related processor features that the CPUs at the time didn't have and the kind of complete sandboxing abstractions we take for granted came at a high cost (VT instruction sets were a decade off and minimum ram was 4MB, not GB, but MB ... for everything, the whole system, all of it). As far as encryption goes, it was slow. Transparent disk encryption was totally possible but the performance hit was significant. People could be forgiven for deciding they really didn't care that much. Home users weren't keeping the kinds of secrets on their home computer that people do on their cell phones these days. The world was less digitally integrated.
- msla 6y ago
  Windows 95 never ran on anything less than an 80386, which could and did run reasonably secure OSes. That CPU didn't have support for hardware virtualization, but "sandboxing" is vague enough that you can reasonably say that 32-bit protected mode enforced secure sandboxing at the hardware level on those chips.
  - marcodiego 6y ago
    Yes, 80386 had memory protection but windows 95 did not enforce it. That is the reason I started using linux.
  - kristopolous 6y ago
    I was talking about things like Skylake's Memory Protection Extensions, Nehalems Safer Mode Extensions, Software Guard Extension, the virtualization extensions around 2005, page table virtualization with EPT, TXT, RDRAND for hardware entropy etc That's why it depends Things like AES and SHA are implemented in hardware these days. We can get into discussion on whether netware or xenix on a 386 is an unusable dog or not, I've got an actual 386 about 6 feet away from me as I write this. I could even give you login if you want to live the pain. Windows 95 made compromises, read barbarians led by Bill Gates for a good rundown. It was never intended to be their network line (NT), but instead for traditional home computers. Internet explorer was super last minute that's why it was just licensed code from spyglass mosaic. It was released the day after OEMs got windows 95. Gates didn't think there'd be a large demand for dialup modem based internet and that they had a few years to worry about it. He pivoted effectively a month or two before release. That's why MS pushed multiple patches out quickly after the release to get a competent networking stack outside of winsock. The people making windows 95 were competent and cared, they just had lots of conflicting priorities to attend to at once and people used it not as the manufacturers had intended. It's wasn't an easy job. Sure it has security vulnerabilities by 2021 standards. I'd venture to say every system in 1995 that could reasonably run on a typical 4 year old home computer did at the time. 386BSD 1.0, NetBSD 1.1, Linux 1.3, likely all riddled with issues by modern standards. And yes I'm obviously totally aware of the mainstream pop culture consensus of windows 95 sux or whatever. I mean duh, do you really think that's news to me? I know it could BSOD with some malformed packets and that its user security was totally fake. It was totally used in ways it wasn't designed for. Microsoft honestly thought serious stuff would be run on netware, MVS, sunos, os/2, hpux, nonstop os, tru64, os 2200, qnx, etc, certainly not windows 95. "Ah shit, here we go anyway" The curse of success
    - exmadscientist 6y ago
      > It was totally used in ways it wasn't designed for. Isn't this the hallmark of all truly revolutionary technologies?
corey_moncure 6y ago
Never connect it to a network, and install all software from read only CD media, and you'll be just fine.
- yellowapple 6y ago
  > and install all software from read only CD media Malware and AUTORUN.EXE: name a more iconic duo.
  - Macha 6y ago
    Yeah, there were even cases of malware making its way onto commercial software releases in those days.
juotlrjrb 6y ago
Most viruses back then travelled through infected executables on diskettes and CDs. Many Win 95 computers had only sporadic net access or none at all.
- ggm 6y ago
  Worked in an ISP whose bulk ordered install media for dialup config was preinfected either at the diskette factory or the bulk copyist. We'd shipped to customers before it was detected. A lot of virus came from people in supply chain basically. Even extra goodies installed in the handy local pc shop, "he said it made my pc faster" still happens. A lot of viruses were glued to the front of magazines
marcodiego 6y ago
Extremely vulnerable. The whole time you're running the machine as root, there's simply no other option. Drivers could be in 16 or 32 bits causing instabilities and kernel-level vulnerabilities. Memory protection was easy to circumvent and no special rights are needed to listen to keyboard, record audio, video or take screenshots. Auto-run was enabled by default. It was very easy to make bomb-cd's that installed anything just by inserting it on the drive. No centrally verified software repository and hard to acquire dev-tools forced the users to basically run whatever software was needed without compiling it themselves or by passing binaries from person to person. This alone made viruses spread vastly. And it created bad habits that survived to this day like hiding extension of files and installation processes that encourage the user to not pay attention on what is happening and simply accept what is asked.
II2II 6y ago
Windows 95 was very vulnerable to computer viruses. That being said, almost every personal computer operating system of the era was vulnerable. This was an era of single user operating systems where software could easily gain full access to the machine. The notion of the operating system running with greater privileges than applications was fuzzy since applications could simply inject a device driver override that. (Granted, that isn't technically necessary for computer viruses.) There were, of course, exceptions (e.g. Windows NT). Those exceptions were rare in homes and small businesses. There were people who would claim that their operating system is an exception, but most of those claims were only supported by virus writers having limited interest in those platforms.
phendrenad2 6y ago
Probably not very much, how many people out there are running Windows 95? The botnet authors have probably long ago trashed their win95 payloads.

deleted 6y ago

[deleted]

