Jump to content

Why do you still use 9X


win95guy

Recommended Posts

an NT OS can be taken over simply by sending a specially crafted packets to its ports leading to buffer overflow and code execution, remote control of the machine.

Like cluberti said, that's on a unpatched box only, it only affects versions that are like 10 years old, and that's also after bypassing firewalls. And that's hardly a NT-only thing. The same can be said for just about any software that uses the network in any way, like web browsers for example.

Someone could use one of the (very common) flash exploits or anything along those lines (browser exploit, etc), and use that to pwn your box (view the wrong page, get infected). At least, with a modern OS, the default browser is sandboxed so it won't actually do anything, and even if it somehow got past that (highly unlikely), then you're still not running as admin so no system files or apps would get infected (no permissions) and so on. It just can't do very much.

The same flash exploit used on an OS like Win9x means getting thoroughly PWNED (assuming the code can actually run on that old OS) -- there's absolutely NOTHING standing in its way: full access to memory, processes, files, registry, etc. So from there it can infect your system files, download some more malware, terminate processes of any "security" app, install rootkits and anything else it so pleases. There's absolutely nothing to stop it. When someone has that level of access to your box, it's game over. And it's definitely a LOT easier to accomplish such things against older OS'es like Win9x that don't have anything like DEP/NX bit support, where code can be executed inside data-only memory (zero buffer overflow protection).

The real protection against these vulnerabilities is keeping updated, which you can't really do anymore in Win9x' case as extended support ended years ago. Win9x security is an oxymoron. Your only security is not being a target.

Besides, all the people saying how XP is so insecure and such things... I haven't had a single virus in 5+ years, ~2/3 of that while running XP with local admin privileges. Running as a standard user used to be a pain circa 2000 too, but software has gotten a lot better in the last 10 years.

Link to comment
Share on other sites


Cars don't get stolen, driven by lunatics, and end up killing people 'by default'.

This isn't Slashdot. Your car analogy doesn't work.

Your point holds weight in the fact that most home users are unaware of the fact that NT based OSes default settings may leave them at risk, but it does not make NT inherently insecure.

In a way, it does. If there's nothing to compromise, that system is 100% secure. The fact that NT opens services to the outside means it's not secure, as it makes it susceptible to attacks.

98 and 95s only cover is its so called 'secure default setup' which again, doesn't make it secure by design.
It is not secure (Such a novelty on an OS that runs everything as root is an oxymoron).
you have to be realistic - the flat memory and no process security or separation model is 100% the achilles' heel of 9x system security.
Win9x security is an oxymoron.

Like many others before you who have argued this subject, you confuse local security with remote security. Not to mention that NT security is a joke to hackers, because there are several backdoors to administrator status, some of which can even be used remotely.

no firewall by default

A software firewall is not useful.

no anti-malware included

Anti-malware is one of the top 6 dumbest ideas in computer security.

Most of its security comes from its 0.1% market share

Nonsense. This is not security through obscurity. You can't attack what isn't there.

The real protection against these vulnerabilities is keeping updated, which you can't really do anymore in Win9x' case as extended support ended years ago.

The OS itself doesn't get updated, but many programs that run on it still do. The web browser being the most important one.

Link to comment
Share on other sites

Like many others before you who have argued this subject, you confuse local security with remote security.

Not at all. Like I said, anything that uses the network is affected by buffer overflows and such exploits. That was merely one example.

Not to mention that NT security is a joke to hackers, because there are several backdoors to administrator status, some of which can even be used remotely.

If you say so :rolleyes:

A software firewall is not useful.

They certainly are, be they software, or software running on a specialized box (*all* firewalls are basically software). But hey, you keep thinking that.

Anti-malware is one of the top 6 dumbest ideas in computer security.

According to you, perhaps (BTW, Ranum's ideas are quite funny). The rest of us live in the real world, where bad things happen now and then, and have to be fixed. Just like we have hospitals in case you break your leg.

Nonsense. This is not security through obscurity.

You're right, it's security by incompatibility (based on obsolescence) and not being a target. It has nothing to do with obscurity.

The OS itself doesn't get updated, but many programs that run on it still do. The web browser being the most important one.

The OS certainly needs it, just like the browser (many users in this section are still using IE6 too) and plenty of other software.

Your own extremely limited view of security seems to rest solely on having network services or not (being featureless), disregarding everything else, especially when the rest is so full of holes that there's practically only air left.

Link to comment
Share on other sites

Not at all. Like I said, anything that uses the network is affected by buffer overflows and such exploits. That was merely one example.

Once the malware has entered your system, you have already lost. It's the same on NT.

They certainly are, be they software, or software running on a specialized box (*all* firewalls are basically software).

Ooh, so you're trying to argue semantics now. A firewall running on your computer is not the same as running it on your router, which is a specialised computer that is much more capable.

According to you, perhaps (BTW, Ranum's ideas are quite funny). The rest of us live in the real world, where bad things happen now and then, and have to be fixed. Just like we have hospitals in case you break your leg.

Except computer security is not like the real world.

