5 ms·

I've been following this closely over the last couple of hours on Twitter as the news broke. What does it mean in practice? From what I have read one of the vu

I've been following this closely over the last couple of hours on Twitter as the news broke. What does it mean in practice? From what I have read one of the vulnerabilities seems to be a 0day targeting SMB on Windows. One commentator suggested it's enabled by default on the majority of Windows machines (of that I am sceptical). Presumably most people are behind a router which would stop this in its tracks? A lot of people (who I would probably take seriously) suggest disconnecting Windows machines from the internet for the time-being. Is it really this bad? Are there millions of Windows (home-)users who are vulnerable (by default) today?

BinaryIdiot 10y ago
> Presumably most people are behind a router which would stop this in its tracks? Trouble is there are millions of IoT devices with terrible security some of which are alway owned and inside the network. They could be used as a delivery tool to attack multiple machines inside of a network. I'm not sure how many folks connect directly to the internet anymore. Hopefully not many.
- Teichopsia 10y ago
  "Connect directly". Could you please elaborate on that?
  - BinaryIdiot 10y ago
    Connecting a computer directly to a modem, not a router.
    - Teichopsia 10y ago
      Thanks.
jacquesm 10y ago
> One commentator suggested it's enabled by default on the majority of Windows machines (of that I am sceptical). It's been a while since I used windows but there used to be such a thing as the administrative share. https://en.wikipedia.org/wiki/Administrative_share https://en.wikipedia.org/wiki/Administrative_share So I don't find that hard to believe at all.
noinsight 10y ago
> one of the vulnerabilities seems to be a 0day targeting SMB on Windows. If your computer's network profile is set to Public, it will be firewalled off. In other cases YMMV. On corporate networks, AD Domain Controllers are (usually) the most highly privileged servers on the network and they will always have SMB enabled and accessible to the entire domain network because Group Policy relies on SMB shares. Compromise the Domain Controllers and you own the entire (Windows) network because they can administer everything.
fulafel 10y ago
All internet users are behind routers, their function is the opposite of blocking traffic.
- misterdata 10y ago
  Yes, but most NAT routers consumers use act as a firewall too (i.e. they block ingress traffic that is not related to a connection that was initiated from inside)
  - fulafel 10y ago
    NAT is not really routing, routers are expressly forbidden from altering the address and port in IP packets.

BinaryIdiot 10y ago

> Presumably most people are behind a router which would stop this in its tracks? Trouble is there are millions of IoT devices with terrible security some of which are alway owned and inside the network. They could be used as a delivery tool to attack multiple machines inside of a network. I'm not sure how many folks connect directly to the internet anymore. Hopefully not many.

Teichopsia 10y ago
"Connect directly". Could you please elaborate on that?
- BinaryIdiot 10y ago
  Connecting a computer directly to a modem, not a router.
  - Teichopsia 10y ago
    Thanks.

jacquesm 10y ago

> One commentator suggested it's enabled by default on the majority of Windows machines (of that I am sceptical). It's been a while since I used windows but there used to be such a thing as the administrative share. https://en.wikipedia.org/wiki/Administrative_share https://en.wikipedia.org/wiki/Administrative_share So I don't find that hard to believe at all.

noinsight 10y ago

> one of the vulnerabilities seems to be a 0day targeting SMB on Windows. If your computer's network profile is set to Public, it will be firewalled off. In other cases YMMV. On corporate networks, AD Domain Controllers are (usually) the most highly privileged servers on the network and they will always have SMB enabled and accessible to the entire domain network because Group Policy relies on SMB shares. Compromise the Domain Controllers and you own the entire (Windows) network because they can administer everything.

fulafel 10y ago

All internet users are behind routers, their function is the opposite of blocking traffic.

misterdata 10y ago
Yes, but most NAT routers consumers use act as a firewall too (i.e. they block ingress traffic that is not related to a connection that was initiated from inside)
- fulafel 10y ago
  NAT is not really routing, routers are expressly forbidden from altering the address and port in IP packets.