Old vs New: Retired Security Technology

Security technology ages. Algorithms that were strong in the 1990s can be broken on a laptop today, and protocols designed for friendly university networks were never meant for the modern internet. Yet old technology lingers for years in routers, factory machines, government portals, exam syllabuses and audit checklists.

In this lesson you will see the most important retired security technologies side by side with their modern replacements, understand why each one failed, and write small Python tools that spot legacy settings. Knowing the history helps you explain to a client why "it still works" is not the same as "it is still safe".

The big picture

Hashes: MD5 and SHA-1 to SHA-2 and SHA-3

A hash function is broken for security when someone can create collisions: two different inputs with the same digest. Then an attacker can get one document signed and swap in another with the same hash.

• MD5 (1992): researchers demonstrated collisions in 2004. In 2012, the Flame espionage malware abused an MD5 collision to forge a code-signing certificate that appeared to come from Microsoft.
• SHA-1 (1995): the first public collision, called SHAttered, was announced in 2017. Browsers stopped trusting SHA-1 certificates, Git is moving to SHA-256, and NIST plans to retire SHA-1 completely by the end of 2030.
• SHA-2 (SHA-224, SHA-256, SHA-384, SHA-512) is today's workhorse, and SHA-3 (standardised in 2015) is a completely different design kept as an alternative.

import hashlib

data = "Results of Class XII, Rohtak centre".encode()
for name in ["md5", "sha1", "sha256", "sha3_256", "sha512"]:
    digest = hashlib.new(name, data).hexdigest()
    status = "BROKEN for collisions" if name in ("md5", "sha1") else "ok"
    print(f"{name:<9} {len(digest) * 4:>3} bits  {status:<21} {digest[:16]}...")

md5       128 bits  BROKEN for collisions 900badd8da75b59a...
sha1      160 bits  BROKEN for collisions ed69f7e066c7fa76...
sha256    256 bits  ok                    edd0ad48facbd78e...
sha3_256  256 bits  ok                    e51d54171bc0d9e7...
sha512    512 bits  ok                    a2d222235038e0b3...

You will still see MD5 checksums on old download pages. They can catch accidental corruption, but they cannot prove a file was not deliberately replaced. For passwords, none of these fast hashes is right: use a slow password hashing function (see Authentication, Passwords & MFA).

SSL to TLS 1.3

People still say "SSL certificate" out of habit, but every modern site uses TLS. TLS 1.3 removed the risky options that caused years of attacks: static RSA key exchange (no forward secrecy), CBC-mode ciphers, RC4, SHA-1 in signatures and compression. Not every famous TLS problem was a protocol flaw: Heartbleed (2014) was a bug in the OpenSSL library's code, which is why patching libraries matters as much as choosing protocol versions.

This auditor checks a server's TLS settings, such as those reported by Nmap's ssl-enum-ciphers script against your lab server:

server = {
    "protocols": ["TLSv1.0", "TLSv1.2", "TLSv1.3"],
    "ciphers": ["TLS_AES_256_GCM_SHA384", "ECDHE-RSA-AES128-GCM-SHA256",
                "ECDHE-RSA-DES-CBC3-SHA", "RC4-SHA"],
    "certificate_signature": "sha256WithRSAEncryption",
    "rsa_key_bits": 2048,
}

findings = []
for p in server["protocols"]:
    if p in ("SSLv2", "SSLv3", "TLSv1.0", "TLSv1.1"):
        findings.append(f"disable {p}")
for c in server["ciphers"]:
    if any(weak in c for weak in ("RC4", "DES", "NULL", "EXPORT", "MD5")):
        findings.append(f"remove cipher {c}")
if "sha1" in server["certificate_signature"].lower() or "md5" in server["certificate_signature"].lower():
    findings.append("reissue certificate with SHA-256")
if server["rsa_key_bits"] < 2048:
    findings.append("use an RSA key of at least 2048 bits")
if "TLSv1.3" not in server["protocols"]:
    findings.append("enable TLS 1.3")

print("\n".join(findings) if findings else "No legacy settings found")

disable TLSv1.0
remove cipher ECDHE-RSA-DES-CBC3-SHA
remove cipher RC4-SHA

DES-CBC3 is 3DES. NIST no longer allows 3DES for encryption after 2023 because its 64-bit block size makes long sessions vulnerable (the "Sweet32" attack). On Kali, you can check what your own lab server accepts:

sudo nmap -p 443 --script ssl-enum-ciphers 192.168.56.101
openssl s_client -connect 192.168.56.101:443 -tls1_3 < /dev/null