Your own extremely limited view of security seems to rest solely on having network services or not (being featureless), disregarding everything else, especially when the rest is so full of holes that there's practically only air left.

Again, you're confusing local security with remote security. We know Win9x has no security model, and that's not necessarily a problem.

Security is a process, not a product. Not having exploitable services is one thing. Practicing security in everyday use is another.

Link to comment
Share on other sites

Yes I guess if you want to play with an os win 98 is ok .Try coding in ms access and see how long it is before you have to reboot due to the memory leaks in it and that was ms access 2. If you don’t want to move ahead stick with 98 one person mentioned not upgrading from win 98 for the little bit of speed increase well a quad with 16 gig of ram will blow you away for speed but of course it wont run on win 98. If you have no need to use, and learn new programs stay with win 98. Myself I thought Computers where to learn, I want to see one of you stead fast win 98 only users to go and fix a vista or xp pc. But yes I guess if you stay in your house and only want to run old stuff win 98 is for you. I know guys that still use dialup also and log onto BBs hehe. But i really suspect most still use win 98 because of older pc's but even a p3 800 can run xp fine.

Hammey

Link to comment
Share on other sites

cuberti and CoffeFiend, your dishonesty or blindness in this discusssion is nothing short of staggering IMO.

For example CoffeFiend is equating an OS just sitting there with an internet connection with an OS exposing an interactive interface such as a web browser to the Internet and refuses to acknowledge certain unbelievable NT platforms vulns.

Other example is cuberti who escapes completely the point about the run as utility which is to say that code downloaded and executed through one or another exploit will have zero difficulty to get admins rights and take control of the whole machine because code to bypass those limited rights is just trivial to write. I am not speaking about fooling someone into clicking on the run as utilty of course as you wanted to undestand what I wrote. What I was saying is that even Microsoft provided code to anyone able to reverse-engineer this tiny run as utility so they can write malware bypassing limited user rights...

Pass me your emails guys and I'll send you a few innocent executables as attachements like Microsoft recommended to people not so long ago... (Look for Microsoft Picture It Print Studio 2001 if you don't believe that :whistle: )

Edited by eidenk
Link to comment
Share on other sites

As for me, I have two PCs, modern one Core 2 Duo in the city at my flat where I live most of time with Vista, and a second PC in our family house in the countryside with Windows 98. I installed Win98 on it because I had only 1,7 Gb HDD when I built it. It has Celeron 1GHz and 256 Mb RAM, but HDD is enough only for Windows 98. All other HDDs are in my newer PC, and if I by a new HDD, I'll place it to the new PC, because I need more space there. Now after more than a year of using Windows 98 PC, running Windows 98 became my hobby. Even if I find an HDDD for it, I'll stay with Win98 until this PC will die. And I like to play old games, that need DOS. Personally I consider XP the best Windows, and 98 is my second favorite. Vista sucks, I installed it only because I had troubles with my not very good MoBo - Asus P5K under XP.

Link to comment
Share on other sites

I keep one computer with Windows 98 because it happens to have a Voodoo 5500 in it. And GL/Glide works best on that card than anything else, and it works best with Windows 98. So in case I ever want to play an old game, or use an old renderer, I can do it on there.

Link to comment
Share on other sites

cuberti and CoffeFiend, your dishonesty or blindness in this discusssion is nothing short of staggering IMO.

For example CoffeFiend is equating an OS just sitting there with an internet connection with an OS exposing an interactive interface such as a web browser to the Internet and refuses to acknowledge certain unbelievable NT platforms vulns.

Defaults... security... obscurity... going round in circles... etc

Other example is cuberti who escapes completely the point about the run as utility which is to say that code downloaded and executed through one or another exploit will have zero difficulty to get admins rights and take control of the whole machine because code to bypass those limited rights is just trivial to write. I am not speaking about fooling someone into clicking on the run as utilty of course as you wanted to undestand what I wrote. What I was saying is that even Microsoft provided code to anyone able to reverse-engineer this tiny run as utility so they can write malware bypassing limited user rights...

After reading this post, I now understand fully your lack of understanding of Windows. You have a fundamental misunderstanding of how Windows NT works, and to be quite honest, after reading that... rubbish... I think it's quite fortunate you have stuck to Windows 98 or whatever it is you use. Your arguments throughout this entire thread have consisted of 'I am more secure using my OS because of features that aren't there or are not enabled by default'. Seriously, what kind of argument is that? I've heard more sense than that from MySpace forums. RunAs is actually a service which can be disabled if the user feels it so necessary. I don't even believe the exploit you are talking about exists, but if it did/does, it would be negated anyway by having a password on the administrator account and guest account which should be standard practise anyway. Not only that, but it would have been addressed by Microsoft, like they did with the Messenger service when it started being abused bigtime. Admittedly, that service was a cockup right from the start, and if it had been designed only to allow LAN communication (instead of WAN communication) it would have been feasible to leave it enabled.

