I recently took over managing the IT needs for a small healthcare agency with locations in 3 different cities. They have a widespread use of thin clients, as the clinical application most often used is housed by the State. The thin clients in use are Win XP. I know that thin clients have no hard drive, but are they vulnerable to virus/ malware through Internet or USB drive? CD / DVD? I know that these devices have not been patched manually, so no patching since April 2014.
Most of the above comments don't answer your question which was
I know that thin clients have no hard drive, but are they vulnerable to virus/ malware through Internet or USB drive?
And the answer is yes, they are. There are many infections which don't need a user controlled hard drive. A vulnerable windows service is enough (because the infection happens in RAM memory, in the process space basically). Or that a user browses a vulnerable internet site. So the answer is: yes, they are vulnerable even without hard drive. The next 2 questions are:
- How probable is such an infection
- What is the impact?
1 depends on what the users do with those WinXP boxes. If they are using office/email/internet like normal PC users in an average office then I would say the probability is the same. And the security awareness of those users largely impacts the probability, as usual. Social engineering and stuff, you know.
2 Usually, the impact of such a compromise is
- Ransomware, Encryption of the hard drive
- Information leakage
- installation of a root kit
- denial of service
- etc etc
I would say 1 is impossible if no hard drive is present, are there any network drives connected? 3 sounds difficult to me without hard drive, 4 is always possible (if the attacker gains admin level he can just shutdown the box) and 2 is probably possible and you have to assess the severity (basically: how sensitive is the data processed on these boxes).
Disclaimer: This is what I think is the situation for an average hacker who only sees "hey, an XP box!" and goes ahead and attacks it. Someone who knows more about your environment can, of course, better exploit the big attack vector called WinXP. So you should also try to find an answer to the question whether you are a high value target for someone or what could be a motivation to attack you and for whom.
Assuming that you are using them to access a remote VM using Citrix or similar, the risks of viruses on the devices is absolutely minimal.
Making other use of the embedded XP OS would increase the risk and allowing users to use the embedded browser would put them at serious risk when surfing the web so if you haven't already done so, you should disable that.
The biggest risk therefore is the lack of support. Should you come across an embedded OS related issue that required a fix, you would be out of luck.
On the other hand, if the remote desktop you are using is also running XP, that is a very different matter and presents some really serious risks even if the owners have paid the extreme amounts for extended support.