The Anti-virus Times

Tuesday, November 13, 2018

It’s an interesting game. You connect an unpatched
Windows PC to the network and wait to see what
gets downloaded faster — the latest update or a virus.

https://geektimes.ru/post/289153

The main reason the WannaCry Trojan has been successful is because of a vulnerability within the SMB v1 protocol (Server Message Block (SMB) version 1). The protocol, used to organize file sharing, allows applications to read and write files and also to request server software services on a computer network, i.e., to exchange data with any server program configured to receive SMB client requests. Using the SMB protocol, an application (or a user) can access a remote server’s files and other resources. Simply put, if you open access to a folder or use shared folders on other computers, the SMB protocol makes that possible.

This protocol exists in three versions. By default support for SMB 1.0 is enabled in Windows 10 and Server 2016 since computers that no longer support Windows XP or Server 2003 may be present in a local network. If no such machines remain in a network, in the current (i.e., supported) versions of Windows, it is desirable to disable the SMB 1.x protocol or to remove the driver completely. This will block attackers from accessing the many vulnerabilities present in this outdated protocol. In this case the shared resources will remain accessible: all the clients trying to access SMB shared files will use the newer and more functional versions of the SMB protocol.

Quite a number of methods can be used to disable support for the outdated protocol (https://support.microsoft.com/ru-ru/help/2696547/how-to-enable-and-disable-smbv1-smbv2-and-smbv3-in-windows-and-windows-server, http://winitpro.ru/index.php/2017/05/10/otklyuchenie-smb-1-0-v-windows-10-server-2016/). We will cite the simplest one:

1. Open the Execute menu using the Win+R keyboard shortcut or the Start button.
2. Input the "cmd" command, and click ОК.
3. In the command line enter the command dism /online /norestart /disable-feature /featurename:SMB1Protocol

Attention! The command Dism is present in Windows 7 service pack 1 and higher. For earlier systems, you need to edit the registry to close access to the protocol.

Disabling an obsolete protocol is unlikely to harm those not using outdated corporate systems at home.

However, if anyone is breathing a sigh of relief after installing the updates and removing the old protocol, it is too early to rejoice.

In simple words: If you have a writable shared resource, attackers can execute the needed code on the computer with the shared folder. Moreover, while WannaCry implemented a vulnerability that operates only in Windows, and while Linux and Mac owners did not come under attack, the new (not widely known, to be more precise) vulnerability at a minimum affects Linux.

Thus, the story of vulnerabilities goes on.