You gotta more carefully define "vulnerable" and "computer virus" here, otherwise answers can only have equal hand-waving vagueness. There's security related processor features that the CPUs at the time didn't have and the kind of complete sandboxing abstractions we take for granted came at a high cost (VT instruction sets were a decade off and minimum ram was 4MB, not GB, but MB ... for everything, the whole system, all of it). As far as encryption goes, it was slow. Transparent disk encryption was totally possible but the performance hit was significant. People could be forgiven for deciding they really didn't care that much. Home users weren't keeping the kinds of secrets on their home computer that people do on their cell phones these days. The world was less digitally integrated.

msla 6y ago
Windows 95 never ran on anything less than an 80386, which could and did run reasonably secure OSes. That CPU didn't have support for hardware virtualization, but "sandboxing" is vague enough that you can reasonably say that 32-bit protected mode enforced secure sandboxing at the hardware level on those chips.
- marcodiego 6y ago
  Yes, 80386 had memory protection but windows 95 did not enforce it. That is the reason I started using linux.
- kristopolous 6y ago
  I was talking about things like Skylake's Memory Protection Extensions, Nehalems Safer Mode Extensions, Software Guard Extension, the virtualization extensions around 2005, page table virtualization with EPT, TXT, RDRAND for hardware entropy etc That's why it depends Things like AES and SHA are implemented in hardware these days. We can get into discussion on whether netware or xenix on a 386 is an unusable dog or not, I've got an actual 386 about 6 feet away from me as I write this. I could even give you login if you want to live the pain. Windows 95 made compromises, read barbarians led by Bill Gates for a good rundown. It was never intended to be their network line (NT), but instead for traditional home computers. Internet explorer was super last minute that's why it was just licensed code from spyglass mosaic. It was released the day after OEMs got windows 95. Gates didn't think there'd be a large demand for dialup modem based internet and that they had a few years to worry about it. He pivoted effectively a month or two before release. That's why MS pushed multiple patches out quickly after the release to get a competent networking stack outside of winsock. The people making windows 95 were competent and cared, they just had lots of conflicting priorities to attend to at once and people used it not as the manufacturers had intended. It's wasn't an easy job. Sure it has security vulnerabilities by 2021 standards. I'd venture to say every system in 1995 that could reasonably run on a typical 4 year old home computer did at the time. 386BSD 1.0, NetBSD 1.1, Linux 1.3, likely all riddled with issues by modern standards. And yes I'm obviously totally aware of the mainstream pop culture consensus of windows 95 sux or whatever. I mean duh, do you really think that's news to me? I know it could BSOD with some malformed packets and that its user security was totally fake. It was totally used in ways it wasn't designed for. Microsoft honestly thought serious stuff would be run on netware, MVS, sunos, os/2, hpux, nonstop os, tru64, os 2200, qnx, etc, certainly not windows 95. "Ah shit, here we go anyway" The curse of success
  - exmadscientist 6y ago
    > It was totally used in ways it wasn't designed for. Isn't this the hallmark of all truly revolutionary technologies?

corey_moncure 6y ago

Never connect it to a network, and install all software from read only CD media, and you'll be just fine.

yellowapple 6y ago
> and install all software from read only CD media Malware and AUTORUN.EXE: name a more iconic duo.
- Macha 6y ago
  Yeah, there were even cases of malware making its way onto commercial software releases in those days.

juotlrjrb 6y ago

Most viruses back then travelled through infected executables on diskettes and CDs. Many Win 95 computers had only sporadic net access or none at all.

ggm 6y ago
Worked in an ISP whose bulk ordered install media for dialup config was preinfected either at the diskette factory or the bulk copyist. We'd shipped to customers before it was detected. A lot of virus came from people in supply chain basically. Even extra goodies installed in the handy local pc shop, "he said it made my pc faster" still happens. A lot of viruses were glued to the front of magazines

marcodiego 6y ago

Extremely vulnerable. The whole time you're running the machine as root, there's simply no other option. Drivers could be in 16 or 32 bits causing instabilities and kernel-level vulnerabilities. Memory protection was easy to circumvent and no special rights are needed to listen to keyboard, record audio, video or take screenshots. Auto-run was enabled by default. It was very easy to make bomb-cd's that installed anything just by inserting it on the drive. No centrally verified software repository and hard to acquire dev-tools forced the users to basically run whatever software was needed without compiling it themselves or by passing binaries from person to person. This alone made viruses spread vastly. And it created bad habits that survived to this day like hiding extension of files and installation processes that encourage the user to not pay attention on what is happening and simply accept what is asked.

II2II 6y ago

Windows 95 was very vulnerable to computer viruses. That being said, almost every personal computer operating system of the era was vulnerable. This was an era of single user operating systems where software could easily gain full access to the machine. The notion of the operating system running with greater privileges than applications was fuzzy since applications could simply inject a device driver override that. (Granted, that isn't technically necessary for computer viruses.) There were, of course, exceptions (e.g. Windows NT). Those exceptions were rare in homes and small businesses. There were people who would claim that their operating system is an exception, but most of those claims were only supported by virus writers having limited interest in those platforms.

phendrenad2 6y ago

Probably not very much, how many people out there are running Windows 95? The botnet authors have probably long ago trashed their win95 payloads.