1.
SMB Security Best Practices
Original release date: January 16, 2017 | Last revised: March 16, 2017
In response to public reporting of a potential Server Message Block (SMB) vulnerability, US-CERT is providing known best practices related to SMB. This service is universally available for Windows systems, and legacy versions of SMB protocols could allow a remote attacker to obtain sensitive information from affected systems.
US-CERT recommends that users and administrators consider:
- disabling SMBv1 and
- blocking all versions of SMB at the network boundary by blocking TCP port 445 with related protocols on UDP ports 137-138 and TCP port 139, for all boundary devices.
US-CERT cautions users and administrators that disabling or blocking SMB may create problems by obstructing access to shared files, data, or devices. The benefits of mitigation should be weighed against potential disruptions to users. For more information on SMB, please review Microsoft Security Advisories
2696547 and
204279.
Original page:
SMB Security Best Practices
2.
How to remove SMB v1 in Windows 8.1, Windows 10, Windows 2012 R2, and Server 2016
Caution! Don’t forget to reboot the targeted systems.
Windows Server: Server Manager method:
Uncheck Features SMB 1.0:
Windows Client: Add or Remove Programs method:
Uncheck Features SMB 1.0:
Windows Client: PowerShell method:
Disable-WindowsOptionalFeature -Online -FeatureName smb1protocol
Note You must restart the computer after you make these changes.
How to remove SMB v1 in Windows 7, Server 2008 R2, Windows Vista, and Server 2008
PowerShell method:
Windows PowerShell 2.0 or a later
To disable SMBv1 on the SMB server, run the following cmdlet:
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters" SMB1 -Type DWORD -Value 0 -Force
Note You must restart the computer after you make these changes.
Registry method:
To enable or disable SMBv1 on the SMB server, configure the following registry key:
Registry subkey:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\ParametersRegistry entry: SMB1
REG_DWORD: 0 = Disabled
REG_DWORD: 1 = Enabled
Default: 1 = Enabled
Note You must restart the computer after you make these changes.
Original page with other methods:
How to enable and disable SMBv1, SMBv2, and SMBv3 in Windows and Windows Server
3.
Disabling NetBIOS over TCP/IP
Use the following steps to disable NetBIOS over TCP/IP; this procedure forces all SMB traffic to be direct hosted. Take care in implementing this setting because it causes the Windows-based computer to be unable to communicate with earlier operating systems using SMB traffic:
1. Open
Network and Sharing Center and then click
Change adapter settings.
2. Right-click
Ethernet adapter, and then click
Properties.
3. Click
Internet Protocol (TCP/IP), and then click
Properties.
4. Click
Advanced.
5. Click the
WINS tab, and then click
Disable NetBIOS over TCP/IP.
6. Repeat for all relevant adapters as NetBT_Tcpip is bound to each adapter individually.
Original page:
Direct hosting of SMB over TCP/IP
4.
Disabling certain TCP ports via firewall
How to disable Ports 135, 137, 138, 139, 445 via the Firewall
A.) TCP ports 135, 137, 139
1. Open the
Control Panel.
2. Click the
Windows Firewall.
3. Click
Advanced settings.
4. Click
Inbound Rule.
5. On the right side, click
New rule.
6. Chose the
Port.
7. Click
Next.
8. Choose
Specific local ports.
9. Click
TCP radio-button above and type
135, 137, 139
10. Click
Next.
11. Choose
Block the connection.
12. Click
Next.
13. Tick the three checkboxes and click
Next.
14. Type
My rule: Close TCP ports 135, 137, 139 into the Name box.
15. Click
Finish.
B.) TCP port 445
1. Open the
Control Panel.
2. Click the
Windows Firewall.
3. Click
Advanced settings.
4. Click
Inbound Rule.
5. On the right side, click
New rule.
6. Chose the
Port.
7. Click
Next.
8. Choose
Specific local ports.
9. Click
TCP radio-button above and type
445
10. Click
Next.
11. Choose
Block the connection.
12. Click
Next.
13. Tick the three checkboxes and click
Next.
14. Type
My rule: Close TCP port 445 into the Name box.
15. Click
Finish.
C.) UDP ports 137, 138
1. Open the
Control Panel.
2. Click the
Windows Firewall.
3. Click
Advanced settings.
4. Click
Inbound Rule.
5. On the right side, click
New rule.
6. Chose the
Port.
7. Click
Next.
8. Choose
Specific local ports.
9. Click
UDP radio-button above and type
137, 138
10. Click
Next.
11. Choose
Block the connection.
12. Click
Next.
13. Tick the three checkboxes and click
Next.
14. Type
My rule: Close UDP ports 137, 138 into the Name box.
15. Click
Finish.
5.
Microsoft Security Bulletin MS17-010 - Critical
Security Update for Microsoft Windows SMB Server (4013389)
Published: March 14, 2017
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to execute arbitrary code via crafted packets, aka "Windows SMB Remote Code Execution Vulnerability." This vulnerability is different from those described in CVE-2017-0144, CVE-2017-0145, CVE-2017-0146, and CVE-2017-0148.
Security update deployment
Here are the links to the available MS17-010 updates for all of the Windows versions:
Prerequisites:
KB2919442 and KB2919355
All future security and non-security updates for Windows 8.1 and Windows Server 2012 R2 require update 2919355 to be installed. We recommend that you installupdate 2919355
https://support.microsoft.com/en-us/help/2919355
on your Windows 8.1-based, or Windows Server 2012 R2-based computer so that you receive future updates.
