4 ms·

I am very curious of how long it would take to be ‘pwned’ whilst browsing the web with internet explorer on XP. Seconds, minutes, hours? Time to fire up a VM

I am very curious of how long it would take to be ‘pwned’ whilst browsing the web with internet explorer on XP. Seconds, minutes, hours? Time to fire up a VM I think.

hulitu 4y ago
Years ? I don't know if the newest ransomware runs on Win XP.
- danogentili 4y ago
  Actually, it would make perfect sense for malware to rely very heavily on backwards compatibility and old exploits.
causality0 4y ago
Depends on your browsing habits. If you're only visiting a handful of trustworthy websites maybe never. If you spend nine hours a day on bootleg hentai streaming sites, maybe very quickly.
- WhackyIdeas 4y ago
  Maybe. See we had a trusted B2B site we use for stock. Then we noticed our bank account being raided. Turns out they had hackers on their system skimming all the card details. Maybe they were hosting on XP. Didn’t ask.
- badsectoracula 4y ago
  Chances are said bootleg hentai streaming sites wont work on IE6 anyway.
- grishka 4y ago
  Probably also depends on whether you have Flash Player installed and which version.
mmcgaha 4y ago
A long time because the old TLS does not let you connect to modern servers.
guestbest 4y ago
I’ve used windows XP tablet is on a Toshiba with a patched up version of Firefox designed to use TLS 1.3 on the internet without issues for hours. I think most software is so I’m compatible with it that even hacking it is a history lesson.
- guestbest 4y ago
  Most hacking software is so incompatible with xp, I meant to write
userbinator 4y ago
If you turn off JS and all the other features (ActiveX, etc.) that should've never been allowed on anything other than sites you fully trust, probably a very long time. I wonder how much malware now just refuses to run on XP because it attempts to use functions that were introduced in later versions.
- WhackyIdeas 4y ago
  If I was going to attempt this with a VM, maybe I would try to perform a checksum on every file first then recheck everything after an hour (from a powered down state) and look for changes. I would be concerned that any malware would simply be a downloader for something which is undetectable to AV. Probably the wrong place to ask, but this seems like such a fun experiment to try but maybe more difficult than I initially thought.
badsectoracula 4y ago
Most likely never because nothing more advanced than very basic HTML sites work with IE6 nowadays and with JS enabled you are more likely to crash the browser than visit a site. This includes the vast majority of ads which are the main way to get such malware. Also chances are even if a bad ad (or other vulnerability) hits you, it wont work because it'd be designed for browsers people actually use :-P.
alar44 4y ago
Oh you won't even be able to load a modern web page on XP or before so no worries there.
bluedino 4y ago
There was a time where a fresh 98 install wouldn't last very long at all if you had a public IP
- anenefan 4y ago
  I think it was more people clicking on links being sent to them in IM, emails or other personal messaging. I used to for fun 2001 to 2006 or so, run a fresh install of 98se which I had burned to CD, recovery was about 20 mins perhaps a bit less, (read however long it took to copy a 600 meg image to hard drive) and cruised the net. No security as such, just seeing what was out there, what ports being probed etc. I rarely had any issues. Yes of course when I was tormenting some large wannabe hacker forum (read script kiddies) where one or more had decided to prove themselves by attacking a couple of harmless looking forums, yes I think they managed to get in pretty quickly iirc about five minutes. For giggles after a couple of times (they got quicker) I switched over to a live linux cd ... but since one of their members had outdone themselves and annoyed people who unlike myself quite happy with my new chew toys, ... I figured just a matter of time before my fun would end ... their forum strangely packed it at end of week :) In all of it, my only issue albeit a very serious one, was contaminated backups, which occurred when was when I was "tagged" in 2003 with something, which was so unique that last time I scanned a copy of the infected system in 2009-10, it still didn't raise any flags with the latest anti malware or root kit detection available at the time.

I am very curious of how long it would take to be ‘pwned’ whilst browsing the web with internet explorer on XP. Seconds, minutes, hours? Time to fire up a VM I think.

hulitu 4y ago

Years ? I don't know if the newest ransomware runs on Win XP.

danogentili 4y ago
Actually, it would make perfect sense for malware to rely very heavily on backwards compatibility and old exploits.

causality0 4y ago

Depends on your browsing habits. If you're only visiting a handful of trustworthy websites maybe never. If you spend nine hours a day on bootleg hentai streaming sites, maybe very quickly.

WhackyIdeas 4y ago
Maybe. See we had a trusted B2B site we use for stock. Then we noticed our bank account being raided. Turns out they had hackers on their system skimming all the card details. Maybe they were hosting on XP. Didn’t ask.
badsectoracula 4y ago
Chances are said bootleg hentai streaming sites wont work on IE6 anyway.
grishka 4y ago
Probably also depends on whether you have Flash Player installed and which version.

mmcgaha 4y ago

A long time because the old TLS does not let you connect to modern servers.

guestbest 4y ago

I’ve used windows XP tablet is on a Toshiba with a patched up version of Firefox designed to use TLS 1.3 on the internet without issues for hours. I think most software is so I’m compatible with it that even hacking it is a history lesson.

guestbest 4y ago
Most hacking software is so incompatible with xp, I meant to write

userbinator 4y ago

If you turn off JS and all the other features (ActiveX, etc.) that should've never been allowed on anything other than sites you fully trust, probably a very long time. I wonder how much malware now just refuses to run on XP because it attempts to use functions that were introduced in later versions.

WhackyIdeas 4y ago
If I was going to attempt this with a VM, maybe I would try to perform a checksum on every file first then recheck everything after an hour (from a powered down state) and look for changes. I would be concerned that any malware would simply be a downloader for something which is undetectable to AV. Probably the wrong place to ask, but this seems like such a fun experiment to try but maybe more difficult than I initially thought.

badsectoracula 4y ago

Most likely never because nothing more advanced than very basic HTML sites work with IE6 nowadays and with JS enabled you are more likely to crash the browser than visit a site. This includes the vast majority of ads which are the main way to get such malware. Also chances are even if a bad ad (or other vulnerability) hits you, it wont work because it'd be designed for browsers people actually use :-P.

alar44 4y ago

Oh you won't even be able to load a modern web page on XP or before so no worries there.

bluedino 4y ago

There was a time where a fresh 98 install wouldn't last very long at all if you had a public IP

anenefan 4y ago
I think it was more people clicking on links being sent to them in IM, emails or other personal messaging. I used to for fun 2001 to 2006 or so, run a fresh install of 98se which I had burned to CD, recovery was about 20 mins perhaps a bit less, (read however long it took to copy a 600 meg image to hard drive) and cruised the net. No security as such, just seeing what was out there, what ports being probed etc. I rarely had any issues. Yes of course when I was tormenting some large wannabe hacker forum (read script kiddies) where one or more had decided to prove themselves by attacking a couple of harmless looking forums, yes I think they managed to get in pretty quickly iirc about five minutes. For giggles after a couple of times (they got quicker) I switched over to a live linux cd ... but since one of their members had outdone themselves and annoyed people who unlike myself quite happy with my new chew toys, ... I figured just a matter of time before my fun would end ... their forum strangely packed it at end of week :) In all of it, my only issue albeit a very serious one, was contaminated backups, which occurred when was when I was "tagged" in 2003 with something, which was so unique that last time I scanned a copy of the infected system in 2009-10, it still didn't raise any flags with the latest anti malware or root kit detection available at the time.