Slashdot Mirror
Microsoft Won't Patch 20-Yr-Old SMBv1 Vulnerability (You Should Just Turn the Service Off) (onmsft.com)
An anonymous reader shares a news post: Following the recent WannaCry and Petya ransomware attacks, Microsoft recommended all Windows 10 users to remove the unused but vulnerable SMBv1 file sharing protocol from their PCs. This is because both variants of the ransomware actually used the same SMBv1 exploit to replicate through network systems, even though it seems that Petya mostly affected Windows PCs in Ukraine. Anyway, if you haven't turned off the protocol on the PC already, you really should: Not only because new WannaCry/Petya variants could once again use the same vulnerability again to encrypt your files, but because another 20-year-old flaw has just been unveiled during the recent DEF CON hacker conference. The SMB security flaw called "SMBLoris" was discovered by security researchers at RiskSense, who explained that it can lead to DoS attacks affecting every version of the SMB protocol and all versions of Windows since Windows 2000. More importantly, a Raspberry Pi and just 20 lines of Python code are enough to put a Windows server to its knees.
Why doesn't Microsoft patch the OS so that SMB1 is disabled entirely? I mean MS already shoves all sorts of crap down your throat anyways, why can't that unshove shit?
Most of HP's multi-function printers with Scan To Network only support SMB1. When will they issue a firmware update that adds support for SMB2?
Looks like the Pwnie Awards for "Lamest Vendor" was given to the wrong "vendor". Wilfully leaving millions of people open to an exploit that is in active use is just beyond lame.
More importantly, a Raspberry Pi and just 20 lines of Python code are enough to put a Windows server to its knees.
Well, isn't your run of the mill screen saver enough to do that?
You shouldn't use outdated standards. I thought this was already decided. Let me go update my router so that it'll fix a bug in WEP. That'll make it secure.
looks like god made 1 mistake...
Apache has the same vulnerability and they never really came up with a good fix for it.
Like Robert Graham describes in http://blog.erratasec.com/2017..., it's a type of attack that can be perpetrated against any service on the internet.
Solutions:
- Build a proxy service (per the article) that parses input before passing it to $SERVICE.
- Do not put it on the internet (i.e. firewall).
Is SMB open by default in Windows Firewall anyway? If anything, pooh-pooh Redmond for that. I know, I know, millions of affected hosts.
They should just send an update that disables it for all users. It would have to be no more a pain due to the repercussions of not disabling it.
Seriously though, there is an awful lot of questionable things (to me) that Microsoft does on a regular basis. But doing something like this would be A super inconvenient, and B, force a lot of other vendors to up their standards as well (pun potentially intended).
I couldn't see the move as any more disastrous as entire hospitals going offline... I dunno, this is just one guys opinion... flame away!
https://support.microsoft.com/...
Because SMBv2 on android is apparently still difficult. With ES File Explorer, you need to install some crappy game to get SMBv2 support and it's spotty at best. Not everyone likes to run a streaming server (that actually have client-like, full screen interfaces), just have a share or two and access it via SMB from all kinds of devices. Maybe there'll be a Windows port of SAMBA to use a non-vulnerable version of SMBv1.
When the copyright term is "forever minus a day", live every day like it's the last.
The trouble is that lots of software still requires it. Probably why MS don't turn it off via an update.
Remove it just to see it reappear after the next windows update.
sudo rm -r -f --no-preserve-root /
By "the service" do you mean SMB? The threat is descirbed as affecting all versions of SMB, but nearly all of the tech writers describing the bug are suggesting turning off SMBv1. Is no one actually paying attention to what the authors are saying, or am I missing something?
"Please enable javascript and refresh the page"
Wankers
There's a patch for this.
https://linuxmint.com/download...
aaaaaaa
Won't this leave all Windows machines vulnerable to any other exploit that would gain access to the device, potentially turn it on again, and allow the ransomware to do its damage?
It would be better to remove SMB1 support entirely, or patch it if that's too difficult for MS.
Fuck off, there's a good scumbag.
Agreed, there is a huge lot of older but still functional equipment that only talks SMB1. Microsoft has put together this list, and it surely isn't everything: https://blogs.technet.microsoft.com/filecab/2017/06/01/smb1-product-clearinghouse/
https://www.freebsd.org/
OS X still has such miserable SMB client we are stuck with SMB1/CIFS to maintain some semblance of reliability and speed.
See subject & for the solution - SMB Ports 445/139 (TCP) & 137/138 (UDP) protection via:
Disable SMBv1 on the SERVER, configure the following registry key:
Registry subkey: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters Registry entry: SMB1
REG_DWORD: 0 = Disabled
REG_DWORD: 1 = Enabled
Default: 1 = Enabled
Enable SMBv2 on the SERVER, configure the following registry key:
Registry subkey:HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters Registry entry: SMB2
REG_DWORD: 0 = Disabled
REG_DWORD: 1 = Enabled
Default: 1 = Enabled
---
Disable SMBv1 on the CLIENT, run the following commands:
sc.exe config lanmanworkstation depend= bowser/mrxsmb20/nsi
sc.exe config mrxsmb10 start= disabled
Enable SMBv2 & SMBv3 on the CLIENT, run the following commands:
sc.exe config lanmanworkstation depend= bowser/mrxsmb10/mrxsmb20/nsi
sc.exe config mrxsmb20 start= auto
---
* The above is per https://support.microsoft.com/en-us/help/2696547/how-to-enable-and-disable-smbv1,-smbv2,-and-smbv3-in-windows-vista,-windows-server-2008,-windows-7,-windows-server-2008-r2,-windows-8,-and-windows-server-2012/
(THIS HAS BEEN PATCHED but you can protect this way too & it works...)
