Slashdot Mirror
Microsoft Won't Patch 20-Yr-Old SMBv1 Vulnerability (You Should Just Turn the Service Off) (onmsft.com)
An anonymous reader shares a news post: Following the recent WannaCry and Petya ransomware attacks, Microsoft recommended all Windows 10 users to remove the unused but vulnerable SMBv1 file sharing protocol from their PCs. This is because both variants of the ransomware actually used the same SMBv1 exploit to replicate through network systems, even though it seems that Petya mostly affected Windows PCs in Ukraine. Anyway, if you haven't turned off the protocol on the PC already, you really should: Not only because new WannaCry/Petya variants could once again use the same vulnerability again to encrypt your files, but because another 20-year-old flaw has just been unveiled during the recent DEF CON hacker conference. The SMB security flaw called "SMBLoris" was discovered by security researchers at RiskSense, who explained that it can lead to DoS attacks affecting every version of the SMB protocol and all versions of Windows since Windows 2000. More importantly, a Raspberry Pi and just 20 lines of Python code are enough to put a Windows server to its knees.
Why doesn't Microsoft patch the OS so that SMB1 is disabled entirely? I mean MS already shoves all sorts of crap down your throat anyways, why can't that unshove shit?
Most of HP's multi-function printers with Scan To Network only support SMB1. When will they issue a firmware update that adds support for SMB2?
You shouldn't use outdated standards. I thought this was already decided. Let me go update my router so that it'll fix a bug in WEP. That'll make it secure.
Like Robert Graham describes in http://blog.erratasec.com/2017..., it's a type of attack that can be perpetrated against any service on the internet.
Solutions:
- Build a proxy service (per the article) that parses input before passing it to $SERVICE.
- Do not put it on the internet (i.e. firewall).
Is SMB open by default in Windows Firewall anyway? If anything, pooh-pooh Redmond for that. I know, I know, millions of affected hosts.
https://support.microsoft.com/...
Because SMBv2 on android is apparently still difficult. With ES File Explorer, you need to install some crappy game to get SMBv2 support and it's spotty at best. Not everyone likes to run a streaming server (that actually have client-like, full screen interfaces), just have a share or two and access it via SMB from all kinds of devices. Maybe there'll be a Windows port of SAMBA to use a non-vulnerable version of SMBv1.
When the copyright term is "forever minus a day", live every day like it's the last.
The trouble is that lots of software still requires it. Probably why MS don't turn it off via an update.
Remove it just to see it reappear after the next windows update.
sudo rm -r -f --no-preserve-root /
By "the service" do you mean SMB? The threat is descirbed as affecting all versions of SMB, but nearly all of the tech writers describing the bug are suggesting turning off SMBv1. Is no one actually paying attention to what the authors are saying, or am I missing something?
On an otherwise air-gapped network which receives periodic functionality and security updates via local WSUS, SMB1 might be perfectly safe to use. In fact, there are a great many instances where SMB1 might not pose a problem, and many of them involve expensive equipment that only speaks SMB1. Why would MS push an update to piss of the majority of medium-to-large businesses, who are the typical users of such equipment and configurations?
Those are the only users they seem to care about not pissing off right now.
APK quotes people (including myself) without context and should not be trusted. Just thought you should know.
I couldn't see the move as any more disastrous as entire hospitals going offline...
What, pray tell, do you think happens when the whole reason the hospital has SMB1 enabled on its systems in the first place is to talk to multi-hundred-thousand- and multi-million-dollar pieces of medical equipment (think MRI and such) that don't speak SMB2?
Therein lies the rub.
Yes, those machines should be on an air-gapped network shared only with the workstations used to control and operate them. No, the vendors of those machines will not allow that because they want realtime monitoring of the equipment. Blame those vendors for Microsoft really not being able to do anything about this; it's not like hospitals can say "fine, if you won't sell us a more up-to-date MRI we just won't have one at all", they'd face liability for not utilizing every available means of diagnosis and treatment.
APK quotes people (including myself) without context and should not be trusted. Just thought you should know.
There's a patch for this.
https://linuxmint.com/download...
aaaaaaa
Won't this leave all Windows machines vulnerable to any other exploit that would gain access to the device, potentially turn it on again, and allow the ransomware to do its damage?
It would be better to remove SMB1 support entirely, or patch it if that's too difficult for MS.
Agreed, there is a huge lot of older but still functional equipment that only talks SMB1. Microsoft has put together this list, and it surely isn't everything: https://blogs.technet.microsoft.com/filecab/2017/06/01/smb1-product-clearinghouse/
VLANs aren't a perfect solution, switch firmware can potentially be exploited and we're talking about potentially life-and-death critical infrastructure. Beyond that, if the vendors want the equipment on the public internet (which they do, which you'd understand had you read my entire post before spouting off), VLANs aren't really a solution.
