Re: Security risks of obsolete hardware/software

"BUT...are obsolete products necessarily tested for all new vulnerabilities?"

Yes. The process is called "hacking"...:-)

So what I mean to say is that NEW exploits on obsolete hardware and software are constantly found and are "advertised" on hacking lists (hence the reference to Metasploit) and on vulnerability bulletins from various sources. If everyone stayed on current patches and supported hardware, hackers would have a much harder job relying solely on zero day exploits. BUT, people are lazy and fail to patch and run unsupported hardware and software that is known to have vulnerabilities.

Rob could continue to run the device until an exploit is found or thing goes casters up. I don't necessarily recommend it it but I have plenty of devices and software that are VERY long in the tooth, are unsupported, but are still secure. Until proven otherwise, I'll keep running them. The point is that obsolete doesn't mean exploitable...it just means that you don't get a fix when an exploit is found. But there are plenty of lists that publish newly found exploits on old hardware and software (because people run old hardware and software that is long out of support).

Pete Helgren
www.petesworkshop.com
GIAC Secure Software Programmer-Java

On 3/18/2013 9:49 AM, Charles Wilt wrote:

BUT...are obsolete products necessarily tested for all new vulnerabilities?