Slashdot Mirror
Windows Remains Vulnerable To Serious 18-Year-Old SMB Security Flaw
Mark Wilson writes A serious security hole leaves millions of Windows users open to attack, making it possible to extract encrypted credentials from a target machine. Researchers at Cylance say the problem affects "any Windows PC, tablet or server" (including Windows 10) and is a slight progression of the Redirect to SMB attack discovered by Aaron Spangler way back in 1997. Redirect to SMB is essentially a man-in-the-middle attack which involves taking control of a network connection. As the name suggests, victims are then redirected to a malicious SMB server which can extract usernames, domains and passwords. Cylance also reports that software from companies such as Adobe, Oracle and Symantec — including security and antivirus tools — are affected.
apparently this is how sony got hacked
intellectual property law is philosophically incoherent. it is your moral duty to ignore it or sabotage it
"Software...are affected"? Has samzenpus ever heard of a mass noun?
IIRC, we discussed this in MSE classes, the same ones where the instructor assured us we need not register a domain name for our internal network (!), and agreed that despite the lack of information from Microsoft, It was worth it to block SMB ports from the public networks. As well as others, such as SQL Server (1433/1434 at a minimum), AD (135,389,5722, and the list goes on), and other services we need not expose to nor listen on for external traffic, we rapidly got to the point where the reasonably responsible admin blocked by default, opened only what was necessary, and then directed these to the proper hosts inside the network.
This is slightly older than the Y2K bug. And still not really fixed? Microsoft's choices here have always come back to haunt them. NetDDE, OLE, the HTML viewers, and this, all making Outlook once the premier distribution method for viruses and all form of malware,
Interprocess friendliness has its cost. Ease of use goes both ways. The crooks are happy to take advantage of your features.
deleting the extra space after periods so i can stay relevant, yeah.
It requires a man in the middle attack on traffic that should never go across the internet outside a vpn. Yes it's a problem but not exactly a significant one for a well put together network.
No sir I dont like it.
"Microsoft has eradicated buffer overflows with Windows XP", Jim Allchin aug 2001
"My son, seven years old, runs Windows Vista, and, honestly, he doesn't have an antivirus system on his machine", Jim Allchin Nov 2006
Read the article but replace "SMB" with "Super Mario Bros."
But... this is software that people were _paid_ to write. That means that these sorts of security holes can't happen! Not that open source thing of "many eyes makes all bugs shallow", they have the _right_ people reading the code thus these things can't happen. Right? Right?! (And if your sarcasm detector isn't going off the scale, you really need a new sarcasm detector....)
BUT IT'S MICRO$HAFT!!!!11 Common sense and real-world risk doesn't apply when it's about these LO$ERS!
Fuck M$ in their antitrust asses!
did you bother to RTFA?
one of them will bring a laptop into a starbucks, get infected, bring it into work where it gets connected to the internal network
or perhaps the employees at your company are forbidden to drink coffee?
Windows file-sharing on home machines has pretty much always been terrible. It's like a bunch of monkeys put it together. I am guessing they tasked one or two guys to add it to home machines when the bulk of a group was working on corporate file sharing (which is at least a bit more reliable), and the result was just a really bad design and code that has been sitting around the kernel forever. Getting two machines to talk to each other over an Ethernet cable has always been much harder than in linux. (I was going to say and less secure, but I remember the telnet and ftp days...)
Really.. I'm astonished by this Shocking revelation... :-o
Is this bug more of a enterprise issue then anything? Someone mentioned Sony was hacked this way. These days the bad guys to me are winning but are mostly after bigger fish then singular users on one PC. Not saying individuals are not targets but certainly they probably are targeted through other means. Some writer was bragging about the new Chromebook Pixel and how great it is not to be subject to all those thousands of Windows malware. I thought, he's probably right that the Chrome OS is safer, but then I ask myself how does he know anything about his Chrome OS. I have yet seen a tangible security scanner for Chrome OS. I suppose you could "trust" Google to patch any security issues. I run both Windows and Mac's and I would find either one to be safe and to back that up I rarely come across anything more then spyware on any PC's and mostly Windows based attacks on my Mac's. I am on the assumption any OS can be compromised. As one security person said, just because you live in a quiet neighborhood does not mean nobody can get into your house.
original paper here: http://cdn2.hubspot.net/hubfs/270968/SPEAR/RedirectToSMB_public_whitepaper.pdf
How hard is it to mandate any submission contain the source instead of some shill article?
I remain vulnerable to serious 18 year olds, if you catch my drift.
Escher was the first MC and Giger invented the HR department.
I don't know how or why it came to this. The world is hooked on insecure authentication protocols. NTLMv2, Kerberos, plaintext, plaintext over encrypted tunnel protected by group secrets (sigh..) or certificates and dull thud of every flawed permutation of a challenge handshake system imaginable.
These things are employed virtually everywhere and the consequences are visible everywhere.
Haha I tricked you or your computer into connecting to my file system or my fake bank or my fake web site and because of that I now have your credentials and your f*****d.
Living with consequences has become so routine and institutionalized some find it difficult to see the problem at all ... instead resorting to blaming failure of a castle defense or operating in an unsafe environment rather than notice the root cause of the problem - broken authentication systems.
When the most widely deployed use of a secure authentication protocol is protecting an online role playing game I have no interest in Microsoft's (And all other vendors) lame excuses for not fixing these problems decades ago.
The article states "the encryption method used was devised in 1998 and is weak by today’s standards ... Microsoft has yet to release a patch to fix the Redirect to SMB vulnerability" as if Microsoft must remove the feature in order for Cylance to consider this resolved. Instead a number of improvements have been made to SMB since 1998 include support for HMAC-SHA256 (v2.0) and AES-CMAC (v3.0) hashing. http://www.windowsecurity.com/.... You are going need a little more than "$3000 worth of GPUs" to forward brute force the AES-CMAC hashed passwords.
I have no problem running windows. I just run it inside a tightly controlled virtual machine, with very limited network access. That way. it can't damage my hardware, corrupt my software, or muck with my critical files. There are safe ways to run Windows.
Feel better?
Systemd/Kits/logind brining this crap to a linux near your
a dumb post considering the windows if anything has had less vulnerabilities the last few years than OSX or Linux.
Forget those 0 day attacks you've heard so much about. the 6575 day attacks are the real problem!
The applications that are providing the attack vector might be fixable. It isn't really a good thing for a remote attacker to be able to get your machine to try to open a file, especially a remote one. The main problem, from the sounds of it, is the sheer number of applications affected.
Reminiscent of DLL hijacking attacks, really.
Use Windows Starter.
IF you're on a stand-alone single user system cut server service (useless in that situation anyhow) using services.msc, or use Port 139 & 445 blocks via your Windows firewall for BOTH inbound + outbound UDP & TCP packets...
* Either SHOULD "do the job" in that situation...
APK
P.S.=> Server-wise, as I *think* you're specifically leading to WILL be as you said though - patch time is the only REAL 'save' since MS' networking depends on 139 & 445 ports to work properly... apk
I've recommended BOTH in security guides for years https://www.google.com/search?... (9/10 of the top results are those guides written by "yours truly")...
APK
P.S.=> The less services you run, in *ANY* event, means the more cpu cycles, RAM, + other forms of I/O you have available for the processes you DO want to run too, so "double-bonus"... apk
-1 for truth. Nice.
Let's see a formal statement from MS that we can shut off NetBIOS and it won't break any MS apps. (Not third party apps, just MS apps).