'Security by antiquity': why some experts deliberately keep using old, outdated tech to dodge hackers

[Ryan98]

A BBC Future feature examines a counterintuitive cybersecurity phenomenon some researchers call security by antiquity, or alternatively security by obsolescence, the idea that deliberately sticking with an old, outdated piece of technology can sometimes prove safer than switching to something newer, precisely because attackers have simply stopped paying attention to it. Finnish cybersecurity researcher Mikko Hyppönen offers one of the clearest personal examples, having stuck with the aging email client Eudora long after most people had moved on to newer alternatives, arguing it was really superior in several ways even though it was far from perfectly secure on its own technical merits.

As the broader user base migrated toward newer email tools, Hyppönen noticed hackers had effectively forgotten about Eudora entirely, no longer bothering to develop or deploy exploits against a shrinking, increasingly irrelevant target. He explained the underlying logic plainly, the vast majority of attackers are ordinary criminals trying to make money, and it simply doesn't make economic sense for them to spend time targeting a system being run by a comparative handful of remaining users when far larger, more lucrative targets exist elsewhere.

Computer scientist Matt Bishop of UC Davis demonstrated the same principle experimentally, almost entirely by accident, back in the 1990s. He and his colleagues deliberately set up an internet connected honeypot, a controlled system meant to attract and study hackers, using an older software version that had already been superseded by several subsequent updates. Virtually no attackers bothered targeting it at all. Once the team upgraded that same honeypot to the current, up to date version instead, Bishop recalled they immediately got all the attacks they could have wanted, a result he still finds genuinely amusing looking back on it.

Experts interviewed for the piece were careful to stress that using the latest, fully patched software generally remains the optimum security approach for most everyday situations, and this strategy isn't a universal recommendation people should broadly apply. But the article also points to actually serious real world applications of the same underlying principle, including what defense analyst Withington calls analogue resilience in Ukraine, where Russia has actively jammed GPS navigation and interfered with satellite communications, forcing renewed practical reliance on older, less networked technology precisely because it isn't vulnerable to the same kind of modern electronic interference in the first place

'Security by antiquity': Why older tech is sometimes safer from hackerswww.bbc.co.uk

[Sandworm81]

The Matt Bishop honeypot experiment is such a clean, almost perfectly controlled demonstration of this exact principle in action. Same fundamental setup, only the software version actually changed, and the difference in attacker interest was apparently immediate and completely stark

[RightNutter]

We will all be using typewriters very soon

[ShawnMichaels07]

Curious how long this specific advantage actually lasts for any given piece of legacy technology before hackers eventually do circle back around to it. If enough critical infrastructure or notably valuable targets end up quietly clustering on the exact same old system for this specific reason, that could eventually flip the whole calculation and make it a clearly worthwhile target again after all

[Western Depot]

The Ukraine GPS jamming example takes this from a fun cybersecurity curiosity into something with properly serious real world military stakes attached. Analogue resilience becomes an actual matter of life and death rather than just an interesting philosophical thought experiment about old software

[PixelTea97]

Hyppönen's economic framing is simply the part that makes this whole idea click properly for me. Most attackers are running a business at the end of the day, and businesses generally don't bother chasing customers, or in this case targets, that simply aren't worth the time and effort required

[Jenny]

There's something almost darkly funny about deliberately choosing a worse, more limited piece of software specifically because it's so unpopular that nobody bothers attacking it anymore. Obscurity itself becomes an actual defensive strategy in its own right rather than just an unfortunate accidental side effect of using something outdated

[Skibidi98]

The old Department of Defense websites running outdated software examples mentioned elsewhere in this broader security by obsolescence discussion are a good reminder this isn't purely some theoretical academic idea. Real, serious, high value organizations have apparently leaned on exactly this same principle deliberately for years now

[Estuary80]

Worth being careful this doesn't get read by anyone as a genuine general recommendation to stop patching and updating things normally. The article is quite explicit that current, updated software remains the actual best default approach for basically everyone in ordinary, everyday situations specifically

[Sharon9]

This feels like a particularly nice, refreshing counterpoint to the constant, relentless drumbeat of always update everything immediately advice that usually dominates most mainstream cybersecurity coverage. Reality is clearly a bit more nuanced and situationally dependent than that simple blanket advice usually suggests on its own