Editorial Samba at Risk from Wormable Bug Similar to WannaCry: Present on Many NAS boxes

[R-T-B]

Samba, the open source implementation of the Windows CIFS file sharing protocol found on Linux and many home NAS-systems, now has its own version of a "WannaCry" grade bug ready to cause users grief. Like WannaCry, Sambas bug enables remote code execution and is totally wormable. Unlike WannaCry however, it does require write access to the SMB share, limiting it's effect unless you run an unauthenticated share on the internet.

So why is this newsworthy at all? It is of course newsworthy in its own right because of bad security practices that run rampant in our industry, I would argue, but that's not really why I posted this, I will confess. Yes, I'm trying to make a point again with that blunt instrument we call "editorial." I do apologize for the inconvenience (not really).




Moving onwards to my point, what I found interesting about this particular report was that the issue was reported by none other than a government agency, and not one known for being exactly a beacon of exploit reporting: The U.S. Department of Homeland Security.

Maybe I'm jumping the gun a bit, just maybe, but could it be that after WannaCry, the government is starting to realize stockpiling exploits is not good for cyber security as a whole, and beginning to report them instead? Certainly interesting to see a government agency report an issue like this that could be used for monitoring people or something. Maybe the impact of WannaCry was to wake our government up a bit in a positive way?

I'm a positive thinking man, but even I find that a bit hard to believe from just one incident. Maybe though, this is the start of something new. I can hope. Let's keep watching and see if this trend continues.

How do you feel about this? Is the stockpiling of exploits a legitimate strategy in cyber-warfare? Should it be stopped? Expanded? If so, how far is too far? And is this evidence of a change of governmental policy in the US? Let us know what you think below.

View at TechPowerUp Main Site

 

[R-T-B]

It's marked "editorial" as per usual people. It may be more tame than many of my usual ones, but it's still an opinion, don't take any of this as fact or use the medication other than directed. If you do, contact poison control immediately.

Oh, and if you actually run an unprotected share on the internet, update your samba version, and get yourself a frickin' firewall.

 

[lexluthermiester]

It's marked "editorial" as per usual people. It may be more tame than many of my usual ones, but it's still an opinion, don't take any of this as fact or use the medication other than directed. If you do, contact poison control immediately.

Oh, and if you actually run an unprotected share on the internet, update your samba version, and get yourself a frickin' firewall.

This is one of the reasons why I don't let anything connect to the internet unless it NEEDS it to function and then that something does not connect to my house network. Yes, I run two separate networks in my home. One wired with very limited Wifi with no connection to the internet at all, and the other Wifi with a few wired jacks that has very controlled internet access sitting behind two firewalls. This may seem like over-kill but in this age of everyone and their dog trying to steal other peoples internet so they don't get into trouble for their illegal activities, one can not be to careful.

 

[R-T-B]

This may seem like over-kill but in this age of everyone and their dog trying to steal other peoples internet so they don't get into trouble for their illegal activities

 

[DeathtoGnomes]

Thanks for the opinion. I do agree that the USG is holding on too tight and doing more harm than good. Collecting exploits that wind up being used more often against its own citizens than on target countries. Call it stupidity when Wikileaks calls out the idiots trying to be secretive and end up showing how abusive they are with those "tools".

 

[TheLostSwede]

The big concern here is "unsupported" devices, as there are most like hundreds of thousands, if not millions of devices out there that run samba, but have fallen off the supported devices category from their original manufacturer. It means that they no longer receive software updates, but it doesn't mean the devices are useless. No company is going to go and release patches for devices that dropped off their supported devices list 4-5 years ago. These devices could be things like routers, web cameras and what not, in addition to just NAS appliances, as samba is used on anything that has remote accessible storage, so it's a rather scary thing, as so many of these devices have lax security. What's worse, many of these devices can't have the software updated, as it's an integral part of the firmware and changing samba version can break a lot of things.

 

[librin.so.1]

>using the SMB protocol to begin with
gee wiz...

 

[Endeavour]

Do we have a fast, open, easy-to-use protocol to replace SMB/CIFS that doesn't require to set up a server?
SMB 3.x? A lot of devices and most apps only support SMB1/CIFS.
WebDAV is more widely supported, but is not as easy as CIFS and apparently it's too slow.

 

[R-T-B]

Do we have a fast, open, easy-to-use protocol to replace SMB/CIFS that doesn't require to set up a server?
SMB 3.x? A lot of devices and most apps only support SMB1/CIFS.
WebDAV is more widely supported, but is not as easy as CIFS and apparently it's too slow.

Not really. I'd hardly call NFS and the like a "replacement" because it's completely unaware of all sorts of Windows specific things.