If you install a language pack after you install this update, you must reinstall this update.
Before applying KB2919355 update, you must have the following update installed on Windows RT 8.1, Windows 8.1, or Windows Server 2012 R2:
KB2919442
https://support.microsoft.com/en-us/help/2919442
A servicing stack update is available for Windows RT 8.1, Windows 8.1, and Windows Server 2012 R2: March 2014
Important:
When you install this update from Windows Update, updates
2932046, 2937592, 2938439, 2934018, and 2959977 are included in the
installation.
Important This update (2919355) replaces
update 2883200 . You don't have to install update 2883200 after you
install this update.
You can obtain the stand-alone update package through the Microsoft Download Center.
Download Download the x86-based Windows 8.1 update package
http://www.microsoft.com/downloads/details.aspx?familyid=47b21d89-3f78-477f-9402-8021e61bef59
Download Download the x64-based Windows 8.1 update package
http://www.microsoft.com/downloads/details.aspx?familyid=f2917221-a8b3-4024-b755-818ad0e7703d
Download Download the x64-based Windows Server 2012 R2 update package
http://www.microsoft.com/downloads/details.aspx?familyid=373b1bb0-6d55-462e-98b7-6cb7d9ef1448
Note The updates must be installed in the following order:
clearcompressionflag.exe
KB2919355
KB2932046
KB2959977
KB2937592
KB2938439
KB2934018
clearcompressionflag.exe
38 KB
Windows8.1-KB2919355-x64.msu
690.8 MB
Windows8.1-KB2932046-x64.msu
48.0 MB
Windows8.1-KB2934018-x64.msu
126.4 MB
Windows8.1-KB2937592-x64.msu
303 KB
Windows8.1-KB2938439-x64.msu
19.6 MB
Windows8.1-KB2959977-x64.msu
2.8 MB
Date Published:
5/5/2014
KB2919442 is a prerequisite for Windows Server 2012 R2 Update and should be installed before attempting to install KB2919355
Windows RT 8.1, Windows 8.1, and Windows Server 2012 R2 update KB2919355 original page:
https://support.microsoft.com/en-us/help/2919355
April 2014
To confirm the exact version of Windows Server 2012 R2 that is installed on a computer, run Msinfo32.exe
If Windows Server 2012 R2 Update is installed, the value reported for Hardware Abstraction Layer will be
6.3.9600.17031
- End of prerequisites section -
Security Update for Microsoft Windows SMB Server (4013389)
Windows Server 2012 R2 (all editions)
For all supported editions of Windows Server 2012 R2 download:
Windows8.1-KB4012213-x64.msu
Security only
or
For all supported editions of Windows Server 2012 R2 download montly rollup containing this update, currently it is windows8.1-kb4019215 or previous one Windows8.1-KB4012216
A system restart is required after you apply this security update.
March 2017 Security Only Quality Update for Windows 8.1 and Windows Server 2012 R2
https://support.microsoft.com/en-us/help/4012213/march-2017-security-only-quality-update-for-windows-8-1-and-windows-server-2012-r2
File name:
Windows8.1-KB4012213-x64.msu
SHA1 hash:
5B24B9CA5A123A844ED793E0F2BE974148520349
SHA256 hash
9570C588FECFF58831F989BA62B0743495B366DEFC382F5DC12FF50E0F9BED9B
File name:
Windows8.1-KB4012213-x86.msu
SHA1 hash
E118939B397BC983971C88D9C9ECC8CBEC471B05
SHA256 hash
DD770131CD4E87F9D8ED8038427F8952905EF31C9BC6E3D32C88FD71F9984EFB
File download page:
http://www.catalog.update.microsoft.com/search.aspx?q=4012213
To determine whether MS17-010 fixes have been installed:
Check by installed Knowledge Base number for any of the listed updates that contain MS17-010 patch.
To check by Windows PowerShell method enter this PowerShell command:
get-hotfix -id KB4012212,KB4012213
If you installed a rollup that contains MS17-010, check for one of applied updates, for example (May 2017):
get-hotfix -id KB4012213,KB4012216,KB4012219,KB4015550,KB4015553,KB4019213,KB4019215
To check for some of previous Server 2012R2 and Windows 8.1 updates:
get-hotfix -id KB2919442
get-hotfix -id KB2919355,KB2959977,KB2919442
How do you really know a machine is vulnerable (or not)?
The nmap script smb-vuln-ms17-010 detects Microsoft SMBv1 hosts vulnerable to a remote code execution vulnerability (ms17-010). First of all make sure you have a recent version of Nmap (version 7.40 or later). Then download the script smb-vuln-ms17-010 from its github repository and place it in your NSE script directory:
Linux - /usr/share/nmap/scripts/ or /usr/local/share/nmap/scripts/
OSX - /usr/local/share/nmap/scripts/ or /opt/local/share/nmap/scripts/
Windows - C:\Program Files\Nmap\scripts\
To install the script in your system:
#nmap --script-updatedb
To detect if a machine is vulnerable, run the following Nmap command:
$nmap -v --script smb-vuln-ms17-010 -p445
Here is an unpatched machine before and after applying some mitigating measures:
A "fully vulnerable" host may return the following script results:
| smb-vuln-ms17-010:
| VULNERABLE:
