3 ms·

I’ve worked doing data analysis on vulnerabilities, and it’s really really bizarre. Some times the most secure systems are running insanely old software. Some

I’ve worked doing data analysis on vulnerabilities, and it’s really really bizarre. Some times the most secure systems are running insanely old software. Sometimes software that’s a bit out of date correlates to fewer attacks. When people are attacked, they upgrade their software. So a company that has gone a long time with no updates, followed by frantically updating everything could be a warning sign.

threatactor 4y ago
Maybe some weirdness is cleared up by noting that besides being an indication that upgrades haven't been necessary for a while, really old software often gains additional resilience to attacks by becoming more obscure with age. Targeted efforts are warded off somewhat by the unfamiliar attack surface and mass scanners typically won't be looking for ancient services. This is only tangentially related, but Im curious if you found anything about the typical length of time between systems being compromised to when intrusions are discovered as part of your work - if you would like to and are at liberty to share :)
- gladiatr72 4y ago
  The local university maintained DECNet routing to support systems still in use in the physics department until the early 2000's (when they also ceased inter-building IPX routing). Guess which systems were never exploited for distributing Warez and porn? All exploited systems before then were either windows nt or Linux. Commercial Unix (Dec, sgi, sun) rarely came up and generally only when there were accounts using identical credentials with a more exploitable platform.
- aflag 4y ago
  Very old software may gain an edge. However, that takes a while and depends on the number of people using the old software as well. For instance, Windows XP was a big target for decades after it had been superseded by newer versions of windows. If your software stack is from the 90s, I'd say you might just getting obscure enough by this point. Scanners are frequently not looking for the breakthrough 0-day vulnerabilities, but just for the low hanging fruit of old and well known vulnerabilities.

threatactor 4y ago

Maybe some weirdness is cleared up by noting that besides being an indication that upgrades haven't been necessary for a while, really old software often gains additional resilience to attacks by becoming more obscure with age. Targeted efforts are warded off somewhat by the unfamiliar attack surface and mass scanners typically won't be looking for ancient services. This is only tangentially related, but Im curious if you found anything about the typical length of time between systems being compromised to when intrusions are discovered as part of your work - if you would like to and are at liberty to share :)

gladiatr72 4y ago
The local university maintained DECNet routing to support systems still in use in the physics department until the early 2000's (when they also ceased inter-building IPX routing). Guess which systems were never exploited for distributing Warez and porn? All exploited systems before then were either windows nt or Linux. Commercial Unix (Dec, sgi, sun) rarely came up and generally only when there were accounts using identical credentials with a more exploitable platform.
aflag 4y ago
Very old software may gain an edge. However, that takes a while and depends on the number of people using the old software as well. For instance, Windows XP was a big target for decades after it had been superseded by newer versions of windows. If your software stack is from the 90s, I'd say you might just getting obscure enough by this point. Scanners are frequently not looking for the breakthrough 0-day vulnerabilities, but just for the low hanging fruit of old and well known vulnerabilities.