Edited by JustinStacey
Link to comment
Share on other sites

and to be quite honest, after reading that... rubbish... I think it's quite fortunate you have stuck to Windows 98 or whatever it is you use. Your arguments throughout this entire thread have consisted of 'I am more secure using my OS because of features that aren't there or are not enabled by default'. Seriously, what kind of argument is that? I've heard more sense than that from MySpace forums.

Settle down there. :no:

Link to comment
Share on other sites

Myself I thought Computers where to learn, I want to see one of you stead fast win 98 only users to go and fix a vista or xp pc. But yes I guess if you stay in your house and only want to run old stuff win 98 is for you.

I've been an ASAP member for the last 4+ years. In that time, I've battled and removed more malicious code than most users will ever see, most of it from XP. Debating Windows security from a theoretical perspective is useless. No version of Windows is secure out of the box. That is what matters since most of them are used with out of the box settings. It runs in admin mode by default, as do most users. Out of the box, they're all security nightmares. Vista may have improved the security but it has other "features" that I find unacceptable. That's another discussion.

The NT systems do provide better separation between users than 9X, aka local security. That has not made it any more secure against threats from the internet. If anything, the NT file system made NT systems vulnerable to a class of malware (rootkits) that is difficult to detect and can be very hard to remove. A file system that makes it easy to hide executables and processes is not a security asset. Each OS has its strengths and weaknesses in regards to security. 9X systems don't restrict administrative access. NT systems have a larger attack surface. 9X is more vulnerable to attacks originating locally. NT systems are more vulnerable to web based attacks. Choose your vulnerability.

you have to be realistic - the flat memory and no process security or separation model is 100% the achilles' heel of 9x system security.

On NT systems, that separation was defeated so often and easily that the results weren't much better. The "admin mode" only design of 9X systems is not a problem when a default-deny security policy is implemented. That same policy would have put an end to all those privilege escalation exploits on NT systems.

Newer NT systems do have more built in tools for improving security, firewall, LUA, etc. 9X systems require 3rd party software to implement the same functions. That said, the 3rd party tools do a better job of it. I'd trust a 3rd party firewall a lot more than the XP firewall. The 3rd party firewall gives better control over traffic to/from system process, not to mention outbound control. I'll also trust a classic HIPS like SSM more than Windows built in tools. SSM allows me to control system processes, not just installed applications.

As installed, a 9X system is vulnerable, just like XP. They have different weaknesses, but both can result in a completely compromised system. With properly configured 3rd party tools, 9X can be made secure against most anything except the users themselves. With the right configuration, even user stupidity can be made a non-issue. The same applies to NT systems.

This thread has been going in circles and doing nothing useful. Out of the box, they're all vulnerable. They can all be secured against anything but a user with administrative access, including 98. With 3rd party software, an effective limited mode can be created on 98. It may not be part of the original core OS but it will function just as effectively.

Link to comment
Share on other sites

and to be quite honest, after reading that... rubbish... I think it's quite fortunate you have stuck to Windows 98 or whatever it is you use. Your arguments throughout this entire thread have consisted of 'I am more secure using my OS because of features that aren't there or are not enabled by default'. Seriously, what kind of argument is that? I've heard more sense than that from MySpace forums.

Settle down there. :no:

He's still correct. Anyone who believes that Windows 98 offers better security then the Windows NT based platform obviously doesn't understand the metrics behind the equations to determine so. That lack of anything that is capable of user rights assignment for the file system or registry should be a glaring difference to start with. The list could go on forever.

Link to comment
Share on other sites

Yes I guess if you want to play with an os win 98 is ok .Try coding in ms access and see how long it is before you have to reboot due to the memory leaks in it and that was ms access 2. If you don’t want to move ahead stick with 98 one person mentioned not upgrading from win 98 for the little bit of speed increase well a quad with 16 gig of ram will blow you away for speed but of course it wont run on win 98. If you have no need to use, and learn new programs stay with win 98. Myself I thought Computers where to learn, I want to see one of you stead fast win 98 only users to go and fix a vista or xp pc. But yes I guess if you stay in your house and only want to run old stuff win 98 is for you. I know guys that still use dialup also and log onto BBs hehe. But i really suspect most still use win 98 because of older pc's but even a p3 800 can run xp fine.

Hammey

Bring me that "quad with 16 gig of ram" and I wil put it to good use with Windows 98.

I already have an 8GB system with 3GB of System RAM and 5GB of RAMDisks.

I recently wrote software to allow programs to Allocate and use 64-Bit RAM.

I am working on multicore software as well.

All of the RAM related software is available in the Main and Prerelease sections on my website at:

rloew1.no-ip.com

Link to comment
Share on other sites

I already have an 8GB system with 3GB of System RAM and 5GB of RAMDisks.

Seriously? 5 GB of ramdisks? why? in case you decide you want to read an entire uncompressed DVD onto a ram drive? how useful could that really be? I usually avoid car analogies but i cant help but picture a Geo Metro(the 3 cylinder one) with Windows 98 logo spraypainted on the side attempting to pull 5 Railroad cars.

Link to comment
Share on other sites

Guest
This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
×
×
  • Create New...