Hacker News Reader

Comment by owenmarshall | Hacker News Reader

Do you suspect there are any 0day/worms still targeting Windows 95 systems?

I wonder if an unpatched Win95 box is actually safer than an unpatched modern Windows box.

Win95 is running as root by default. Any process can open another's memory. It has the same registry entry as Windows NT for running a program on startup. The keylogging API is basically the same. The IShellFolder and IWebBrowser interfaces are identical, so as long as the malware didn't request specific classes or features that are outside the realm of Windows 95, it can probably do pretty well. Luckily, Internet Explorer 3 doesn't support TLS.

Except for the Ex functions. I wonder if a malware can be run under KernelEx.

That floppy disk controller is the only way into the box and isn't nearly as vulnerable as a modern usb controller since there's no smarts!! The windows 95 system is going to be safer than a patched windows 10 on the network for their use case.

For the common-case en masse compromises, not a concern. For targeted attacks it can still be an issue. Stuxnet is an example of this where they compromised an air-gapped system. Stuxnet was obviously extremely sophisticated, technically and for the overall operation, but the principles still apply. Also people frequently misjudge how big of a target they may be & what their risk profile really is (not saying for this use-case specifically, just in general).

>Do you suspect there are any 0day/worms still targeting Windows 95 systems?

You'd be surprised how much malware is "legacy" 32-bit and works without issue on WinXP. A lot of malware even shies away from Unicode API's and specifically calls out the *A Win32 API functions.

Considering the Win32 API is backwards compatible to a fault, I don't see why modern malware couldn't absolutely wreck a Win9x box.

Yes, but Windows XP was in widespread use until recently and is still in use in a lot of places. I don't know where "netmarketshare.com" takes their user statistics (Google just used them when i searched for that) but it reports "1.26%" for Windows XP, which i think is still a large number. There are still so many users of Windows XP that Microsoft released a critical security patch last year despite XP being official EOL for years now.

Sure – once the malware lands. But I doubt anyone is going after any Win95 vulnerabilities, so how does it get on the box to start chomping?

Loaded from the boot sector of any floppy that happens to be present when the system is restarted, unless the boot order has been changed from factory defaults and the (possibly very old) coin cell powering NVRAM holds sufficient charge to retain these changes when (if) the system is ever powered off.

In general, attacks (e.g. most ransomware campaigns) are not automated malware spreading on its own, they involve people. If it's accessible on a network (which is the big 'if'), then it's obvious on any scan that it's a Win95 machine, and then you can try to look up a vulnerability for any exposed service. For example, if file sharing is running, then all the SMB vulnerabilities (e.g. EternalBlue and friends) apply also to Win95 systems, and I'm not sure if Windows 95 had a patch made, backported and issued for them.

Eh, no. Not by a chance. I have some old as heck games which don't even work even under W2k with w9x compat mode (it's hidden, you need a command to enable it), so a total nope under XP.

Windows XP (NT kernel) and 9x are totally different OSes, using totally different kernels. They share some API, but not really the interesting parts.

I work on software that still supports XP with only a little pain. Visual Studio 2019 will still install the necessary toolchain if you ask nicely. Targeting Windows 95/98 in 2020 sounds like a nightmare.

> Visual Studio 2019 will still install the necessary toolchain if you ask nicely

Could I get a link to how to do this and/or web search terms? Is this just something targeting visual C runtime 20xx or older?

Reply on news.ycombinator.com