I recently took over managing the IT needs for a small healthcare agency with locations in 3 different cities. They have a widespread use of thin clients, as the clinical application most often used is housed by the State. The thin clients in use are Win XP. I know that thin clients have no hard drive, but are they vulnerable to virus/ malware through Internet or USB drive? CD / DVD? I know that these devices have not been patched manually, so no patching since April 2014.
-
6You don't need an antivirus software. You need a flame thrower.– UTF-8Oct 4, 2016 at 17:15
-
1He meant that XP.– AriaOct 4, 2016 at 17:18
-
4Your focus should be to retire XP since support has ended. You should review this thread as it discusses the security implications of continuing to run XP.– user2320464Oct 4, 2016 at 18:01
-
2You can replace XP with Linux no issues in most cases.– AriaOct 4, 2016 at 18:39
-
2Calm down folks, it is certainly possible that the organisation has a legacy system that can only be run on a native XP OS. I have supported such a system.– schroeder ♦Oct 4, 2016 at 20:20
|
Show 4 more comments
2 Answers
Most of the above comments don't answer your question which was
I know that thin clients have no hard drive, but are they vulnerable to virus/ malware through Internet or USB drive?
And the answer is yes, they are. There are many infections which don't need a user controlled hard drive. A vulnerable windows service is enough (because the infection happens in RAM memory, in the process space basically). Or that a user browses a vulnerable internet site. So the answer is: yes, they are vulnerable even without hard drive. The next 2 questions are:
- How probable is such an infection
- What is the impact?
1 depends on what the users do with those WinXP boxes. If they are using office/email/internet like normal PC users in an average office then I would say the probability is the same. And the security awareness of those users largely impacts the probability, as usual. Social engineering and stuff, you know.
2 Usually, the impact of such a compromise is
- Ransomware, Encryption of the hard drive
- Information leakage
- installation of a root kit
- denial of service
- etc etc
I would say 1 is impossible if no hard drive is present, are there any network drives connected? 3 sounds difficult to me without hard drive, 4 is always possible (if the attacker gains admin level he can just shutdown the box) and 2 is probably possible and you have to assess the severity (basically: how sensitive is the data processed on these boxes).
Disclaimer: This is what I think is the situation for an average hacker who only sees "hey, an XP box!" and goes ahead and attacks it. Someone who knows more about your environment can, of course, better exploit the big attack vector called WinXP. So you should also try to find an answer to the question whether you are a high value target for someone or what could be a motivation to attack you and for whom.
-
Certainly the risks of XP on a thin client are far lower than on a PC. Though there are still 2 modes of operation for Windows based thin clients of which using them as a true thin client is the safest since the OS has minimal use, most work is done by the server which could be delivering an entirely different OS. There are other risks though, mainly the fact that any OS related problems can no longer be fixed by Microsoft unless you want to pay them some very large amounts of money. Oct 4, 2016 at 21:16
-
@JulianKnight I think the "pay them some very large money" basically means buying Microsoft and telling some engineers to fix it, because they simply will not have staff for that type of work.– NelsonOct 5, 2016 at 8:33
-
Well, if you are big enough with deep enough pockets, they will do pretty much anything to help. There are plenty of organisations that have already had to shell out to get additional support for XP. MS aren't happy about it but they will certainly take your money. To be fair, they recognise that it isn't always possible for large enterprises to extract themselves from a specific OS except over several years, they certainly want big enterprise customers so they try not to leave them totally in the lurch. Oct 5, 2016 at 12:55
Assuming that you are using them to access a remote VM using Citrix or similar, the risks of viruses on the devices is absolutely minimal.
Making other use of the embedded XP OS would increase the risk and allowing users to use the embedded browser would put them at serious risk when surfing the web so if you haven't already done so, you should disable that.
The biggest risk therefore is the lack of support. Should you come across an embedded OS related issue that required a fix, you would be out of luck.
On the other hand, if the remote desktop you are using is also running XP, that is a very different matter and presents some really serious risks even if the owners have paid the extreme amounts for extended support.
