What Happens If You Connect Windows XP To the Internet In 2024? (youtube.com) 73
Long-time Slashdot reader sandbagger writes: Have you ever wondered if it's true you can instantly get malware? In this video, a person connects an XP instance directly to the internet with no firewall to see just how fast it gets compromised by malware, rootkits, malicious services and new user accounts. The answer — fast!
Malwarebytes eventually finds eight different viruses/Trojan horses -- and a DNS changer. (One IP address leads back to the Russian federation.) Itâ(TM)s fun to watch -- within just a few hours a new Windows user has even added themself. And for good measure, he also opens up Internet Explorer...
âoeWindows XP -- very insecure,â they conclude at the end of the video. âoeVery easy for random software from the internet to get more privileges than you, and it is very hard to solve that.
âoeAlso, just out of curiosity I tried this on Windows 7. And even with all of the same settings, nothing happened. I let it run for 10 hours. So it seems like this may be a problem in historical Windows.â
Malwarebytes eventually finds eight different viruses/Trojan horses -- and a DNS changer. (One IP address leads back to the Russian federation.) Itâ(TM)s fun to watch -- within just a few hours a new Windows user has even added themself. And for good measure, he also opens up Internet Explorer...
âoeWindows XP -- very insecure,â they conclude at the end of the video. âoeVery easy for random software from the internet to get more privileges than you, and it is very hard to solve that.
âoeAlso, just out of curiosity I tried this on Windows 7. And even with all of the same settings, nothing happened. I let it run for 10 hours. So it seems like this may be a problem in historical Windows.â
My senior developer still uses XP at home (Score:2)
Re: (Score:2)
Still have (and start it occasionally) WinXP in VM. Back in the days, it took 1.5 minutes to start. Today, even in VM, WinXP starts off an SSD in about 10s. Again: from cold start to ready to use desktop in under 10s. Feels like magic.
P.S. My Android phone takes ~2min to start and ~1min before it's actually useable. Linux on HW or in VM - ~15-20 seconds.
Re: (Score:2)
Re: My senior developer still uses XP at home (Score:1)
Not necessarily optimized, flash in phones is simply slower and lower quality than any decent desktop SSD. Also the fact that core Windows XP is like 300MB (definitely fits on a CD) whereas modern Android is ~4GB.
Re: (Score:2)
When I went retro with MS software, I went to Windows 95b. No malware collected, because not internet connected.
Re: (Score:2)
Windows 95 has TCP/IP though, and a file server too, so you can easily subject it to pwnage if you're not careful.
Re: (Score:2)
I'm pretty sure that was an add-on. WinSock or some such. I think the on-line connection became standard with Windows98, but that had timing problems with the music software I was using.
Re: (Score:2)
Windows 95 has built in networking. You'll have to go back to Windows 3.1 for a version of Windows that doesn't include a network stack.
Re: (Score:2)
Yes, TCP/IP support just wasn't in the default installation for Windows 95 so you had to enable it separately. OS/2 Warp was similar, I have a faint memory of having to download the OS/2 packages but you could definitely also get online with that one using just official OS/2 from IBM.
WinXP, compromised, same as Linux from that era. (Score:4, Interesting)
Develops with the latest Microsoft tools at work, goes retro at home.
Presumably patched as much as WinXP will patch. However that is only little better than a fresh install from a WinXP SP1 CD.
I have an XP box too, for testing purposes. OK, legacy gaming too.. Never would I allow it to be visible to the internet. I've run OpenBSD based firewalls at home and examined the log files. Tons of probing of my home user IP address from Eastern Europe and Russia and China, and a ton more from my "neighbors" on my internet provider's subnet. These probes can lead to an infected system, be it Windows or Linux.
Back in XP days a friend installed Linux off of a CD, not a network based install. When he got a successful install it was late and he went to sleep. When he got up in the morning to configure it he found it already compromised. Apparently the CD was missing key patches. WinXP will be the same. At a minimum it needs to be behind a deny all incoming firewall, allowing only communications that the WinXP box initiates to a very short whitelist of trusted sites for testing. Even that is dangerous depending on what these sites use in their software stack for their website.
Personally I'd use an XP VM zipped and stored for such testing. As needed I'd make a copy, do the testing, delete the VM just used. Start over with another fresh copy of the stored VM next time.
Re: (Score:2)
Personally I'd use an XP VM zipped and stored for such testing. As needed I'd make a copy, do the testing, delete the VM just used. Start over with another fresh copy of the stored VM next time.
