SMB Shares Dangerous?

SMB Shares Dangerous?
Secure Home | Search | About
Login Password
Register Now! Lost Password?
 Microsoft Applications Security    Post an article   get this group's latest topics as an RSS feed add this group's latest topics to your My MSN content add this group's latest topics to your My Yahoo content add this group's latest topics to your Google content
Subject Author Date
SMB Shares Dangerous? Brad Baker 04-26-2007
Posted by Brad Baker on April 26, 2007, 9:09 am
If you were  Registered and logged in, you could reply and use other advanced thread options
Appologies for the x-posting but I posted this at
microsoft.public.win2000.security and got no response so hoping for a better
response here. :)

--
A number of our employees access our windows servers using either mapped
drives or UNC paths with vpn. I am somewhat concerned that accessing our
servers this way may pose a security risk as a number of viruses
proliferate
through network shares.

The shares are password protected so users do have to authenticate to
access
them but as far as I know once they have authenticated, their credentials
are cached for a period of time. Also with mapped drives in particular I
believe login information is saved permanently.

I'm wondering what others thoughts are on this matter and if anyone can
point me to any articles that confirm or deny the risk (or lack there of)
for using mapped drives and/or UNC paths. Finally if there is a risk, are
there other alternatives?

Thanks
Brad



Posted by Nick Domukhovsky on April 26, 2007, 11:46 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
> Appologies for the x-posting but I posted this at
> microsoft.public.win2000.security and got no response so hoping for a better
> response here. :)
>
> --
> A number of our employees access our windows servers using either mapped
> drives or UNC paths with vpn. I am somewhat concerned that accessing our
> servers this way may pose a security risk as a number of viruses
> proliferate
> through network shares.
>
> The shares are password protected so users do have to authenticate to
> access
> them but as far as I know once they have authenticated, their credentials
> are cached for a period of time. Also with mapped drives in particular I
> believe login information is saved permanently.
>
> I'm wondering what others thoughts are on this matter and if anyone can
> point me to any articles that confirm or deny the risk (or lack there of)
> for using mapped drives and/or UNC paths. Finally if there is a risk, are
> there other alternatives?
>
> Thanks
> Brad
>
>
SMB (even without any file share) is dangerous by design. This core
protocol of MS Network and it has a great number of various bugs, which
allow remote code execution (most through buggy RPC interfaces). So,
first, you should implement some quarantine technique for your remote
users (to be sure, that their workstations are secured).
You can read about VPN quarantine here:
http://www.microsoft.com/technet/security/prodtech/windowsserver2003/quarantineservices/vppgch01.mspx

Also you can implement Cisco Secure Desktop on your mobile clients:

http://www.cisco.com/en/US/products/ps6742/prod_release_note09186a00805765e3.html



--
With best regards
Nickolay Domukhovsky, MCSA

Posted by S. Pidgorny on April 28, 2007, 10:05 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
G'day:

> SMB (even without any file share) is dangerous by design.

Are you trying to say that Windows file/print servers and UNIX/Linux servers
running Samba are inherently insecure? They are not.

> This core
> protocol of MS Network and it has a great number of various bugs, which
> allow remote code execution (most through buggy RPC interfaces).

So the danger is not in the protocol design but in the implementation bugs
(all known are fixed).

> first, you should implement some quarantine technique for your remote
> users (to be sure, that their workstations are secured).
> You can read about VPN quarantine here:
>
http://www.microsoft.com/technet/security/prodtech/windowsserver2003/quarantineservices/vppgch01.mspx
>
> Also you can implement Cisco Secure Desktop on your mobile clients:
>
>
http://www.cisco.com/en/US/products/ps6742/prod_release_note09186a00805765e3.html

Yes, addressing client security is the right way to deal with the risk of
virus proliferation.

--
Svyatoslav Pidgorny, MS MVP - Security, MCSE
-= F1 is the key =-

* http://sl.mvps.org * http://msmvps.com/blogs/sp *



Posted by Nick Domukhovsky on May 6, 2007, 11:55 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
>
> Are you trying to say that Windows file/print servers and UNIX/Linux servers
> running Samba are inherently insecure? They are not.

I'm trying to say, that SMB to much functionality to be Internet file
share protocol. Needless to say, that NFS a little better in this way.

> So the danger is not in the protocol design but in the implementation bugs
> (all known are fixed).
If there were the way to turn off all RPC functionality and leave only
file sharing it will be right design for Internet file sharing protocol.
But you cannot turn off all this functionality, and RPC will always be
dangerous (fix always appear after spreading of public exploits).



--
With best regards
Nickolay Domukhovsky, MCSA

Posted by S. Pidgorny on May 7, 2007, 4:51 am
If you were  Registered and logged in, you could reply and use other advanced thread options
G'day:


> I'm trying to say, that SMB to much functionality to be Internet file
> share protocol. Needless to say, that NFS a little better in this way.

Please explain? What is "better"? In what way NFS better than CIFS? From
security to performance, NFS is a loser.

>> So the danger is not in the protocol design but in the implementation
>> bugs
>> (all known are fixed).
> If there were the way to turn off all RPC functionality and leave only
> file sharing it will be right design for Internet file sharing protocol.
> But you cannot turn off all this functionality, and RPC will always be
> dangerous (fix always appear after spreading of public exploits).

The fact is that NFS depends on RPC and not CIFS.

--
Svyatoslav Pidgorny, MS MVP - Security, MCSE
-= F1 is the key =-

* http://sl.mvps.org * http://msmvps.com/blogs/sp *



Similar ThreadsPosted
Is this dangerous? July 29, 2006, 6:24 am
!?!?! HTA files are EXTREMELY DANGEROUS ?!?! January 5, 2006, 6:21 pm
Destructive, dangerous Autochk.exe June 26, 2006, 8:47 am
Vulnerable, Outdated, Dangerous DLLS May 8, 2008, 4:12 pm
Is Viewpoint dangerous (Windows Media Player) October 29, 2005, 2:11 pm
How is dangerous connect to server over internet with remote deskt July 21, 2006, 8:05 am
Tightening down shares on a network?? October 13, 2005, 2:02 pm
Access to network shares January 25, 2007, 5:13 am
Missing Admin Shares July 19, 2007, 6:54 am
Open Access to Shares June 7, 2008, 6:22 pm

The site map in XML format XML site map

Contact Us | Privacy Policy