Has anyone taken a look at Win9x' networking components?

[BenoitRen]

If you ever run into a certain KaiRo on #seamonkey on irc.mozilla.org, beware as he's blinded by his hate for Win9x. Yet, I think he had a point today.

There's more than just the browser in Win9x that is important to security. The TCP/IP stack, DNS cache, and other things.

So, did anyone have a look at those yet? Are there any unofficial updates? Now that Win98 is unsupported, it won't be easy to know possibly flaws...

Edited February 11, 2007 by BenoitRen

[Acheron]

The problem isn't Windows 98. Remember a few years ago almost everything securtiy related released by Microsoft was due to Internet Explorer or Windows Service Problems. Since Windows 98 doesn't run any services by default there were only few security related problems specific. Most issues are patched so far. The only one I know so far left is an issue with NetBIOS: http://www.msfn.org/board/index.php?showto...amp;hl=security

[BenoitRen]

I'm not sure about that.

BenoitRen, KaiRo: I had a look at the 78 critical updates for Windows 98, and a large number of them are to do with Internet Explorer, but there are enough non-IE ones so that you can't be complacent

Neil is very knowledgable and pretty neutral on these things, so I trust his judgment.

[Acheron]

I'm not sure about that.

BenoitRen, KaiRo: I had a look at the 78 critical updates for Windows 98, and a large number of them are to do with Internet Explorer, but there are enough non-IE ones so that you can't be complacent

Neil is very knowledgable and pretty neutral on these things, so I trust his judgment.

Then why ask questions on MSFN when you already have your answers

[BenoitRen]

Neil has taken a look at the issued updates by M$, not the actual components themselves. For example, maybe someone looked at the TCP/IP stack when a flaw was found in Windows 2000's TCP/IP stack, and produced an unofficial patch for Win9x. Stuff like that.

As I said, official support is gone. Now we have to make unofficial updates to whatever flaws are found in the networking components.

[MDGx]

My 2 ¢ :

We don't "make" unofficial updates [except the few (esdi_506.pdr, kernel32.dll, shell32.dll + a few others) figured out by the few programmers who kindly donate their spare time to these projects], we download + extract M$ official files from other OSes, and rebundle them with iexpress to make them install on 98, 98 SE and/or ME.

The TCP/IP stack [+ WinSock32] in Win98/98 SE/ME is a very simple stack, in its default mode [the way it is installed on a "fresh" system without modifications/tweaks] has very few security issues, *except* NetBIOS [the major one I can think of right now].

HTH

[TravisO]

Let me sum it up with this (poor) analogy: It's kind of like living on the beach and you hide an unmarked key to your house in the sand. Is that a possible security problem, yes, but should you be worried, no.

Win98's lack of security updates relating to non IE things are a mixed blessing. The truth is, I'm sure there are many bugs left with the Win98 networking, but the simple truth is, hackers & security experts aren't wasting their time with exploits for 10yr old OSs. They are only concerned with server OSs and XP & Vista, they aren't taking the time to play with the 9x stack anymore.

The only reason new 9x flaws are found is because something a hacker discovers in 2003 or XP happens to also exist in 98 as they most likely tested the exploit out in a Virtual PC session just to see if it works. So realize that possible flaws might still exist, but they won't be found because nobody is looking for them, so it happens to make Win 98 secure.

[BenoitRen]

Thanks for the replies. However, since I wrote Win9x, I also mean Win95. What about its networking components? Or does the Dial-up Networking 1.4 upgrade have everything to bring it up to par with Win98's?