Slashdot Mirror
Microsoft Will Disable WannaCry Attack Vector SMBv1 Starting This Fall (bleepingcomputer.com)
An anonymous reader writes: Starting this fall, with the public launch of the next major Windows 10 update — codenamed Redstone 3 -- Microsoft plans to disable SMBv1 in most versions of the Windows operating systems. SMBv1 is a three-decades-old file sharing protocol that Microsoft has continued to ship "enabled by default" with all Windows OS versions.
The protocol got a lot of attention recently as it was the main infection vector for the WannaCry ransomware. Microsoft officially confirmed Tuesday that it will not ship SMBv1 with the Fall Creators Update. This change will affect only users performing clean installs, and will not be shipped as an update. This means Microsoft decision will not affect existing Windows installations, where SMBv1 might be part of a critical system.
The protocol got a lot of attention recently as it was the main infection vector for the WannaCry ransomware. Microsoft officially confirmed Tuesday that it will not ship SMBv1 with the Fall Creators Update. This change will affect only users performing clean installs, and will not be shipped as an update. This means Microsoft decision will not affect existing Windows installations, where SMBv1 might be part of a critical system.
The old Microsoft was backwards compatible to old software. Yes it was hard, yes it meant to support shitty old protocols like SMB v1, but they did it, and lots of stuff worked, just worked together, Microsoft code that actually worked!
When they disable SMB v1, one cannot put XP or anything before it in the same network as a current Windows to share files. E.g. a XP VM for some old scanner or printer that you can still use via VM and the current host OS can access.
What is bad is not upgrading the security of a protocol that is ON by default for 30 years.
Let us take something equally ancient on the unix side, like the Xwindows. Is it on by default in linux? Does it suck as much as SMBv1 in terms of security? What kind of security enhancements have gone into each protocol over these three decades?
I don't know which one is better, but that will give us a sense of how much blame to heap on Microsoft.
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
and small networked systems? I honestly haven't paid much attention to the underlining protocols of Windows file sharing. What, if any, advantages are there to having it on by default?
Hi! I make Firefox Plug-ins. Check 'em out @ https://addons.mozilla.org/en-US/firefox/addon/youtube-mp3-podcaster/
The damage has been done.
Smb 1 has been depricated for 4ish years though. Why are oems not bothering to support newer protocol stacks when they're out there?
disable by default:
* cortana
* search
* xbox
* windows store updates
* non critical updates
* old app profiling
* prefeching the unprefetchable
* apps in suspended mode
* task scheduler
* onedrive
* remote access
* remote admin
* windows media
* shared folders
and the list goes on and on and on
btw do you know you can boot with a linux usb and delete all the windows store/windows apps folders? some registry cleanup after boot but hey no more ghost process in background eating cpu and memory
When you take something that wasn't designed with security in mind and try to expand and adapt it, you have a lot of issues. Better to start with something designed for the purpose it is being used from the start.
HTTP is a good example. It was designed as a stateless protocol for transferring text documents with markup. We now rely on it to do stateful transactions for things like shopping carts online and this has lead to tons of security issues since you have to hack on state to a protocol that isn't designed to support it using things like cookies. It would be much more secure had it been designed from the ground up to handle stateful transactions with people.
IP is another great example. There's all kinds of shit in IPv4 that is completely stupid from the perspective of a protocol used on the Internet. Like source routing, where you can specify the routers that a packet must go through, or the fact that you can just claim to be from any IP you want. This is a bad design for a global communications network. However it is that way because IP wasn't designed for a global communications network, it was designed for an ARPA project and it grew. IPv6 fixes a lot of this because it was designed later, around how IP is actually used these days.
Also talking about Xwindows is funny because man you wanna talk security risk, X is a huge. If you have an X server that talks on the network any system on the network can just draw to your local display, and you have no easy way of knowing that it isn't your system. Someone can phish passwords in a very hard to detect way using it. Now of course most distros are smart enough to block remote X using the firewall, and you do something like tunnel it over SSH. However that is a hack, it is putting up barriers around something insecure. If those barriers are bypassed, the insecurity is still there. Better if it were designed secure from the ground up. Then you still put the barriers in place as well so that you aren't relying on any one level of security.
Discontinuing the use of older protocols is a good idea for security, when possible. It isn't always possible, of course, I mean IPv4 is still far and away the most widely used IP spec. But you stop using them when you can (and indeed modern OSes will prefer IPv6 when they have both available).
From MS - SMB Ports 445/139 (TCP) & 137/138 (UDP) protection via:
Disable SMBv1 on the SERVER, configure the following registry key:
Registry subkey: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters Registry entry: SMB1
REG_DWORD: 0 = Disabled
REG_DWORD: 1 = Enabled
Default: 1 = Enabled
Enable SMBv2 on the SERVER, configure the following registry key:
Registry subkey:HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters Registry entry: SMB2
REG_DWORD: 0 = Disabled
REG_DWORD: 1 = Enabled
Default: 1 = Enabled
---
Disable SMBv1 on the CLIENT, run the following commands:
sc.exe config lanmanworkstation depend= bowser/mrxsmb20/nsi
sc.exe config mrxsmb10 start= disabled
Enable SMBv2 & SMBv3 on the CLIENT, run the following commands:
sc.exe config lanmanworkstation depend= bowser/mrxsmb10/mrxsmb20/nsi
sc.exe config mrxsmb20 start= auto
---
* The above is per https://support.microsoft.com/en-us/help/2696547/how-to-enable-and-disable-smbv1,-smbv2,-and-smbv3-in-windows-vista,-windows-server-2008,-windows-7,-windows-server-2008-r2,-windows-8,-and-windows-server-2012/
APK
P.S.=> For a SINGLE 'standalone' non-networked PC (no home network/LAN but TCP/IP connected online) turn off Server & Workstation services.
