SMB Security Exploit?

1. offizieller Beitrag
    • Offizieller Beitrag

    Anyone see this?


    https://www.bleepingcomputer.c…ers-execute-code-as-root/


    OMV 6 is affected.


    Zitat

    While default configurations are exposed to attacks, threat actors that would want to target this vulnerability would need write access to a file's extended attributes.


    "Note that this could be a guest or unauthenticated user if such users are allowed write access to file extended attributes," the Samba Team added.

    All you guys constantly refusing to address permissions and just "7777" and guest access everything, should probably take pause.

    • Offizieller Beitrag

    This is only a problem if you have timemachine support enabled.

    omv 7.0.5-1 sandworm | 64 bit | 6.8 proxmox kernel

    plugins :: omvextrasorg 7.0 | kvm 7.0.13 | compose 7.1.6 | k8s 7.1.0-3 | cputemp 7.0.1 | mergerfs 7.0.4


    omv-extras.org plugins source code and issue tracker - github - changelogs


    Please try ctrl-shift-R and read this before posting a question.

    Please put your OMV system details in your signature.
    Please don't PM for support... Too many PMs!

    • Offizieller Beitrag
    Zitat von ryecoaaron

    This is only a problem if you have timemachine support enabled.

    I was wondering as it kept mentioning apple stuff... but I thought all the time machine stuff was basically enabled by default now w/ SMB.

    • Offizieller Beitrag
    Zitat von KM0201

    I thought all the time machine stuff was basically enabled by default now w/ SMB.

    Luckily, it does require checking the box on the share - https://github.com/openmediava…samba/files/shares.j2#L55

    • Offizieller Beitrag
    Zitat von Zoki

    So I am lucky, if it is not the default. No Macs around :)

    Heck I don't even have Windows, let alone overpriced hardware w/ an OS I last used to play the original Oregon Trail in the mid 80's


    I do have 1 SMB share though, as for some reason my Shield and Kodi like giving NFS fits.. SMB works just fine (no time machine enabled). It's kinda strange as I have no issues w/ NFS on any other system here. So it's easiest to just have a "Media" share with all my movies, tv shows, etc.. and point Kodi at it over SMB.

    • Offizieller Beitrag
    Zitat von greg77

    Plus attackers have to have access to your home network....

    That isn't the hard part if you get a virus from a download or malicious web site.

    • Offizieller Beitrag

    Debian tracker is here - https://security-tracker.debian.org/tracker/CVE-2021-44142

    Ubuntu did fix it. So, maybe their fix will get pushed upstream.

    omv 7.0.5-1 sandworm | 64 bit | 6.8 proxmox kernel

    plugins :: omvextrasorg 7.0 | kvm 7.0.13 | compose 7.1.6 | k8s 7.1.0-3 | cputemp 7.0.1 | mergerfs 7.0.4


    omv-extras.org plugins source code and issue tracker - github - changelogs


    Please try ctrl-shift-R and read this before posting a question.

    Please put your OMV system details in your signature.
    Please don't PM for support... Too many PMs!

    • Offizieller Beitrag

    The conditions are something of a long shot; a server that is exposed to the internet AND has "others + guest" write access to SMB shares. But, I have little doubt that some users are exposed.


    It is, however, another strong vote for keeping truly sensitive data (medical, financial, credit card info, etc.) on a thumbdrive.

    Zitat von crashtest

    The conditions are something of a long shot; a server that is exposed to the internet AND has "others + guest" write access to SMB shares. But, I have little doubt that some users are exposed.

    I am probably better protected than most, but I do not consider my home network safe. With so many devices around one will ultimately arrive at zero trust security models.

    If you got help in the forum and want to give something back to the project click here (omv) or here (scroll down) (plugins) and write up your solution for others.

    • Offizieller Beitrag
    Zitat von Zoki

    I am probably better protected than most, but I do not consider my home network safe. With so many devices around one will ultimately arrive at zero trust security models.

    Well, and you also have to assume someone that would do (in my opinion) something as reckless as "others + guests".. They'd do something stupid like opening their server up to the Internet w/ little attention to security.

    "I just want access to my files, I need them in my phones file browser and there was yt video which says chmod -R 777. Don''t know what it does, but it worked and the other video showed me how to open ports for smb, thenI had to put min protocol=NT1 somewhere to make my ... work"

    If you got help in the forum and want to give something back to the project click here (omv) or here (scroll down) (plugins) and write up your solution for others.

