4 ms·

Windows leverages some services on predefined ports. Namely smb on 445. Responder abuses weak auth via poisoning attacks which trigger smb on 445. Permitting s

Windows leverages some services on predefined ports. Namely smb on 445. Responder abuses weak auth via poisoning attacks which trigger smb on 445. Permitting standard users on a Linux machine to open 445 has security impacts for windows machines, and enables low priv system compromises being directly leveraged (e.g. without privesc) to move laterally. There are many other edge cases which rely on existing behaviour that would make changing this a dangerous change.

acdha 4y ago
This is a good example of the antiquated security model we need to put firmly in the past. If you’re depending on Linux’s privileged port mechanism to protect your Windows boxes, many things have already failed: 1. Your network should be segmented and authenticated: a Linux box listening on port 445 shouldn’t matter because it’s not in a network group which receives that. 2. Your Windows boxes should have their firewalls enabled since they shouldn’t normally be making SMB connections to your Linux servers. 3. Your Linux boxes should have their firewalls configured. 4. Your Windows boxes shouldn’t be accepting requests from strangers to connect over SMB. Another way to think about it: if there’s a major Windows vulnerability, is it more likely that it’ll be attacked by a Linux box or someone in accounting clicking on the wrong PDF? Ultimately you just can’t trust the client - the percentage of times where someone can run code on your Linux box but can’t get root or attack something on a different port is just not enough to rely on for anything. Since you already know you need to protect against those other things, just focus on doing that.
- deleted 4y ago
  [deleted]
- sph 4y ago
  No one is depending on it. Security is an onion. The more layers, the better. I still haven't read a good argument on why that layer has to be removed at all.
  - acdha 4y ago
    > No one is depending on it. Security is an onion. The more layers, the better. > > I still haven't read a good argument on why that layer has to be removed at all. The article is a good place to start. The privileged port security theater means that there have been generations of exploits caused by code which either ran as root when it would otherwise not be necessary, didn't correctly drop privileges, or had some kind of exploitable hand-off between a process running as root which has the bound port. I mention that because it's important to understand for the first point: layering can be useful if it's not duplicative – in this case, this is better handled by firewall policies which are a complete solution — but there's been a cost in exploitable security bugs and complexity due to what the original author described as a gross hack. When the benefits are minimal, those costs should guide the decision — and since the two other popular operating systems have already done this, it's pretty hard to make the case that this gives us a benefit worth keeping.
    - hsbauauvhabzb 4y ago
      So the kernel should change and world should compromise security because a few people can’t figure out how to change defaults? I think there’s a few other security gaps, like pre-service start socket locking etc that you also haven’t considered.
      - acdha 4y ago
        It’s more that we should get rid of things which add risk and don’t offer much security and focus on getting people to use the real security measures. I’m still seeing vendors claim they have to run Java as root on Linux because it needs to bind on port 80/443 and it’d be nice to stop having to haggle.
        hsbauauvhabzb 4y ago
        Yeah. Active directory is broken and has been for 25 years so that won’t be fixed. As strange as it sounds, aside from external implications (e.g. smb), a Java web service running as root _shouldnt_ have much impact - if you drop a shell on the host, it shouldn’t be doing anything more than running that one app. So dropping to jboss user or whatever should have no real world impact for low / sophistication attacks, as irrespective of user they’re still going to have access to db credentials etc. There are hypervisor breakouts etc which may be possible if you are root but not std user, but if you’re able to break out of hypervisors via 0day you probably also have privesc 0day. Edit: I say ‘shouldn’t matter’. If it does matter, you’ve probably got architectural issues in system design.
kalleboo 4y ago
> Permitting standard users on a Linux machine to open 445 has security impacts for windows machines I can connect my phone to your WiFi and now I'm not a "standard user on a Linux machine" anymore but an administrator. The only way to protect the Windows users are with proper network security/firewalling.

acdha 4y ago

This is a good example of the antiquated security model we need to put firmly in the past. If you’re depending on Linux’s privileged port mechanism to protect your Windows boxes, many things have already failed: 1. Your network should be segmented and authenticated: a Linux box listening on port 445 shouldn’t matter because it’s not in a network group which receives that. 2. Your Windows boxes should have their firewalls enabled since they shouldn’t normally be making SMB connections to your Linux servers. 3. Your Linux boxes should have their firewalls configured. 4. Your Windows boxes shouldn’t be accepting requests from strangers to connect over SMB. Another way to think about it: if there’s a major Windows vulnerability, is it more likely that it’ll be attacked by a Linux box or someone in accounting clicking on the wrong PDF? Ultimately you just can’t trust the client - the percentage of times where someone can run code on your Linux box but can’t get root or attack something on a different port is just not enough to rely on for anything. Since you already know you need to protect against those other things, just focus on doing that.

deleted 4y ago
[deleted]
sph 4y ago
No one is depending on it. Security is an onion. The more layers, the better. I still haven't read a good argument on why that layer has to be removed at all.
- acdha 4y ago
  > No one is depending on it. Security is an onion. The more layers, the better. > > I still haven't read a good argument on why that layer has to be removed at all. The article is a good place to start. The privileged port security theater means that there have been generations of exploits caused by code which either ran as root when it would otherwise not be necessary, didn't correctly drop privileges, or had some kind of exploitable hand-off between a process running as root which has the bound port. I mention that because it's important to understand for the first point: layering can be useful if it's not duplicative – in this case, this is better handled by firewall policies which are a complete solution — but there's been a cost in exploitable security bugs and complexity due to what the original author described as a gross hack. When the benefits are minimal, those costs should guide the decision — and since the two other popular operating systems have already done this, it's pretty hard to make the case that this gives us a benefit worth keeping.
  - hsbauauvhabzb 4y ago
    So the kernel should change and world should compromise security because a few people can’t figure out how to change defaults? I think there’s a few other security gaps, like pre-service start socket locking etc that you also haven’t considered.
    - acdha 4y ago
      It’s more that we should get rid of things which add risk and don’t offer much security and focus on getting people to use the real security measures. I’m still seeing vendors claim they have to run Java as root on Linux because it needs to bind on port 80/443 and it’d be nice to stop having to haggle.
      - hsbauauvhabzb 4y ago
        Yeah. Active directory is broken and has been for 25 years so that won’t be fixed. As strange as it sounds, aside from external implications (e.g. smb), a Java web service running as root _shouldnt_ have much impact - if you drop a shell on the host, it shouldn’t be doing anything more than running that one app. So dropping to jboss user or whatever should have no real world impact for low / sophistication attacks, as irrespective of user they’re still going to have access to db credentials etc. There are hypervisor breakouts etc which may be possible if you are root but not std user, but if you’re able to break out of hypervisors via 0day you probably also have privesc 0day. Edit: I say ‘shouldn’t matter’. If it does matter, you’ve probably got architectural issues in system design.

kalleboo 4y ago

> Permitting standard users on a Linux machine to open 445 has security impacts for windows machines I can connect my phone to your WiFi and now I'm not a "standard user on a Linux machine" anymore but an administrator. The only way to protect the Windows users are with proper network security/firewalling.