Not sure if this works in a "mixed-mode" network though (check MS link) using older Windows (e.g. XP/2000 etc.).
APK
P.S.=> For a SINGLE 'standalone' non-networked PC (no home network/LAN but TCP/IP connected online) turn off Server & Workstation services.
That shuts off any "handles" (port 445) this thing propogates thru + turn off NetBIOS over TCP/IP in your internet connection & uncheck/disable Client for Microsoft Networks + File and Print Sharing. Port 139 & 445 always pop up issues over time. It also makes your packet trains smaller (no encapsulation of LanMan)
I covered all this 11++ yrs. ago in a security guide I wrote for users with a single system & apparently, its advice STILL STANDS THE "TEST OF TIME" https://www.google.com/search?hl=en&source=hp&biw=&bih=&q=%22HOW+TO+SECURE+Windows+2000%2FXP%22&btnG=Google+Search&gbv=1/ vs. even today's threats like this one.
* This effectively makes this threat a non-issue + saves you CPU cycles/RAM & other I/O wasted on services you don't NEED as a single PC user only... & you don't. They're just wastes with a single PC really. Many services are (covered in guide above based on CIS Tool guidance (who took fixes to their ware from "yours truly" too, no less)) & again, no more encapsulated packet bulk... apk
There is a switch and service to disable User Experience (not send into to MS). This does nothing, one must disable them in the Task Options.
No remote access is the same way
Autoruns https://docs.microsoft.com/en-... allows you a one click to stop method. BUT could take many areas the same programs is turned off - I have always disabled "Windows Mail" I've 0 use for it. It must take some 20 disables - there obvious.
SMB is a one stop area.
Well, for what it's worth, at least the Windows systems described in the summary manage to boot properly, to the point of having network connectivity and running services.
I can't say the same for my Linux systems that run a distro that uses systemd. I've had those systems fail to boot much too often thanks to problems with systemd.
Maybe this is just systemd doing me a favor and protecting my Linux systems, though? After all, a Linux installation that doesn't boot far enough to mount the filesystems properly likely won't have network connectivity, and likely won't have any services running that might be susceptible to attack.
Give Linux Mint a try. Cinnamon became my favorite; only to find it as close to a Windows setup one's going to get (ie: WinKey+E open a file explorer). KDE is my goal but must learn Linux first.
And yes I and many others dual boot.
Remove the SMB service from the ISO before install.
Open ISO, remove said components from ISO, install
Use NFS.
[non-biblical citation needed]
Try the Trinity desktop. Operationally closer to Windows than is Cinnamon, and more configurable. (Admittedly I miss Win+E, but that can probably be fixed.)
I've been hunting for a linux I could love since 1998, and always they're too buggy or too annoying... but I think I've finally found it in PCLinusOS with Trinity desktop.
http://trinity.mypclinuxos.com...
~REZ~ #43301. Who'd fake being me anyway?
I might go back to LXDE some day. My "safe" desktop is Mate.
Last year they added a 0.1 version utility to set hotkeys. (it's in debian 9 as part of the deb package). Nice little thing, since editing the xml for openbox is a bit of a silly pain. I need my alt-f9 for minimizing.
https://blog.lxde.org/2016/11/...
LXDE does understand Win + D, the only dumb thing is Win key alone doesn't open the start menu, you need to hit ctrl-esc instead. I'd have to try remapping X11-wide the Win key to ctrl-esc and see if it prevent the Win + key shortcuts. Duh! ./ know about it :)
Tip : if you try to use Lubuntu, you'll notice the icons are butt ugly. Bunch of gray in the start menu. To fix the ugly desktop, change the icon theme to a normal-looking one (e.g. "Adwaita" might be installed already). i.e. I think Mate, LXDE, XFCE etc. desktops work well enough that icon themes and similar are much of what should dictate choice of desktop and distro.
This is so important that I wanted to let
I did try q4os : it's a debian with a company behind it that uses Trinity desktop and can look really much like Windows XP. I think it's a bit pointless since the friendly features (super easy software installer with almost nothing in it) and familiarity don't really help. Might be good though for its stated niche : end user desktop in professional business setting where it's the sysadmin that provides the stuff (perhaps the special packages?) and the user only provides the work.
Give Linux Mint a try. Cinnamon became my favorite; only to find it as close to a Windows setup one's going to get (ie: WinKey+E open a file explorer). KDE is my goal but must learn Linux first.
And yes I and many others dual boot.
I'm back to mint on my home desktop. I was running 10 to use Sketchup. I got Win 10 to run with opengl acceleration in VMWare player, though admittedly I haven't worked with it much yet. EIther way, it seems to run sketchup. I'm not aware of any other virtualization solution that supports opengl 3.x acceleration that easily.
One thing I'd like Mint to do, and linux in general, is to use the same hot key combo to lock the screen.
I tried q4os and exegnu (or whatever it's called) too, but found PCLOS slightly more polished. I liked KDE3/4 (which Trinity follows from) but find KDE5 endlessly frustrating, so it was off to Trinity for me. The other desktops are okay (except Gnome, which I hate) but I find them too limiting; I can't get things quite how I want 'em, either for appearance (when you stare at it all day, this matters) or just How Things Work. If I'm going to have a simplified setup, I prefer JWM.
Thanks for the tip on the hotkey app; downloaded and I'll give it a look.
I've seen LXDE setups that looked nice, and others that were what-were-they-smoking! Me, I *loathe* Adwaita (and all the "modern" flat pastel looks) and usually wind up with a weird hybrid of Oxygen and Plastik, just to get some color and texture back. You'd probably hate my desktop. :)
http://www.doomgold.com/images...
~REZ~ #43301. Who'd fake being me anyway?