    Gefällt mir 1

    I thought about adding it but that falls more in the exploitation part although it does have the ability to enumerate shares etc. I will probably add it just in case, thanks so much for the suggestion!

    • Offizieller Beitrag
    Zitat von Zoki

    thenI had to put min protocol=NT1 somewhere to make my ... work"

    While I know that kind of advice might be found on the net, it's no longer true. I suspect it is very (very) old. When I tested the last time, years ago, Linux was fine with NTLMv2. (Here's an -> MS article explaining the security level differences. NT1 is ancient history )


    While NT1 has been patched against "wanna cry", there's very few solid reasons why NT1 compatibility might actually be needed. Mostly, it might be used to support very expensive hardware, like photographic and imaging equipment or industrial process software, used in businesses. (The type of equipment that can't easily be replaced and will never get software or driver updates.)
    __________________________________________

    Zitat von Zoki

    "I just want access to my files, I need them in my phones file browser and there was yt video which says chmod -R 777.

    There's a cost for ignorance and, sometimes, it's quite high. Reasonable security for SMB shares doesn't have to be difficult and it doesn't necessarily have to be done on the CLI. -> Permissions The maximum I would allow, for local guest access is, others + guest = read.


    Zitat von Zoki

    I am probably better protected than most, but I do not consider my home network safe. With so many devices around one will ultimately arrive at zero trust security models.

    That's an astute assumption. No home network, that's physically connected to the Net, is truly safe. However, in the case of home network exploitation, the only value of a home user's data would be as leverage for a ransomware demand. It has no commercial value.

    Using ZFS for data storage (copy on write) and maintaining off-line (cold) server backups are excellent defenses against ransomware. So, while I'm sure world class hacks could get into my LAN, there would be zero benefit to them. They couldn't get to anything I can't restore. (Which includes my truly sensitive data which I store on thumbdrives.)

    In the bottom line, an "air gap" can't be hacked.

    • Offizieller Beitrag
    Zitat von crashtest

    n "air gap" can't be hacked.

    Are you sure? : ) Google "air gap hack hard drive"

    Zitat von crashtest

    While I know that kind of advice might be found on the net, it's no longer true. I suspect it is very (very) old. When I tested the last time, years ago, Linux was fine with NTLMv2. (Here's an -> MS article explaining the security level differences. NT1 is ancient history )


    While NT1 has been patched against "wanna cry", there's very few solid reasons why NT1 compatibility might actually be needed. Mostly, it might be used to support very expensive hardware, like photographic and imaging equipment or industrial process software, used in businesses. (The type of equipment that can't easily be replaced and will never get software or driver updates.

    I just used the search function in this forum: https://forum.openmediavault.o…ult/188106/&highlight=NT1

    and you could do the same for external file access.


    I am totally with you: a basic level of security is not to hard to achieve, but one has to have the right attitude for that and not "I just want it to work". What i fear more than some hacker are mobile devices which are allowed to connectinto my network coming with some ransomeware on it. (Yes, most of them have a seperate network, but ...)


    Backups of my important data is in an off-site safe.

    If you got help in the forum and want to give something back to the project click here (omv) or here (scroll down) (plugins) and write up your solution for others.

    • Offizieller Beitrag
    Zitat von ryecoaaron

    Are you sure? : ) Google "air gap hack hard drive"

    That's another level of hacking where the running assumption is that the equipment is "ON". Note that I'm using cold (mostly powered off) servers for backup and, while not mentioned previously, my servers are in a closet. Adding to that, my clients do not have microphones and my wife's laptop is in another room with a plug in the mic jack and tape over the camera. The only smart phone we have is outside, inside a car, powered off.

    I know from back in the day, for example, that it was possible to read the contents of an undampened CRT screen from a considerable (air gaped) distance. The EM fields generated were really high. But this is another level of "hacking" altogether where, if there's any chance of success to collect something worthwhile, a targeting process is involved and that means really deep pockets. Perhaps Elon Musk might have something to offer, that would be worthwhile, but I doubt that the average OMV user would fit the profile of a "profitable target".

    The typical hacker is looking for easy, low hanging fruit, to make a quick buck. For the vast majority of home users, that would be compromising financial info (which is safe on a thumbdrive) or a ransomware exploit (easy to defeat with backup).

Jetzt mitmachen!

Sie haben noch kein Benutzerkonto auf unserer Seite? Registrieren Sie sich kostenlos und nehmen Sie an unserer Community teil!

Benutzerkonto erstellen Anmelden