Windows 7 Reintroduces Remote BSoD

David Gerard writes "Remember the good old days of the 1990s, when you could teardrop attack any Windows user who'd annoyed you and bluescreen them? Microsoft reintroduces this popular feature in Windows 7, courtesy the rewritten TCP/IP and SMB2 stacks. Well done, guys! Another one for the Windows 7 Drinking Game."

Comments

Local?

[MindStalker]

If it relies on a SMB2 request it is most likely restricted form request inside the LAN.
Either way, still bad.

Re:Local?

[fuzzyfuzzyfungus]

Especially unpleasant given that SMB2 is pretty common on important shared resources. Like fileservers.

Crashing clients is bad, any client on the LAN being able to take down the fileserver is substantially worse.

Re:Local?

[afidel]

Actually the headline is very misleading and that's bad. This affects SMB2 which is in Vista and Server 2008 as well, that means every Server 2008 system is likely vulnerable to a LAN based DoS attack.

Re:Local?

[Sethb]

Uh, by default on modern incarnations of Windows, accounts without passwords are *not* allowed to log in remotely. So, they're extremely difficult to access remotely.

Re:Local?

[phoenix321]

Second that big time.

The belief that a cloud of several thousand clients can ever be held secure is almost obscene. IT departments that concentrate most heavily on defending the outer border of their network, placing more than only a slight hint of trust in their "owned" client hardware are hopefully becoming rare.

Several thousand notebooks, travelling along the employees all around the world, through a hundred massive wifi-zones, hotel LANs, airports etc., should not be trusted higher than the machine Joe Random Employee brought from home. The official corporate notebook may have all the branding, settings, applications and whatnot, but that can at best make it a decently hardened PC, not bullet proof.

Many organisations really concentrate on the border, falling to the illusion of control: "we control the machine, the user / employee has no admin rights so all machines that go along on a business trip come back in perfect shape and without ever acquiring a drive-by rootkit somwhere"

In reality, most breaches are done, or facilitated, or unknowingly supported by people inside the organisation. Disgruntled employees are surely the worst enemy - and guaranteed to be numerous in any multinational company under the current economy. But it can also be frequent-fliers, hard-working staff that take their laptops everywhere and try to work all the time, connecting to a hundred different wifi-APs per year. Trusting a machine means physical control over everything. Trusting machines that commute and travel daily along with their employees is batshit crazy - but most IT departments still pretend they don't see that.

Not consistent

[james_a_craig]

Having actually tried this on three windows 7 machines now, it doesn't seem to work on every machine. (Actually, it's yet to work on any here, although I hear tell that it does work on some). There's something more to this than just "that data crashes it every time".

Re:Not consistent

[afidel]

Try it against a Server 2008 lab server with file shares, I'll bet that it will BSOD.

IP Reasons for SMB2

[eldavojohn]

they don't like introducing "new" things

A slight correction, they like to introduce new things when it suits them. Why the rewrite of SMB into SMB2? Well, it has some technological advantages you would expect but according to Wikipedia:

SMB 2 has two big benefits to Microsoft. The first is clear intellectual property ownership. SMB 1 was originally designed by IBM and was shipped on a wide variety of non-Windows operating systems such as SCO Xenix, OS/2 and DEC VMS (Pathworks). It was partially standardised by X/Open and also had draft standards for IETF which lapsed. (See http://ubiqx.org/cifs/Intro.html for historical detail).

The second benefit is a clean break. Microsoft's SMB1 code has to work with a huge variety of SMB clients and servers. A large number of items in the protocol are optional (such as short and long filenames), there are many infolevels for commands (selecting what structure is returned to a particular request), Unicode was a later addition etc. With SMB2 there is significantly reduced compatibility testing (currently only other Windows Vista clients and servers). Additionally the code is a lot less complex since there is far less variability (e.g. there is no need to worry about having Unicode and non-Unicode code paths as SMB2 requires Unicode support).

So you can see they like to introduce new things when it means they have clear intellectual property ownership rights over it and also a lot less work for them. They also don't have to be backwards compatible with their own products.

While SAMBA 4.0 has experimental support for SMB2 interfacing, I'm guessing the "clear intellectual property" could spell trouble moving forward for Tridgell and the SAMBA team.

I'll be suprised if this affects anyone.

[jim_v2000]

IT departments are going to keep everything patched, and individuals aren't going to do it to themselves on their LANS. Between firewalls and NATs, it's not going to happen over the internet. Really, the only situation that I can imagine this happening is perhaps on a university network.

"RE"-introducing?

[WED Fan]

The article makes it seem like it hasn't been in Windows since Windows NT and that Windows 7 is the first time it's reappeared. Seriously, Vista has it.

Is this a case of "It's after midnight, must post another slam on Microsoft, even if we have twist and stretch like taffy to make the case"?

It wouldn't be so bad but the body of the submission is incredibly slanted, almost more than some of the replies.