Re: Security risks of obsolete hardware/software

[Pete Helgren <pete@xxxxxxxxxx>]

"BUT...are obsolete products necessarily tested for all new 
vulnerabilities?"

Yes.  The process is called "hacking"...:-)

So what I mean to say is that NEW exploits on obsolete hardware and 
software are constantly found and are "advertised" on hacking lists 
(hence the reference to Metasploit) and on vulnerability bulletins from 
various sources.  If everyone stayed on current patches and supported 
hardware, hackers would have a much harder job relying solely on zero 
day exploits.  BUT, people are lazy and fail to patch and run 
unsupported hardware and software that is known to have vulnerabilities.

Rob could continue to run the device until an exploit is found or thing 
goes casters up.  I don't necessarily recommend it it but I have plenty 
of devices and software that are VERY long in the tooth, are 
unsupported, but are still secure.  Until proven otherwise, I'll keep 
running them.  The point is that obsolete doesn't mean exploitable...it 
just means that you don't get a fix when an exploit is found. But there 
are plenty of lists that publish newly found exploits on old hardware 
and software (because people run old hardware and software that is long 
out of support).

Pete Helgren
www.petesworkshop.com
GIAC Secure Software Programmer-Java

On 3/18/2013 9:49 AM, Charles Wilt wrote:
> BUT...are obsolete products necessarily tested for all new vulnerabilities?