Old Windows based test equipment Security

[joeqsmith]

I have various test equipment that uses Windows 2000 & XP.  To share files requires SMB1.  To date, I have basically ignored the security risks.  What are you doing?

[squadchannel]

It would be great if could build a firewall or SMB1-2 bridge for the old system.

[madires]

I'd put them into a separate network, add a linux system with two ethernet ports (one for the old T&M, one for the normal LAN), run two instances of samba (SMB1 for the old T&M, SMB2/3 for the LAN). The linux system can be also used for routing and as firewall.

[CustomEngineerer]

They go on their own network that doesn't have access to the internet or anything else outside of the network. If I'm using a computer to control them it has access to them, but not the other way around.

[JimboJack]

hunt for hacking exposed series of book from Y2K time on securing Windows NT and W2K , NT3.51->W2K was basically directX for games to run.

go dual nic setup a gateway machine one side your insecure SMB1 it own dedicated  VLAN MAC/IP range, the other side the modern world,via a server , none shall pass direct to each other etc.

M$ is pretty much insecure, back then min spec was to not install to any network , hot glue the USB ports and NIC slot,  for highest security was not too install it. 'no joke'. other than that securing windows was to remove all the M$ network stack, including netbios, rely on TCP/IP , the hacking exposed books on M$ does a simple check list and scripts to run as a baseline.

[KungFuJosh]

Is your home/lab network behind a firewall? Maybe two firewalls?

Do you have reason to believe that a hacker would target you, and understand the workings of your network well enough to exploit outdated lab equipment?

What will they do from there?

I agree with what others have said about multi-level networks, and firewalls. I also think it's slightly paranoid unless you're developing something top secret and have reason to believe somebody cares. Necessary or not, operating from a point of paranoia can be helpful/preventative.

[coromonadalix]

there was some report about leaving xp or 7 connect to the web, it did not took long before bots and malware find them ....

[KungFuJosh]

there was some report about leaving xp or 7 connect to the web, it did not took long before bots and malware find them ....

That was kind of silly: https://www.reddit.com/r/technology/comments/1cu6zj0/someone_connected_windows_xp_to_the_internet_and/

Bots and malware can't magically appear on idle computers behind firewalls. If somebody went to a malicious website, with no internet security at all, on a public IP, then they might be in trouble.

Even your ISP should have some layer of protection...how good it is, I dunno.

[Cyclotron]

I have various test equipment that uses Windows 2000 & XP.  To share files requires SMB1.  To date, I have basically ignored the security risks.  What are you doing?

At work or home?  At home I run my lab and office as an isolated LAN but still having access through my firewall. My home has another VLAN for the normal home stuff. At work, labs are often isolated but generally speaking within the lab there are little need for high security but that really depends on the data and the systems the instruments are working with. I would expect any place to consider it a major issue to use SMB1 to use modern gear that doesn't use that protocol.

[DimitriP]

there was some report about leaving xp or 7 connect to the web, it did not took long before bots and malware find them ....

Perhaps someone can explain how using an old machine with an oudated browser to "connect to the web"* will be "found" by a bot or malware.


* "connect" meaning behind a NAT router/firewall and not diretly connected using a public IP address

[Cyclotron]

Perhaps someone can explain how using an old machine with an oudated browser to "connect to the web"* will be "found" by a bot or malware.

* "connect" meaning behind a NAT router/firewall and not diretly connected using a public IP address

I believe you mean "found" in the sense of an attacker probing for your browser? Directly initiated attacks at your host would be prevented by a firewall.

But, the risk of outdated browsers is not in being "found" in that sense but being discovered in traps that are all over the web for such browsers. Now that being the case, you can try to avoid the dark alleys of the internet but every now and then the malicous code leaks into more trustworthy sites.

Many very outdated browsers can't even talk to the "normal" web today because of several factors. They do not have an up-to-date CA list, they don't support modern ciphers or HTTP protocols.  If you tried to use Internet Explorer 6 on the internet it will fail miserably.

[J-R]

Since I work in the IT industry, I am comfortable having what I consider an ideal setup, which is a small virtualization cluster with software firewall/routing combined with switches and wireless access points that support VLANs.  So in that case it's easy to isolate equipment in any desired arrangement.  For example, all of my cloud-managed devices are isolated and can only access the internet because they are black boxes and untrusted.

However, it's understandable that not everyone is going to be willing or able to put together something similar on their own.

One relatively easy solution is to set up what is called double NAT, where you simply connect a second home router downstream from your main or ISP router.  The WAN port of your second router is connected to a LAN port on your first router.  Place your old test equipment on the LAN of the second router, and place all your modern home devices on the LAN of the first router.  The concept here is that your main home devices are high risk, since you constantly use them to access the Internet and could be hit by some zero day or unpatched attack via web browser or e-mail or etc..  But they are not able to reach the test equipment, protecting those from easy attacks that have been known for decades.  (Side note, be sure each router uses a different private IP address range.)  You can poke holes in the second firewall as needed to access the test equipment, preferably via some secure method.

Another option that is a step up from there would be to buy a router with multiple interfaces, such as this: https://shop.netgate.com/products/1100-pfsense
You can isolate your test equipment on the OPT port and set up specific rules on what can talk to what, similar to the previous example.


Accessing various random websites from an old device running an old browser like IE is definitely a bad idea.  Compromised websites and advertisements ARE out there.  Many websites run an excessive amount of questionable third party code, such as tracking/analytics/plugins/etc. which could also be an entry point for compromising your test equipment.  Modern browsers have a lot of extra protections.

[Rubo]

Since network security is kind of my main job  , as long as you have a somewhat current/decent router, they already have a basic firewall.

Just like others have mentioned already, don't use your test equipment to browse the internet    and you'll be fine.

You can always take any of the previously mentioned steps (a good firewall with multiple subnets/vlans with isolation between them, double nat, etc.) if you want a piece of mind.

[Cyclotron]

How many of us work in the IT industry? 

I've been an IT Operator, Engineer, and now an IT Architect for most of my career. I spent my early days in Industrial Robotics.

At my last job, I was Director of IT and hired a guy that is/was and EE.  He was testing the waters and I told him he could likely make more money in IT.
He's stuck with it and is one of the head engineers at the previous company I worked at.

[Conrad Hoffman]

We have a couple old systems at work that have no upgrade path. Our simple solution is they can't access anything and if you need data in or out, you grab a flash drive and use sneakernet.

[Fungus]

https://xkcd.com/3109/