Heads up: SMB (aka Windows File Sharing) should NOT be publicly routed

Tech Talk Windows
1

SMB v3 has a bug that is currently not patched. It was never (and will never be) a good idea to allow SMB connections over the open Internet. (You should use a VPN between sites if you need to file share between locations.) Right now this looks like it could be wormable, so hopefully MS acts quickly to patch it. (Remember the SMB v1 problems back in 2017? (Wannacry and Petya and later derivations.)
https://isc.sans.edu/forums/diary/Critical+SMBv3+Vulnerability+Remote+Code+Execution/25890/

This could be a serious risk if malware gets though your protections. Remember the problems that the UK NHS had in 2017? As always, be extra aware, never click on anything in an email, etc. Stay safe out there…

2 Likes
2

Yes. We’ve known since the 1990s that SMB shouldn’t be activated on an open connection or routed to the Internet.

Interestingly, it only seems to affect Server 2016/2019. There was no mention of Server 2012(R2) being affected.

1 Like
3

Since it’s SMB 3 with compression only, I expect the list of OS versions that include that is somewhat restricted to newer OS versions.

1 Like
4

Yes, that is my guess.

1 Like
5

There is a handy little SMB config tool called SMBChanger
http://wieldraaijer.nl/others.html

2 Likes
6

I’m going to paste the link to the Microsoft advisory in this thread because although it is referenced in the Sans post it’s actually more detailed than that, and they say it will be updated as more information becomes available:

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/adv200005

1 Like
7

Looks like MS has decided to do an out of cycle patch of some sort:
https://support.microsoft.com/en-us/help/4551762/windows-10-update-kb4551762

1 Like
8

ZDNet.com has put up a decent article on this too: