ned wasn’t kidding: the end of smb1 - interopevents.com wasn’t kidding2... ·...
TRANSCRIPT
![Page 1: Ned wasn’t kidding: The End of SMB1 - interopevents.com wasn’t kidding2... · aka.ms/StopUsingSmb1 SMB1 vendor & product list - aka.ms/StillNeedsSmb1 SMB & Windows Server - aka.ms/windowsserver](https://reader030.vdocuments.net/reader030/viewer/2022013113/5a9dde9a7f8b9a96438d8b36/html5/thumbnails/1.jpg)
Ned wasn’t kidding: The End of SMB1
Ned Pyle
Microsoft
![Page 2: Ned wasn’t kidding: The End of SMB1 - interopevents.com wasn’t kidding2... · aka.ms/StopUsingSmb1 SMB1 vendor & product list - aka.ms/StillNeedsSmb1 SMB & Windows Server - aka.ms/windowsserver](https://reader030.vdocuments.net/reader030/viewer/2022013113/5a9dde9a7f8b9a96438d8b36/html5/thumbnails/2.jpg)
SMB 3.1.1
The evolution of SMB
Past 5 yearsThe 1980s The 1990s mid 2000s
The primordial ooze SMB1/”CIFS” SMB2 SMB3
![Page 3: Ned wasn’t kidding: The End of SMB1 - interopevents.com wasn’t kidding2... · aka.ms/StopUsingSmb1 SMB1 vendor & product list - aka.ms/StillNeedsSmb1 SMB & Windows Server - aka.ms/windowsserver](https://reader030.vdocuments.net/reader030/viewer/2022013113/5a9dde9a7f8b9a96438d8b36/html5/thumbnails/3.jpg)
SMB 1
DOS, Windows, LANMan(!)
Ubiquitously abused
Slow, unsafe $%^#
![Page 4: Ned wasn’t kidding: The End of SMB1 - interopevents.com wasn’t kidding2... · aka.ms/StopUsingSmb1 SMB1 vendor & product list - aka.ms/StillNeedsSmb1 SMB & Windows Server - aka.ms/windowsserver](https://reader030.vdocuments.net/reader030/viewer/2022013113/5a9dde9a7f8b9a96438d8b36/html5/thumbnails/4.jpg)
SMB 2
Windows Vista+ / Windows Server 2008+
User-optimizedRequest compounds, large reads and writes
Folder & file property caching
Durable handles
Improved message signing - HMAC SHA-256
Large MTU support
![Page 5: Ned wasn’t kidding: The End of SMB1 - interopevents.com wasn’t kidding2... · aka.ms/StopUsingSmb1 SMB1 vendor & product list - aka.ms/StillNeedsSmb1 SMB & Windows Server - aka.ms/windowsserver](https://reader030.vdocuments.net/reader030/viewer/2022013113/5a9dde9a7f8b9a96438d8b36/html5/thumbnails/5.jpg)
SMB 3
SMB 3.0
SMB 3.02
SMB 3.1.1
Windows 8+ / Windows Server 2012+
Datacenter application-optimized
Software-defined fabric
Modern user
Security-oriented
![Page 6: Ned wasn’t kidding: The End of SMB1 - interopevents.com wasn’t kidding2... · aka.ms/StopUsingSmb1 SMB1 vendor & product list - aka.ms/StillNeedsSmb1 SMB & Windows Server - aka.ms/windowsserver](https://reader030.vdocuments.net/reader030/viewer/2022013113/5a9dde9a7f8b9a96438d8b36/html5/thumbnails/6.jpg)
![Page 7: Ned wasn’t kidding: The End of SMB1 - interopevents.com wasn’t kidding2... · aka.ms/StopUsingSmb1 SMB1 vendor & product list - aka.ms/StillNeedsSmb1 SMB & Windows Server - aka.ms/windowsserver](https://reader030.vdocuments.net/reader030/viewer/2022013113/5a9dde9a7f8b9a96438d8b36/html5/thumbnails/7.jpg)
Deprecated years ago
Removable since WS2012 R2/Win8.1
Disable-able since Vista/2008
Gone in WS2016 Nano
![Page 8: Ned wasn’t kidding: The End of SMB1 - interopevents.com wasn’t kidding2... · aka.ms/StopUsingSmb1 SMB1 vendor & product list - aka.ms/StillNeedsSmb1 SMB & Windows Server - aka.ms/windowsserver](https://reader030.vdocuments.net/reader030/viewer/2022013113/5a9dde9a7f8b9a96438d8b36/html5/thumbnails/8.jpg)
![Page 9: Ned wasn’t kidding: The End of SMB1 - interopevents.com wasn’t kidding2... · aka.ms/StopUsingSmb1 SMB1 vendor & product list - aka.ms/StillNeedsSmb1 SMB & Windows Server - aka.ms/windowsserver](https://reader030.vdocuments.net/reader030/viewer/2022013113/5a9dde9a7f8b9a96438d8b36/html5/thumbnails/9.jpg)
uninstalled by default
uninstalled by default
uninstalled if not used
![Page 10: Ned wasn’t kidding: The End of SMB1 - interopevents.com wasn’t kidding2... · aka.ms/StopUsingSmb1 SMB1 vendor & product list - aka.ms/StillNeedsSmb1 SMB & Windows Server - aka.ms/windowsserver](https://reader030.vdocuments.net/reader030/viewer/2022013113/5a9dde9a7f8b9a96438d8b36/html5/thumbnails/10.jpg)
![Page 11: Ned wasn’t kidding: The End of SMB1 - interopevents.com wasn’t kidding2... · aka.ms/StopUsingSmb1 SMB1 vendor & product list - aka.ms/StillNeedsSmb1 SMB & Windows Server - aka.ms/windowsserver](https://reader030.vdocuments.net/reader030/viewer/2022013113/5a9dde9a7f8b9a96438d8b36/html5/thumbnails/11.jpg)
Attacker
Blocked – no SMB1 server
Home and Pro editions
SMB1 Client
![Page 12: Ned wasn’t kidding: The End of SMB1 - interopevents.com wasn’t kidding2... · aka.ms/StopUsingSmb1 SMB1 vendor & product list - aka.ms/StillNeedsSmb1 SMB & Windows Server - aka.ms/windowsserver](https://reader030.vdocuments.net/reader030/viewer/2022013113/5a9dde9a7f8b9a96438d8b36/html5/thumbnails/12.jpg)
disabled by default
allowed client dialects
![Page 13: Ned wasn’t kidding: The End of SMB1 - interopevents.com wasn’t kidding2... · aka.ms/StopUsingSmb1 SMB1 vendor & product list - aka.ms/StillNeedsSmb1 SMB & Windows Server - aka.ms/windowsserver](https://reader030.vdocuments.net/reader030/viewer/2022013113/5a9dde9a7f8b9a96438d8b36/html5/thumbnails/13.jpg)
Find it
![Page 14: Ned wasn’t kidding: The End of SMB1 - interopevents.com wasn’t kidding2... · aka.ms/StopUsingSmb1 SMB1 vendor & product list - aka.ms/StillNeedsSmb1 SMB & Windows Server - aka.ms/windowsserver](https://reader030.vdocuments.net/reader030/viewer/2022013113/5a9dde9a7f8b9a96438d8b36/html5/thumbnails/14.jpg)
Aka.ms/StillNeedsSMB1
![Page 15: Ned wasn’t kidding: The End of SMB1 - interopevents.com wasn’t kidding2... · aka.ms/StopUsingSmb1 SMB1 vendor & product list - aka.ms/StillNeedsSmb1 SMB & Windows Server - aka.ms/windowsserver](https://reader030.vdocuments.net/reader030/viewer/2022013113/5a9dde9a7f8b9a96438d8b36/html5/thumbnails/15.jpg)
![Page 16: Ned wasn’t kidding: The End of SMB1 - interopevents.com wasn’t kidding2... · aka.ms/StopUsingSmb1 SMB1 vendor & product list - aka.ms/StillNeedsSmb1 SMB & Windows Server - aka.ms/windowsserver](https://reader030.vdocuments.net/reader030/viewer/2022013113/5a9dde9a7f8b9a96438d8b36/html5/thumbnails/16.jpg)
![Page 17: Ned wasn’t kidding: The End of SMB1 - interopevents.com wasn’t kidding2... · aka.ms/StopUsingSmb1 SMB1 vendor & product list - aka.ms/StillNeedsSmb1 SMB & Windows Server - aka.ms/windowsserver](https://reader030.vdocuments.net/reader030/viewer/2022013113/5a9dde9a7f8b9a96438d8b36/html5/thumbnails/17.jpg)
![Page 18: Ned wasn’t kidding: The End of SMB1 - interopevents.com wasn’t kidding2... · aka.ms/StopUsingSmb1 SMB1 vendor & product list - aka.ms/StillNeedsSmb1 SMB & Windows Server - aka.ms/windowsserver](https://reader030.vdocuments.net/reader030/viewer/2022013113/5a9dde9a7f8b9a96438d8b36/html5/thumbnails/18.jpg)
Zap it
![Page 19: Ned wasn’t kidding: The End of SMB1 - interopevents.com wasn’t kidding2... · aka.ms/StopUsingSmb1 SMB1 vendor & product list - aka.ms/StillNeedsSmb1 SMB & Windows Server - aka.ms/windowsserver](https://reader030.vdocuments.net/reader030/viewer/2022013113/5a9dde9a7f8b9a96438d8b36/html5/thumbnails/19.jpg)
Zap it
![Page 20: Ned wasn’t kidding: The End of SMB1 - interopevents.com wasn’t kidding2... · aka.ms/StopUsingSmb1 SMB1 vendor & product list - aka.ms/StillNeedsSmb1 SMB & Windows Server - aka.ms/windowsserver](https://reader030.vdocuments.net/reader030/viewer/2022013113/5a9dde9a7f8b9a96438d8b36/html5/thumbnails/20.jpg)
Zap it
KB2696547
![Page 21: Ned wasn’t kidding: The End of SMB1 - interopevents.com wasn’t kidding2... · aka.ms/StopUsingSmb1 SMB1 vendor & product list - aka.ms/StillNeedsSmb1 SMB & Windows Server - aka.ms/windowsserver](https://reader030.vdocuments.net/reader030/viewer/2022013113/5a9dde9a7f8b9a96438d8b36/html5/thumbnails/21.jpg)
![Page 22: Ned wasn’t kidding: The End of SMB1 - interopevents.com wasn’t kidding2... · aka.ms/StopUsingSmb1 SMB1 vendor & product list - aka.ms/StillNeedsSmb1 SMB & Windows Server - aka.ms/windowsserver](https://reader030.vdocuments.net/reader030/viewer/2022013113/5a9dde9a7f8b9a96438d8b36/html5/thumbnails/22.jpg)
38
10
11
2
fuzzing, review, & pentests pay off
![Page 23: Ned wasn’t kidding: The End of SMB1 - interopevents.com wasn’t kidding2... · aka.ms/StopUsingSmb1 SMB1 vendor & product list - aka.ms/StillNeedsSmb1 SMB & Windows Server - aka.ms/windowsserver](https://reader030.vdocuments.net/reader030/viewer/2022013113/5a9dde9a7f8b9a96438d8b36/html5/thumbnails/23.jpg)
Set-SMBShare –LeasingModeFull = default
Shared = grant read-caching lease, not write or handle-caching
None = no oplocks or leases
New to RS3
Should never be used
![Page 24: Ned wasn’t kidding: The End of SMB1 - interopevents.com wasn’t kidding2... · aka.ms/StopUsingSmb1 SMB1 vendor & product list - aka.ms/StillNeedsSmb1 SMB & Windows Server - aka.ms/windowsserver](https://reader030.vdocuments.net/reader030/viewer/2022013113/5a9dde9a7f8b9a96438d8b36/html5/thumbnails/24.jpg)
![Page 25: Ned wasn’t kidding: The End of SMB1 - interopevents.com wasn’t kidding2... · aka.ms/StopUsingSmb1 SMB1 vendor & product list - aka.ms/StillNeedsSmb1 SMB & Windows Server - aka.ms/windowsserver](https://reader030.vdocuments.net/reader030/viewer/2022013113/5a9dde9a7f8b9a96438d8b36/html5/thumbnails/25.jpg)
End-to-end SMB encryptionPrivacy
AES-128-GCM & AES-128-CCM
SMB Signing updatedIntegrity
AES-CMAC
Pre-auth Integrity
Plus all SMB can make use of UNC Hardening
![Page 26: Ned wasn’t kidding: The End of SMB1 - interopevents.com wasn’t kidding2... · aka.ms/StopUsingSmb1 SMB1 vendor & product list - aka.ms/StillNeedsSmb1 SMB & Windows Server - aka.ms/windowsserver](https://reader030.vdocuments.net/reader030/viewer/2022013113/5a9dde9a7f8b9a96438d8b36/html5/thumbnails/26.jpg)
aka.ms/StopUsingSmb1
SMB1 vendor & product list - aka.ms/StillNeedsSmb1
SMB & Windows Server - aka.ms/windowsserver
SMB team blog - aka.ms/serverstorage
Old SMB blog - aka.ms/josesmb3
Spec Team -blogs.msdn.microsoft.com/openspecification
![Page 27: Ned wasn’t kidding: The End of SMB1 - interopevents.com wasn’t kidding2... · aka.ms/StopUsingSmb1 SMB1 vendor & product list - aka.ms/StillNeedsSmb1 SMB & Windows Server - aka.ms/windowsserver](https://reader030.vdocuments.net/reader030/viewer/2022013113/5a9dde9a7f8b9a96438d8b36/html5/thumbnails/27.jpg)
Which side do you want to be on?
![Page 28: Ned wasn’t kidding: The End of SMB1 - interopevents.com wasn’t kidding2... · aka.ms/StopUsingSmb1 SMB1 vendor & product list - aka.ms/StillNeedsSmb1 SMB & Windows Server - aka.ms/windowsserver](https://reader030.vdocuments.net/reader030/viewer/2022013113/5a9dde9a7f8b9a96438d8b36/html5/thumbnails/28.jpg)
Thank You!Questions?