5 ms·

Over-hyped. Nobody in their right mind would expose a SMB share to the public net which mitigates the exploits a bit, and for #1 SMB servers have a long history

by orf 11y ago

Over-hyped. Nobody in their right mind would expose a SMB share to the public net which mitigates the exploits a bit, and for #1 SMB servers have a long history with MITM issues. Yes they are bad and people should patch, but did it really need such a build up, and how did the build up help?

jra_samba 11y ago
Read the disclosures. It's not SMB. It's nothing to do with SMB. It's your AD-DC that is at risk here.
- tptacek 11y ago
  It's not SMB, but it's all DCE RPC, right?
  - jra_samba 11y ago
    Yes that's correct. But DCE RPC is used for control of all AD-DC instances. That's why it's rated important.
- orf 11y ago
  I have, and I didn't say it had anything to do with it. The point is it's hardly a heartbleed or even a shellshock. Having samba accessible from the public internet is a issue in itself, regardless of this exploit. The MITM is dangerous I guess, but it's a MITM. It's bad, but not super-hypetrain mega-branding bad. It's not colleagues talking about it at lunch bad. Plus all the shady stuff other people have commented on here. Edit: having re-read the release ok, yeah, it's pretty bad. I still think you overdid it on the release though.
  - jra_samba 11y ago
    I can't disagree. But I (and the Samba Team) didn't create the website or do the hype.
jlgaddis 11y ago
Unfortunately, there are a lot of people not "in their right mind" that work in I.T. About 18 months ago, I was asked to look into an issue one of our customers was experiencing (we're primarily an ISP but we also provide some managed services to our customers as well). They had several Windows (2003 and 2008) servers sitting on the public Internet, with public IP addresses, not behind a firewall. Among several other "WTFs?", their primary domain controller was being used 24/7 in DoS (amplification) attacks by way of the DNS service. Of course, every other port that Windows exposes by default was open and accessible to the world on this machine (and several others). Don't underestimate the clusterfucks that can happen when so-and-so's nephew who is "good with computers" is allowed to run things.

by orf 11y ago

jra_samba 11y ago

Read the disclosures. It's not SMB. It's nothing to do with SMB. It's your AD-DC that is at risk here.

tptacek 11y ago
It's not SMB, but it's all DCE RPC, right?
- jra_samba 11y ago
  Yes that's correct. But DCE RPC is used for control of all AD-DC instances. That's why it's rated important.
orf 11y ago
I have, and I didn't say it had anything to do with it. The point is it's hardly a heartbleed or even a shellshock. Having samba accessible from the public internet is a issue in itself, regardless of this exploit. The MITM is dangerous I guess, but it's a MITM. It's bad, but not super-hypetrain mega-branding bad. It's not colleagues talking about it at lunch bad. Plus all the shady stuff other people have commented on here. Edit: having re-read the release ok, yeah, it's pretty bad. I still think you overdid it on the release though.
- jra_samba 11y ago
  I can't disagree. But I (and the Samba Team) didn't create the website or do the hype.

jlgaddis 11y ago

Unfortunately, there are a lot of people not "in their right mind" that work in I.T. About 18 months ago, I was asked to look into an issue one of our customers was experiencing (we're primarily an ISP but we also provide some managed services to our customers as well). They had several Windows (2003 and 2008) servers sitting on the public Internet, with public IP addresses, not behind a firewall. Among several other "WTFs?", their primary domain controller was being used 24/7 in DoS (amplification) attacks by way of the DNS service. Of course, every other port that Windows exposes by default was open and accessible to the world on this machine (and several others). Don't underestimate the clusterfucks that can happen when so-and-so's nephew who is "good with computers" is allowed to run things.