Old Windows based test equipment Security  - Page 1
Forum section: electronics / testgear

author: joeqsmith
author_rank: Super Contributor
timestamp: August 01, 2025, 04:44:01 pm
content: I have various test equipment that uses Windows 2000 & XP. To share files requires SMB1. To date, I have basically ignored the security risks. What are you doing?

author: squadchannel
author_rank: Frequent Contributor
timestamp: August 01, 2025, 05:28:24 pm
content: It would be great if could build a firewall or SMB1-2 bridge for the old system.

author: madires
author_rank: Super Contributor
timestamp: August 01, 2025, 05:32:16 pm
content: I'd put them into a separate network, add a linux system with two ethernet ports (one for the old T&M, one for the normal LAN), run two instances of samba (SMB1 for the old T&M, SMB2/3 for the LAN). The linux system can be also used for routing and as firewall.

author: CustomEngineerer
author_rank: Frequent Contributor
timestamp: August 02, 2025, 02:04:06 am
content: They go on their own network that doesn't have access to the internet or anything else outside of the network. If I'm using a computer to control them it has access to them, but not the other way around.

author: JimboJack
author_rank: Regular Contributor
timestamp: August 02, 2025, 02:05:32 am
content: hunt for hacking exposed series of book from Y2K time on securing Windows NT and W2K , NT3.51->W2K was basically directX for games to run.go dual nic setup a gateway machine one side your insecure SMB1 it own dedicated VLAN MAC/IP range, the other side the modern world,via a server , none shall pass direct to each other etc.M$ is pretty much insecure, back then min spec was to not install to any network , hot glue the USB ports and NIC slot, for highest security was not too install it. 'no joke'. other than that securing windows was to remove all the M$ network stack, including netbios, rely on TCP/IP , the hacking exposed books on M$ does a simple check list and scripts to run as a baseline.

author: KungFuJosh
author_rank: Super Contributor
timestamp: August 02, 2025, 02:16:23 am
content: Is your home/lab network behind a firewall? Maybe two firewalls?Do you have reason to believe that a hacker would target you, and understand the workings of your network well enough to exploit outdated lab equipment?What will they do from there?I agree with what others have said about multi-level networks, and firewalls. I also think it's slightly paranoid unless you're developing something top secret and have reason to believe somebody cares. Necessary or not, operating from a point of paranoia can be helpful/preventative.

author: coromonadalix
author_rank: Super Contributor
timestamp: August 02, 2025, 02:20:12 am
content: there was some report about leaving xp or 7 connect to the web, it did not took long before bots and malware find them ....

author: KungFuJosh
author_rank: Super Contributor
timestamp: August 02, 2025, 02:37:10 am
content: Quote from: coromonadalix on August 02, 2025, 02:20:12 amThat was kind of silly:https://www.reddit.com/r/technology/comments/1cu6zj0/someone_connected_windows_xp_to_the_internet_and/Bots and malware can't magically appear on idle computers behind firewalls. If somebody went to a malicious website, with no internet security at all, on a public IP, then they might be in trouble.Even your ISP should have some layer of protection...how good it is, I dunno.

author: Cyclotron
author_rank: Unknown
timestamp: August 02, 2025, 02:51:54 am
content: Quote from: joeqsmith on August 01, 2025, 04:44:01 pmAt work or home? At home I run my lab and office as an isolated LAN but still having access through my firewall. My home has another VLAN for the normal home stuff. At work, labs are often isolated but generally speaking within the lab there are little need for high security but that really depends on the data and the systems the instruments are working with. I would expect any place to consider it a major issue to use SMB1 to use modern gear that doesn't use that protocol.

author: DimitriP
author_rank: Super Contributor
timestamp: August 02, 2025, 03:13:54 am
content: Quote from: coromonadalix on August 02, 2025, 02:20:12 amPerhaps someone can explain how using an old machine with an oudated browser to "connect to the web"* will be "found" by a bot or malware.* "connect" meaning behind a NAT router/firewall and not diretly connected using a public IP address

author: Cyclotron
author_rank: Unknown
timestamp: August 02, 2025, 03:26:05 am
content: Quote from: DimitriP on August 02, 2025, 03:13:54 amI believe you mean "found" in the sense of an attacker probing for your browser? Directly initiated attacks at your host would be prevented by a firewall.But, the risk of outdated browsers is not in being "found" in that sense but being discovered in traps that are all over the web for such browsers. Now that being the case, you can try to avoid the dark alleys of the internet but every now and then the malicous code leaks into more trustworthy sites.Many very outdated browsers can't even talk to the "normal" web today because of several factors. They do not have an up-to-date CA list, they don't support modern ciphers or HTTP protocols. If you tried to use Internet Explorer 6 on the internet it will fail miserably.

author: J-R
author_rank: Super Contributor
timestamp: August 02, 2025, 03:58:21 am
content: Since I work in the IT industry, I am comfortable having what I consider an ideal setup, which is a small virtualization cluster with software firewall/routing combined with switches and wireless access points that support VLANs. So in that case it's easy to isolate equipment in any desired arrangement. For example, all of my cloud-managed devices are isolated and can only access the internet because they are black boxes and untrusted.However, it's understandable that not everyone is going to be willing or able to put together something similar on their own.One relatively easy solution is to set up what is called double NAT, where you simply connect a second home router downstream from your main or ISP router. The WAN port of your second router is connected to a LAN port on your first router. Place your old test equipment on the LAN of the second router, and place all your modern home devices on the LAN of the first router. The concept here is that your main home devices are high risk, since you constantly use them to access the Internet and could be hit by some zero day or unpatched attack via web browser or e-mail or etc.. But they are not able to reach the test equipment, protecting those from easy attacks that have been known for decades. (Side note, be sure each router uses a different private IP address range.) You can poke holes in the second firewall as needed to access the test equipment, preferably via some secure method.Another option that is a step up from there would be to buy a router with multiple interfaces, such as this:https://shop.netgate.com/products/1100-pfsenseYou can isolate your test equipment on the OPT port and set up specific rules on what can talk to what, similar to the previous example.Accessing various random websites from an old device running an old browser like IE is definitely a bad idea. Compromised websites and advertisements ARE out there. Many websites run an excessive amount of questionable third party code, such as tracking/analytics/plugins/etc. which could also be an entry point for compromising your test equipment. Modern browsers have a lot of extra protections.

author: Rubo
author_rank: Regular Contributor
timestamp: August 02, 2025, 09:14:29 pm
content: Since network security is kind of my main job, as long as you have a somewhat current/decent router, they already have a basic firewall.Just like others have mentioned already, don't use your test equipment to browse the internetand you'll be fine.You can always take any of the previously mentioned steps (a good firewall with multiple subnets/vlans with isolation between them, double nat, etc.) if you want a piece of mind.

author: Cyclotron
author_rank: Unknown
timestamp: August 02, 2025, 10:36:53 pm
content: How many of us work in the IT industry?I've been an IT Operator, Engineer, and now an IT Architect for most of my career. I spent my early days in Industrial Robotics.At my last job, I was Director of IT and hired a guy that is/was and EE. He was testing the waters and I told him he could likely make more money in IT.He's stuck with it and is one of the head engineers at the previous company I worked at.

author: Conrad Hoffman
author_rank: Super Contributor
timestamp: August 02, 2025, 11:20:01 pm
content: We have a couple old systems at work that have no upgrade path. Our simple solution is they can't access anything and if you need data in or out, you grab a flash drive and use sneakernet.

author: Fungus
author_rank: Super Contributor
timestamp: August 02, 2025, 11:38:58 pm
content: https://xkcd.com/3109/