Got this update from CERT last night.....Don't know if it's been posted yet, but here it is anyways...
Got Windoze?????
http://www.cert.org/advisories/CA-2003-08.html
Printable View
Got this update from CERT last night.....Don't know if it's been posted yet, but here it is anyways...
Got Windoze?????
http://www.cert.org/advisories/CA-2003-08.html
If you don't password protect your shares and have a null password, wtf do you expect? I have a share on my comp. In fact, the whole of my D: is shared. But, only one IP is allowed to access it. Others can't even see the share. Also, the user account that has the priveleges of seeing the share, is a Non-Admin account with absolutely minimal priveleges with a 15 character password. Windows shares are already notoriously insecure, so if you need to use them, make sure you secure them as much as you can.
Cheers,
cgkanchi
Have you ever done an SMB scan on some public networks? You'd be throughly surprised at what is accessible out there. You are smart enough to know to put passwords on system resources, but what about the guy who just bough his new version of XP or 2000, that doesn't know that C$ and ADMIN$ are shared out automatically? This article was just FYI.....sharing the wealth, as one of my former bosses said, as he stole information from another co-worker...hahahaha
ya .. i know SMB mate .. and i understand what do you talking .
SMB is a client server, request-response protocol. The only exception to the request-response nature of SMB is when the client has requested opportunistic locks / oplocks and the server sequently has to break an already granted oplock because another client has requested a file open. And about the security SMB defines :Quote:
Have you ever done an SMB scan on some public networks?
1). Share level.
2). User Level.
in this case i agree with "d0ppelg@nger"
and also "cgkanchi" correct about windows share security becoz i do windows share security either but ever done with SMB for a while.Quote:
If you don't password protect your shares and have a null password, wtf do you expect? I have a share on my comp. In fact, the whole of my D: is shared. But, only one IP is allowed to access it. Others can't even see the share. Also, the user account that has the priveleges of seeing the share, is a Non-Admin account with absolutely minimal priveleges with a 15 character password.
Both of you gave good explanation and suggestion .. so i think both of you correct.
:)
Dude,
Can you not explain something in your own words?
Quote:
This is from here:
SMB is a client server, request-response protocol. The only exception to the request-response nature of SMB is when the client has requested opportunistic locks / oplocks and the server sequently has to break an already granted oplock because another client has requested a file open.