4 ms·
I have a lot of clients still running XP. I have warned them that once MS stops the updates, the bad guys can examine updates for Vista or Win7 and see if the s
by dmfdmf 13y ago
I have a lot of clients still running XP. I have warned them that once MS stops the updates, the bad guys can examine updates for Vista or Win7 and see if the security hole exists in XP. I am guessing that with an April cutoff XP will be unusable as an internet connected device by October.
- xpextend 13y agoGood thing XpExtend was just released at XpExtend[dot]com.
- ForHackernews 13y agoSpam.
- yuhong 13y agoTip: HN has an about box that you can put things like this in.
- copx 13y agoI know very little about this type of security, how can one remotely hack into a computer just because it is connected to the internet and has some known vulnerability? I mean as far as I know my computer does not execute arbitrary code someone sends it through the internet without asking. So how do you exploit those vulnerabilities? I understand how you can exploit a vulnerability in a browser, those things actually execute whatever code happens to be on the pages you visit, they load images etc. by default. But just Windows XP with an open internet connection... how does code execution happen there?
- mitchty 13y agoImagine a problem in tcp packet handling that happens due to a problem parsing a tcp packet and further on up the chain the affected service has a buffer overflow in how it reads the data contained in the tcp packet(s) allowing you to inject arbitrary code into that service, lets say the service is RDP or whatever. Then just by having a system being online and able to accept malicious packets to this service, you can with say shodan scan for that vulnerable port across the entire internet, see if the ip is running xp via tcp fingerprinting, then send your malformed packets to the system and add your shiny new xp machine to your botnet for whatever nefarious purposes you need. Also probably patching the hole you used to get in so that nobody else can use it for their purposes. Now this is highly high level and remote vulnerabilities like these are much rarer than browser vulnerabilities, but from what I've heard there are a number of these vulnerabilities floating around just waiting for microsoft to abandon support for xp. Once that happens we might see more xp botnet nodes showing up and causing havoc.
- copx 13y agoI see, thank you for the explanation.
- dmfdmf 13y agoA little late to reply but... my clients are using XP for web access and email. So its just a matter of time before they get infected via an unclosed security hole.
- userbinator 13y agoHow many of these "holes" are in IE as opposed to the more integral components of the OS? I don't think it'll be as bad as MS wants you to think; after all, I witnessed 98SE's EOL and they said the same thing, used it until late 2010 (dualbooting with XP), but 16 years later a lot of modern malware won't even run on it.
- eru 13y agoWhat reasons did you have for running Windows 98?
- userbinator 13y agoLegacy software (and hardware) - some stuff for embedded development that used to run in DOS, and was OK with 98SE, but wouldn't work in anything NT-based. But mostly I'm a "don't fix it if it ain't broke" type of person, so if it weren't for the fact that a lot of other software I had to use wouldn't run in 98SE, I probably would still be using it. The file manager in Win98 is also surprisingly responsive when compared to XP, Vista, and 7, even on older hardware that's many times slower in benchmarks. Things seem to happen instantaneously, whereas in XP, Vista, and 7 there is a slight but noticeable delay every time e.g. you open a folder or scroll around. I think it's a little amusing that, even though it can only use 1 core, on my i7 system Win98 feels so much faster and less "intrusive" in many ways.
- eru 13y agoThanks! DosBox might help you.
- userbinator 13y agoFrom the Wikipedia page: Probably the most common hardware feature of DOS-era PCs that the official version of DOSBox doesn't emulate is the parallel port that was used to connect most printers, since very few games can make use of a printer. I'm not just playing games with this, I have some hardware that needs a parallel port and relies on direct access to the ports, so any sort of emulation layer etc. would likely not work well.