Zero-Day Windows Security Flaw Can Crash Systems, Cause BSODs (helpnetsecurity.com) 64
Orome1 quotes a report from Help Net Security: A zero-day bug affecting Windows 10, 8.1, Windows Server 2012 and 2016 can be exploited to crash a vulnerable system and possibly even to compromise it. It is a memory corruption bug in the handling of SMB traffic that could be easily exploited by forcing a Windows system to connect to a malicious SMB share. Tricking a user to connect to such a server should be an easy feat if clever social engineering is employed. The vulnerability was discovered by a researcher that goes by PythonResponder on Twitter, and who published proof-of-exploit code for it on GitHub on Wednesday. The researcher says that he shared knowledge of the flaw with Microsoft, and claims that "they had a patch ready 3 months ago but decided to push it back." Supposedly, the patch will be released next Tuesday. The PoC exploit has been tested by SANS ISC CTO Johannes Ullrich, and works on a fully patched Windows 10. "To be vulnerable, a client needs to support SMBv3, which was introduced in Windows 8 for clients and Windows 2012 on servers," he noted, and added that "it isn't clear if this is exploitable beyond a denial of service." Until a patch is released, administrators can prevent it from being exploited by blocking outbound SMB connections (TCP ports 139 and 445, UDP ports 137 and 138) from the local network to the WAN, as advised by CERT/CC. "The tweet originally announcing this issue stated that Windows 2012 and 2016 is vulnerable," the researcher said. "I tested it with a fully patched Windows 10, and it got an immediate blue screen of death."
10 = Blue Screen (Score:2)
Re: (Score:2)
I believe that it is whatever accent color you choose for Windows 10 in general.
Re: (Score:1)
Those blue screens and the event viewer are probably trying to tell you something. You may want to look into it.
My bet is bad memory or some other faulty component or a bad driver.
Re: (Score:2)
Yeahh, they trying to tell you about a segfault at address 0xdeadbeef in binary blob xyz, but sorry, you don't get to debug it. tough shit. keep the money flowing anyway, k?
Re: (Score:3)
Crashing all day? I suggest getting a book or taking a class on how to install and configure 2012 servers. Or maybe just get someone who knows what the hell they are doing to setup your server(s). The #1 cause of server exploits in both Windows and Linux OS's are the idiot administrators.
Re: (Score:2)
I didn't mean to imply all administrators are idiots. There are a lot of very good administrators out there but at the same time there are also a lot of not so good administrators.
"If a system/domain/network administrator needs a class or a book to setup a stable basic system, they are in the wrong line of work"
Maybe they are just entry level newbies that do need books and classes to supplement their real world experience.
Re: (Score:1)
We usually have 9.1 crashes per day on our Windows servers, but today we had over three hundred. We have TCP port 139 open from our internal network to production, so maybe one of our employees has an infection. After closing that port about twenty minutes ago, there's only been a single Windows server that crashed. Glad I found this story.
Re: (Score:1)
Are people logged into those servers and browsing the web? This hole can be exploited if your network allows *outbound* traffic on ports 137/138/139/445. A malicious or compromised web page can embed a link like <img src="\\1.2.3.4\share$\exploit"> and now you're owned, even if inbound SMB is blocked.
Re: (Score:2)
Eh (Score:2)
Ha! (Score:2)
"It's a Bird... It's a Plane... It's SMB!" (Score:2)
You CAN blame it on Trump. Won't be true . . . (Score:2)
No, on second thought let's not blame it on Trump. There's plenty else he correctly deserves the blame for, and Microsoft alone is responsible for the reputation and state of the OS soft
Yet another reason... (Score:2, Informative)
Yet another reason, if we really *need* another, to quit using MS products. I used/supported MS products for 20 years as a sysadmin, but when I retired in 2010, I decided I was done with Windows on my personal systems. I had been dualbooting Win7 and Linux, but once I made the decision, I simply deleted the Win7 partition, and reinstalled grub. After 6 years of zero MS, I've not missed it a bit.. In fact, I'm forced to use Windows in a part-time volunteer support position with a local charity, and I find th
Re: (Score:2)
Yet another reason, if we really *need* another, to quit using MS products.
[...]
After seeing all of the multiple forms of abuse MS heaps on those who still use Windows...
Hold your horses buddy! You can't just take my schadenfreude joy away! I mean, come on, not when the real suffering is just about to begin! ;)
pointless? (Score:2)
Stupid (Score:3)
Attacking SMB is retarded. SMB services should -never- ever be exposed to the internet, under any circumstances. Anyone who does expose SMB to the internet deserves to get hacked. Bury that crap in a VPN, use a firewall, and disregard this silliness.
Re:Stupid (Score:4, Informative)
SMB services should -never- ever be exposed to the internet, under any circumstances.
If it's like the last SMB issue, then the issue is not that they send packets to an SMB server, but rather get the machine to connect (outbound) to a malicious SMB server, which replies with malicious packets.
This can be done using standard phishing tricks.
This is why one should block outbound SMB traffic as well.
Re: (Score:2)
This is why one should block outbound SMB traffic as well.
As I said, firewall. Keep that junk contained to a intranet/VPN. SMB does not belong on the internet, in the clear at least.
Re: (Score:2)
This is why one should block outbound SMB traffic as well.
As I said, firewall. Keep that junk contained to a intranet/VPN. SMB does not belong on the internet, in the clear at least.
No Grandma ... look go to 192.168.1.1. No grandma in your browser ... no in Chrome type that in ... no go to firewall ...
Re: (Score:1)
And that will prevent an attack from inside your network exactly how? Even if you disallow any foreign machines from attaching to your network, it only takes one connection to an existing compromised machine to spread. The only solution is to get rid of SMB network or fix the SMB stack.
Re: (Score:2)
Attacks from inside the network can typically be traced to one particular machine+user. Who's then getting fired and/or sued.
Re: (Score:3)
Re: (Score:1)
Irresponsible disclosure (Score:3, Interesting)
Regardless of whether they pushed it back or not, if they're planning to release next Tuesday then disclosing the hole with PoC exploit code is just irresponsible. You could have waited 5 more days.
Re: (Score:2)
Re: Irresponsible disclosure (Score:4, Insightful)
Make sure your SMB is behind a firewall.
RTFA: It is not an attack on your SMB. It's a phishing-style attack vector that tricks users into contacting a malicious server. More appropriately, one should block outbound SMB traffic to "not your SMB".
Re: (Score:1)
one should block outbound SMB traffic to "not your SMB".
Yeap.
Re: (Score:2)
Many ISPs actually block the default windows ports by default across their networks...
Re: (Score:2)
Regardless of whether they pushed it back or not, if they're planning to release next Tuesday then disclosing the hole with PoC exploit code is just irresponsible. You could have waited 5 more days.
Probably because it will break a SHIT load of intranet and Sharepoint apps on corporate networks. Then the next headline on Slashdot is ... MS RELEASES EVIL UPDATE THAT RUINS CORPORATE NETWORKS ... then we see the negative comments here about updates etc.
MS can not catch a break either way.
Yes having SMB over TCP/IP sounds outright retarded. But many corporate apps on different subnets can not route SMB because of NetBie which is a non routable protocol layer 2 . So Sharepoint and VBScript encapsulate this
Re: (Score:2)
It depends on his motivations. He could be doing this to embarrass MS, but it may be that he's pressuring them to ensure that the patch gets released on Tuesday. He's been sitting on a 0-day for three months, so he could embarrass them at any time of his choosing. Why do it a few days before a patch Tuesday, i.e. when it will have the smallest impact?
FTFY (Score:2)
Where's my villain mustache and hat? (Score:3)