Windows XP on a network, security concerns?

Question

I have a scenario where I need to continue to run a Windows XP PC even though XP is long not supported by Microsoft.

The PC will be connected to my network, but only for the purpose of allowing a Linux virtual machine to access the internet via the PC's network connection. Nothing else on the PC will ever touch the internet.

What kind of security risks might I be exposed to here? I've always thought one needed to browse to a dodgy website or execute/open a malicious file in order for anything bad to happen. That can't happen on this PC (and the virtual machine uses bridged networking which means its traffic is well isolated).

1. Can a Windows XP PC be exploited simply by being connected to a network, without user interaction?

2. If there are risks, what practical steps can be taken to mitigate them while maintaining the physical configuration and functionality as is?

Bounty is open

A tremendous number of people must find themselves in a similar position, where they need to expose a legacy XP PC (or VM for that matter) to a network. That's why I'm offering 500 points, in the hope that we get a solid answer.

Downvoters: Don't be shy to leave a comment. I can improve the question, but only if I know what's wrong with it.

Answer 1

"Security risks" here are kind of broad - the big issue here is XP isn't supported, and if there's some new threat targetting the many XP PCs still in the wild it won't get fixed.. As such, if I listed security issues specifically, it would be a growing list. Windows XP is a static target with dynamically growing threats

Of course, I've had an old XP PC exploited when it was the new, shiny awesome OS, and used by a skiddie to store warez so... its certainly possible quite a few years on.

Lets look at a random long list of vulnerabilities I found on the internet

The Security Account Manager Remote (SAMR) protocol implementation in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows Server 2012 Gold and R2 does not properly determine the user-lockout state, which makes it easier for remote attackers to bypass the account lockout policy and obtain access via a brute-force attack, aka "SAMR Security Feature Bypass Vulnerability."

So... Yeah, its not just you. Basically any vulnerability found in XP stays open and MS isn't fixing it. Not all vulnerabilities rely on direct user stupidity. Any system visible over the internet is going to get poked, prodded and tested. NAT would obscure you, perhaps but the bad guys would know it too

Amusingly this is the one case where the XP PC makes sense.

In theory you can mitigate this to a large extent with very very strict firewall rules, turning off any un-necessary services and keeping the system lean. Specifically turn off anything that allows remote access of any sort, remote logins etc.

I'd consider a slightly different topology - I'd try a USB ethernet adaptor directly attached to the VM or better yet, splitting off the data collection system, doing a point to point Ethernet connection on its own subnet so the XP box is contactable but not on the internet. In short, keep the XP box on its own little network.

It would be nice if you could find a linux style firewall that would drop anything outside specific IPs - then you could just drop any packets, anywhere, that arn't from the VM.

Answer 2

The short answer is that while you can't totally protect this system, you can practically protect it to a level as good or better then a general purpose PC running up-to-data antivirus, antimalware and regular Windows updates - if you limit its functionality enough.

There are risks (really of the unknown), but these risks are pretty small provided you have it behind a decent firewall and only allow requests to be initiated from it (as opposed to running any kind of world accessible server).

You should probably break attack scenarios into 3 kinds -

1. Script Kiddies / general asshats on the Internet who just see everyone as a target.

2. Someone attacking from inside your network (either a co-worker or someone like that, OR SOMEONE WHO'S system has been compromised).

3. People with the desire to launch a targeted attack at you.

You can - and in this case probably should isolate this machine from the rest of the network by putting this machine (and only this machine) behind a dedicated firewall (nat router with no open ports) or its own interface on a firewall - which cheaply pretty much eliminates problem 1 by turning the problem into a type 1 or 3.

For handling group (1) easily enough by not allowing them to gain access to your system. If you do anything which can fall to social engineering/uncontrolled content, you can't secure this system - by this I mean things like doing web browsing with a general purpose web browser. If you are able to limit the mechanisms used to interact with the Internet from this systems AND / CONTROL SANITIZE THE INPUT you should be OK -

[ In the respect of limiting input, data simply traversing the machine is a grey area - you will for the most part be OK because your system is just forwarding the packets, its not - or should not actually be interacting with them - unless an exploit at the routing/packet forwarding level is found - and these would be pretty hard to craft and pretty rare ]

With respect of (3) = Advanced Persistent Attack, it really does not matter if the box is running Windows or something else - sooner or later it will fall. How long it takes depends on how vigilant you are and what resources the attacker can command (but think about it, someone with enough authority could probably break in and physically steal the hardware, so this is probably not an attack you need to worry too much about)

Another couple of thoughts to throw in there - Have good backups - that way if something does go wrong your risk is limited. (And having it on a separate network to the rest of your system mitigates the damage it can do if it is compromised)