APK quotes people (including myself) without context and should not be trusted. Just thought you should know.
https://www.freebsd.org/
OS X still has such miserable SMB client we are stuck with SMB1/CIFS to maintain some semblance of reliability and speed.
It has happened before. Microsoft will choose backward compatibility over security at any day of the week. There was a exploitable flaw in NT4 with DCOM that they wouldn't patch because it would fundamentally change how things worked. Your option is to keep it, or move to something else. Same with this SMB1 crap. If you need it, it is there. But it is old and decrepit and not even MS wants to touch it. Move on.
"When life gives you lemons, don't make lemonade. Make life take the lemons back!" -- Cave Johnson
There is a switch and service to disable User Experience (not send into to MS). This does nothing, one must disable them in the Task Options.
No remote access is the same way
Autoruns https://docs.microsoft.com/en-... allows you a one click to stop method. BUT could take many areas the same programs is turned off - I have always disabled "Windows Mail" I've 0 use for it. It must take some 20 disables - there obvious.
SMB is a one stop area.
Well, for what it's worth, at least the Windows systems described in the summary manage to boot properly, to the point of having network connectivity and running services.
I can't say the same for my Linux systems that run a distro that uses systemd. I've had those systems fail to boot much too often thanks to problems with systemd.
Maybe this is just systemd doing me a favor and protecting my Linux systems, though? After all, a Linux installation that doesn't boot far enough to mount the filesystems properly likely won't have network connectivity, and likely won't have any services running that might be susceptible to attack.
Give Linux Mint a try. Cinnamon became my favorite; only to find it as close to a Windows setup one's going to get (ie: WinKey+E open a file explorer). KDE is my goal but must learn Linux first.
And yes I and many others dual boot.
I work in a hospital and you are right. Multi million dollar FDA approved equipment is slow to get updates. The larger the company the worse the service (I am looking at you GE). However, MRIs should talk DICOM and not SMB. SMB would be a very stupid option!
My point was that there is plenty of equipment in use today (mostly high-end and expensive printers) which, of the file transfer protocols Windows speaks natively, only speak SMB1, and that the fault for those systems being online often lies with vendors, while the fault for those systems being misconfigured and the network they are on being vulnerable often lies with the IT department. I framed my argument in terms of a hospital because that's what I was replying to.
And you should know that many hospitals do use printers affected by this.
APK quotes people (including myself) without context and should not be trusted. Just thought you should know.
Or you just turn it all off via script as part of the install process; then you're at the same point you'd be at with a fresh Linux install. From there, regardless of platform, you still have to figure out what needs turned on.
APK quotes people (including myself) without context and should not be trusted. Just thought you should know.
Try the Trinity desktop. Operationally closer to Windows than is Cinnamon, and more configurable. (Admittedly I miss Win+E, but that can probably be fixed.)
I've been hunting for a linux I could love since 1998, and always they're too buggy or too annoying... but I think I've finally found it in PCLinusOS with Trinity desktop.
http://trinity.mypclinuxos.com...
~REZ~ #43301. Who'd fake being me anyway?
Yes, those machines should be on an air-gapped network shared only with the workstations used to control and operate them.
Sure. Let's forget the PACS systems, the Radiologists's workstations, the research workstations, the various long term storages, medical records, the file room, transfer systems to other hospitals, etc. The size of radiological files for things like CTs and MRIs is too large to deal with sneakernet in the normal workflow. Nevermind who knows how many corner cases such as downtime workflows. Even CR and DR are a pain in the ass these days and being phased out for wireless transfer and those are just plain films. YOu might as well talk about air gapping the different nodes of your Beowulf cluster from each other.
Let's not forget the RIS and HIS coming from the other direction. You really don't want techs having to wait till they finish manually entering in all the patient and exam data before they can start some exam, and then hoping nothing is wrong.
And that attitude is why hospitals are easy targets for ransomware. Enjoy your infection while I treat my own.
APK quotes people (including myself) without context and should not be trusted. Just thought you should know.
I tried q4os and exegnu (or whatever it's called) too, but found PCLOS slightly more polished. I liked KDE3/4 (which Trinity follows from) but find KDE5 endlessly frustrating, so it was off to Trinity for me. The other desktops are okay (except Gnome, which I hate) but I find them too limiting; I can't get things quite how I want 'em, either for appearance (when you stare at it all day, this matters) or just How Things Work. If I'm going to have a simplified setup, I prefer JWM.
Thanks for the tip on the hotkey app; downloaded and I'll give it a look.
I've seen LXDE setups that looked nice, and others that were what-were-they-smoking! Me, I *loathe* Adwaita (and all the "modern" flat pastel looks) and usually wind up with a weird hybrid of Oxygen and Plastik, just to get some color and texture back. You'd probably hate my desktop. :)
http://www.doomgold.com/images...
~REZ~ #43301. Who'd fake being me anyway?