FWIW, there are MUCH better ways to do that. Just one such example using VMWare:
* VMWare -> (vm image) -> Settings -> Hard Disk -> Advanced -> Mode: Independent + Nonpersistent
The "Nonpersistent" option reads, "Changes to this disk are discarded when you power off or restore a snapshot."
Can also do similar via snapshots, COW files, etc.. You don't need to copy the whole VM image every time in any of those cases - just blow away the data created since it started (the Copy On Write file, or rol
Re: (Score:2)
Personally I'd use an XP VM zipped and stored for such testing. As needed I'd make a copy, do the testing, delete the VM just used. Start over with another fresh copy of the stored VM next time.
FWIW, there are MUCH better ways to do that. Just one such example using VMWare: * VMWare -> (vm image) -> Settings -> Hard Disk -> Advanced -> Mode: Independent + Nonpersistent
The "Nonpersistent" option reads, "Changes to this disk are discarded when you power off or restore a snapshot."
Can also do similar via snapshots, COW files, etc.. You don't need to copy the whole VM image every time in any of those cases - just blow away the data created since it started (the Copy On Write file, or roll back to a snapshot, or let VMWare toss out the COW data). If using a non-persistent image, you simply power off; Next boot will be like that last boot never happened.
Awesome. I lean towards deleting since I rarely need the VM again. Waste of SSD space if left hanging around.
Re: (Score:2)
Can you ask him what Web browser he uses?
Re: (Score:2)
Why without firewall? (Score:5, Insightful)
Windows XP has a firewall and it is enabled by default. Why not take Windows XP SP3 with default configuration and see how long it takes to get owned? How is intentionally disabling default security precautions consistent with conclusions related to security of XP?
Re: (Score:2)
Re:Why without firewall? (Score:4, Interesting)
Ya ok.
Anyone with a decent IT engineering background is going to change the network status to "Public". And ensure the firewall is up. And disable stock exceptions (if any).
What I do on legacy test systems is disable any incoming connections on all network profiles. That way if the system joins a domain ports do not automatically open.
However, maybe people are dumber than me.
Re: (Score:3)
Yes and no. XP's firewall depends on the trust status of a network. The private home network allows enough access to other machines to easily exploit one of the various RPC bugs for example.
They used a public IP address.
Re: (Score:2)
The XP firewall, and MS firewalls in general, are totally useless as they let *anything* on the local machine make an outward connection. So if something nasty does get on the box it can immediately phone home to download the real payload.
I've still got XP machines (running old audio software) and, whilst I no longer let them access the 'net, both machines have got an early version of Zone Alarm on them. This not only blocks all incoming connections by default but, crucially, also notifies you the first t
Re: (Score:2)
Re: (Score:2)
The purpose of an endpoint firewall is to protect that system, not protect the rest of the world from it.
I'm not a big fan out outbound firewalls, but they do (try to) prevent bad software (ex. virus) from phoning home to pull down updates. That could get on your system via a local exploit (ex. something a friend emailed you, a usb drive, another infected system on your local network, etc..), and then get smarter and grow after it pulls down an update. Granted, I think that belongs on a different layer (network level firewall), if at all, but there is a benefit locally in naive situations or as an added layer.
Re: (Score:2, Informative)
Windows XP has a firewall and it is enabled by default. Why not take Windows XP SP3 with default configuration and see how long it takes to get owned? How is intentionally disabling default security precautions consistent with conclusions related to security of XP?
It doesn't look like they disabled the OS firewall. It looks like what they're saying is that the XP instance was given a public IP as opposed to residing behind network perimeter firewall or NAT device. I didn't watch every frame of the video so I could be wrong, but I didn't find the presenter shutting the firewall off. There is also mention that this is NOT Gold release XP, so it's at least SP1.
Re:Why without firewall? (Score:5, Informative)
It doesn't look like they disabled the OS firewall. It looks like what they're saying is that the XP instance was given a public IP as opposed to residing behind network perimeter firewall or NAT device. I didn't watch every frame of the video so I could be wrong, but I didn't find the presenter shutting the firewall off. There is also mention that this is NOT Gold release XP, so it's at least SP1.
I watched the video. They intentionally disabled the firewall and there is cut where they did it.