That shuts off any "handles" (port 445) this thing propogates thru + turn off NetBIOS over TCP/IP in your internet connection & uncheck/disable Client for Microsoft Networks + File and Print Sharing. Port 139 & 445 always pop up issues over time. It also makes your packet trains smaller (no encapsulation of LanMan)
I covered all this 11++ yrs. ago in a security guide I wrote for users with a single system & apparently, its advice STILL STANDS THE "TEST OF TIME" https://www.google.com/search?hl=en&source=hp&biw=&bih=&q=%22HOW+TO+SECURE+Windows+2000%2FXP%22&btnG=Google+Search&gbv=1/ vs. even today's threats like this one.
This effectively makes this threat a non-issue + saves you CPU cycles/RAM & other I/O wasted on services you don't NEED as a single PC user only... & you don't. They're just wastes with a single PC really. Many services are (covered in guide above based on CIS Tool guidance (who took fixes to their ware from "yours truly" too, no less)) & again, no more encapsulated packet bulk.
AND?
Don't be STUPID & click on attachments in bogus malicious emails this thing propogates thru also (Chrome/Opera/Webkit users - BEWARE of the ShellControlFile issue that just popped up (.scf file) noted here-> http://www.theregister.co.uk/2017/05/17/chrome_on_windows_has_credential_theft_bug/ ) ... apk
The only people that use SMBv1 are legacy linux systems.
SMBv2 had the copied code from SMBv1 when M$ migrated the APIs they knew, worked, from SMBv1 and then put them into v2.
So why arent they also depreciating SMBv2? That protocol was equally effected as SMBv1?
Or is this, like I hinted in my first line, pulling up the protocol ladder to solidify licence revenue from the equally broken SMBv2 and stifle competition?
So in other words you could not be assed to update the security of your printers for years until it finally broke connectivity?
Just so I know what I should avoid like the plague, what copier manufacturer are you working for?
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
This SMB thing reminds me of people arguing over which version of SNMP is better to use. Use version 1... no version 2c that's better... no v3 with passwords and privacy passwords is much safer when the reality is no matter what version you select the outcome is still very much the same: your fucked. The only sane method for securing SNMP is restricting use to secure channels. (e.g. (D)TLS or SSH)
My understanding SMB is no different. Even latest and greatest version 3 with somewhat modern algorithms still provides zilch in terms of offering a rational basis of trust. Trust is generally established from weak challenge response authentication protocols (NTLM/Kerberos) which when unprotected by PKI exposes users of SMB to offline compromise of their credentials.
The only way to use SMB securely is the same as SNMP - restrict use to a secure channel at which point caring about worthless security features included with versions x, y and z is all a rather fruitless exercise.
I should add on multiple occasions I've found myself having to disable SMBv2 due to shady caching and locking semantics that place performance before safety.
At the end of the day I just want shit that works and Microsoft is spectacularly failing to deliver. It's 2017 and they still can't be bothered to implement a secure authentication protocol capable of standing alone.
In the late 2006 during the pre Vista and XP SP3, I already encountered in a forum about a kid who wanted to secure his XP box and had a headache on his open port TCP/445 which is on by default on fresh installs including the difficult to disable NetBIOS. The poster wanted to know how to disable this default SMBv1 port 445, he criticized MS and even claimed to have contacted MS to close it down due to security issues. But many replied on that forum regarding local machine firewall and router firewall being the solution.
Now that kid (from Netherlands if my memory serves me right) seems to be correct, 11 yrs AGO, about the dangers of an open useless port even if you're protected by your router firewall. If only M$ heed the warning.
At least us Windows users have a modern GUI interface to play with instead of all those text config files under Linux.
I have discussed all of this in another place. Microsoft is unambiguous on this issue, and for good reason.
Call me once they kill NETBIOS and WINS. While those are still working, they are not serious.
"No Windows, No Cry..."
So in other words you could not be assed to update the security of your printers for years until it finally broke connectivity?
Printer security is a can of worms. If you think that is bad, try finding and removing Windows-based medical devices from the general VLAN.
A door that isn't there can not be opened. Why have tons of software running in a machine that isn't used... and then run a firewall in the same machine to block access to the software that isn't used.
Disable all the crap that isn't used! 99.999999999% of all Windows installations does not need or used SMB/CIFS. If MS feel that they want to use it internally in the machine bind it to 127.0.0.1 ONLY! (at least they do not share the registry will full admin rights to guest anymore)
(and PLEASE bring system documentation back up to the level you had with Windows XP!)
I disabled smbv1 back when wannacry broke and while my winows boxes could still talk to each other fine, my macs and Linux boxes all started failing.
I know. Try, just TRY to get a printer 802.1X compliant.
That doesn't mean you can throw your hands up and just be done with it.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.