Wireless and network protocols

The Wi-Fi story (WEP, WPA, WPA2, WPA3) is covered in Wireless Security. The same pattern repeats in network services: Telnet and FTP send passwords in clear text and should be replaced by SSH and SFTP; SMBv1 should be disabled everywhere, since the WannaCry ransomware worm spread worldwide in 2017 through an SMBv1 vulnerability on unpatched Windows machines.

Architecture: old thinking vs new

• Perimeter only vs zero trust: the old model trusted everything inside the office network. Zero trust verifies every user, device and request, wherever it comes from, because attackers and cloud services blur the "inside".
• Antivirus vs EDR: signature-only antivirus has given way to endpoint detection and response that watches behaviour.
• Passwords vs passkeys: passwords plus SMS OTP are being replaced by phishing-resistant passkeys.
• Yearly audits vs continuous monitoring: point-in-time checks are supplemented by automated, continuous checks of configuration and exposure.

Finding legacy technology

Old technology survives where nobody looks. An inventory with replacement priorities turns history lessons into action:

inventory = [
    ("Factory PLC gateway", "Telnet"),
    ("Accounts file server", "SMBv1"),
    ("Old vendor portal", "TLSv1.0"),
    ("Backup checksum script", "MD5"),
    ("Guest Wi-Fi", "WPA2-AES"),
    ("Website", "TLSv1.3"),
]
REPLACE = {
    "Telnet": ("SSH", 1), "SMBv1": ("SMBv3", 1), "TLSv1.0": ("TLS 1.2+", 2),
    "MD5": ("SHA-256", 3), "WEP": ("WPA3", 1), "WPA2-AES": ("WPA3 when devices allow", 4),
}

plan = sorted((REPLACE[tech][1], name, tech, REPLACE[tech][0]) for name, tech in inventory if tech in REPLACE)
for priority, name, tech, new in plan:
    print(f"P{priority}  {name:<23} {tech:<9} -> {new}")

P1  Accounts file server    SMBv1     -> SMBv3
P1  Factory PLC gateway     Telnet    -> SSH
P2  Old vendor portal       TLSv1.0   -> TLS 1.2+
P3  Backup checksum script  MD5       -> SHA-256
P4  Guest Wi-Fi             WPA2-AES  -> WPA3 when devices allow

When a legacy system truly cannot be upgraded (common with industrial equipment), isolate it on its own network segment, restrict who can reach it, monitor it closely and plan its replacement.

Common mistakes

• "It still works, so it is fine." Old protocols usually work perfectly, for attackers too.
• Keeping TLS 1.0 enabled for one old client. Find another way to support that client, or isolate it.
• Using MD5 or SHA-1 in new code because an old tutorial did.
• Calling TLS "SSL" in a technical report. Be precise about versions.
• Forgetting embedded devices: printers, cameras, routers and industrial controllers often run the oldest software in the building.

Key points

• WEP and WPA-TKIP, MD5 and SHA-1, SSL and TLS 1.0/1.1, DES, 3DES and RC4, Telnet, FTP and SMBv1 are all retired.
• MD5 collisions arrived in 2004 and SHA-1's in 2017; use SHA-2 or SHA-3, and slow functions for passwords.
• TLS 1.3 (2018) removed weak options; TLS 1.0 and 1.1 were formally deprecated in 2021.
• Modern thinking favours zero trust, EDR, passkeys and continuous monitoring.
• Inventory legacy technology, replace it by priority, and isolate what cannot be replaced yet.

def grade(protocols, ciphers):
    if any(p in ("SSLv2", "SSLv3", "TLSv1.0", "TLSv1.1") for p in protocols):
        return "F"
    if any(w in c for c in ciphers for w in ("RC4", "DES", "NULL", "EXPORT", "MD5")):
        return "B"
    return "A"

print(grade(["TLSv1.0", "TLSv1.2", "TLSv1.3"], ["RC4-SHA"]))
print(grade(["TLSv1.2", "TLSv1.3"], ["TLS_AES_128_GCM_SHA256"]))