Re:Why without firewall? (Score:4, Funny)
It doesn't look like they disabled the OS firewall. It looks like what they're saying is that the XP instance was given a public IP as opposed to residing behind network perimeter firewall or NAT device. I didn't watch every frame of the video so I could be wrong, but I didn't find the presenter shutting the firewall off. There is also mention that this is NOT Gold release XP, so it's at least SP1.
I watched the video. They intentionally disabled the firewall and there is cut where they did it.
If that’s the case, then someone should put up every other flavor of *NIX/BSD to do the same test. See how much fun happens in perspective. All fun and games in the OS demo derby until you realize someone took out your seat belts too.
Re: (Score:1)
Re: (Score:2)
Default install assumes ethernet is "trusted home network" by default last I checked. That's how it gets fucked by worms instantly. It's outside the scope of the firewall.
If you run telephony modem or similar, firewall will assume "untrusted network" and block worms.
Windows 7 asks for ethernet connection if I remember correctly when you connect the first time, and assumes it's untrusted until you specifically tell it its trusted in the wizard pop-up.
Re: (Score:1)
Why not take Windows XP SP3 with default configuration and see how long it takes to get owned?
Probably because the machine will get owned before it finishes downloading Service Pack 3.
Re: (Score:2)
Who is still installing old versions of Windows, but doesn't know how to slipstream a service pack?
Re: (Score:2)
Because it would be rather boring otherwise. It's like installing an old Linux back in the day with no services running. Nothing interesting is going to happen. (There's a video of like Ubuntu 8.04 being run and put on the Internet - by default nothing interesting happens because there's nothing listening).
The fact is, there's still plenty of crap out there running that's still able to infect XP, despite it not being supported for over a decade now and other Windows versions being patched. Chances are if yo
Re: (Score:1)
My guess is the firewall just doesn't initialize early enough in the install process. This is assuming a direct cable connection with no external firewall/router box already in place.
Re: (Score:1)
Also, this has been a problem for at least a decade, on the major cable networks.
Re: (Score:2)
Original flavour XP didn't have the firewall enabled by default. Service Pack 1 enabled it. However, in the video they installed SP3 and disabled the firewall.
They also made sure it had a public IP address, no NAT protection.
Still in use today (Score:5, Informative)
Re: (Score:2)
Re: (Score:2)
museum (Score:2)
Nice museum.
Re: (Score:2)
Also some older phone systems that may still be running fine but are too expensive to update.
IIRC there was a line card you could install in a Nortel(??) system that ran Meridian Mail on top of XP.
A bunch of diagnostic equipment for ophthalmology was still running on XP until at least 5-10 years ago so I bet there are still many clinics or hospitals with such systems & if they're on the network, they're a liability
Re: (Score:2)
How faithful is XP's DOS mode?. I know theres a lot of *really* ancient process control , and weirdly enough accounting, software running on DOS that never gets updated because frankly it aint broken. But sometimes the machines die and need to be updated. I remember having to get.... shit it might have been an old dBase DB, long time ago.... running on I *think* it was windows 2000 and we couldnt get it to work and ended up moving across to windows 98 or ME or one of those old DOS based ones to get it work
Re: (Score:2)
The main saving grace is such systems are not usually exposed directly to the Internet but live on a LAN behind a firewall.
The other saving grace is they are usually not running a very outdated version of Windows XP. XP got a lot of updates over its time with the majority of easily wormable exploits addressed. Sure it's not secure against everything, but in TFA they did disable the firewall intentionally and not run the most up to date version of Windows XP.
And while windows update itself will no long push updates to Windows XP machines making updating one quite a challenge, you can still find ISOs out there with the most up to
Re: (Score:1)
A few days ago I saw a crashed ATM, running Windows _NT_
They replaced that ATM with a complete new one, so no idea what OS that one is running.
Intriguing. (Score:3)
Some of those attacks will be relatively modern malware, but not many for the simple reason that not many targets use XP any more. A lot of these exploits, then, will be exploits discovered at the time XP was mainstream.
We know a lot of factories, and even hydroelectric power stations, put old computers directly onto the Internet with minimal or no protection to allow remote monitoring. So the test is representative of what small BRICS companies experience, along with a percentage of infrastructure.
More importantly, though, it'll be reflective of the difference between the toolkits the srate-sponsored hackers actually use and the public awareness by corporations of what said hackers can do.
We must assume that the percentage of obliviousness has not decreased significantly, because if it had, things like Heartbleed would not have been nearly as bad, and an international medical testing corp wouldn't have been hacked three times in the first four months of this year.
(Only morons connect unsecured computers directly to the public Internet, remote sites needing access are perfectly capable of connecting via proxies or through VPNs. Directly connecting everything is lazy.)
We should assume far, far more successful low-key and undetected attacks than detected+reported ones, for this reason.
In turn, this means we really need OS' and applications software to implement far better security than has been the case.
Itâ(TM)s fun to watch âoe XP! (Score:5, Insightful)
Re: (Score:2)
So old Itâ(TM)s like a website that couldn't format âoeExtended Characters! âoe
That would be Slashdot?
Re: (Score:2)
nothing (Score:3)
i have connected my windows xp pc to the internet and still no malware after several days
Re: (Score:2)
If you firewall it, it's going to be perfectly fine. The main problem is that there are no good mainline internet facing software options for a lot of basic functions. Last browsers that support XP from chromium and gecko engine families are horribly out of date. Same for email clients, etc.
Re: (Score:1)
If there is a will, there is a way: https://github.com/win32ss/sup... [github.com]
Re: (Score:2)
https://win32subsystem.live/su... [win32subsystem.live]
Thanks, I'll add this thing to my windows 7 machine. I was thinking of actually having to install 10 on it because Firefox is now pulling support from 7. This will help me run it without having to install windows 10 and then perform rectal surgery on it to remove the anal probe.
Re: (Score:2)
i installed Mypal browser and it works and gets updated a few times a year but i use it mostly for old games and listening to internet radio
The last time I accidentally exposed Win7 ... (Score:3)
... in an enterprise cloud hosted by IBM, it took less than a minute for me to lose control. It happened (literally) in front of my eyes in 2015.
IBM had a support engineer on site helping me with the migration I was performing when he saw my "aw, $@!+" moment. He laughed a little (despite his own best efforts not to). He then walked me through setting up the LB/FW and VLAN configuration before installing W7 (I needed to migrate an MS-SQL database to support an otherwise Linux/JAVA product).
Speaking from experience (Score:3)
Re: (Score:2)
Re: Speaking from experience (Score:1)
Equivalent Mac OS? (Score:2)
It would be interesting to try the same experiment with Mac OS. That would be some version of Mac OS 9, and the beta version of OS X.
Now we can pinpoint ground zero of the recent outa (Score:2)
So when did you run this test of yours; inquiring minds want to know.
I remember (Score:2)
I remember back in the days when we would raid the computers of all the idiots that went to their dorms and shared their entire file directories. I used to have a lot of porn from that. And music. And I remember one asshole who videoed his girlfriend and left it on his drive. I emailed it to her from information I got from the same drive.
But I remember crapping people off of IRC with Hayes modem commands. I remember sending shit packets and crashing Windows. And I remember what would now be considered rootk
Staged (Score:2)
Is this that video where they got caught intentionally downloading viruses and running them?
Well thank goodness (Score:2)
Well thank goodness we don't need to reply on an old operating system any longer to get malware since Windows 11 comes preinstalled with tons of it. Thank you for making things easier Microsoft.
It will be like Star Trek ... (Score:3)
What Happens If You Connect Windows XP To the Internet In 2024?
It will be like 1960s TOS Star Trek. First a synthesized "does not compute" will be emitted by the speaker and then smoke and sparks will erupt.
Soooo (Score:2)
Hehe (Score:3)
So, basically, the same thing that happened to it in 2003.
Not that insecure (Score:3)
Just stop the "Server" and a couple of other services whose names I don't remember right now (better yet, stop all network services you don't use), and voila, the XP is secure directly facing the Internetz. No firewalls, no NAT, no nothing. The Server, Browser and the Remote Desktop services are the most dangerous ones.
Well now there's a surprise. (Score:2)
Next you'll tell me somebody has managed to solve a Rubik's Cube in under 30 seconds.
Who cares? (Score:2)
EOM
Why wait for the install to complete? (Score:3)
Why wait for the install to complete? I remember installing XP in around 2000, direct to ISP's Motorola Cable Modem, no firewall. The install failed as it was compromised by a worm, sasser or blaster I guess, *during* the install. I had to start again, install offline and install a software firewall from CD before going online.
Even worse... (Score:2)
I ran a webserver (32-bit Apache/Win) on Windows 98SE for about ten years, until about 2018. Basic security precautions and not much traffic, but still port 80 was wide open to the world. It was fine.
IP address leads back to the Russian federation :o (Score:2)
It's well known that the FSB is too stupid to redirect traffic through a third part ISP