How safe is SMB exposed to internet?

Question

Level 1

105 points

How safe is SMB exposed to internet?

This is related to an older thread, How safe is AFP exposed to internet? Well I'm curious what other experts here think about the risks of exposing SMB shares over the internet? Obviously it's not a good idea to expose either afp or smb, but I have customers who have system in place doing just this. I'm trying to assess the risks before rushing in to change things.

Is Apple's implementation of SMB any less secure than AFP? Is it more secure than Microsoft's implementation in Windows? Well, of course it must be. Of course we all know the fact that it's not running on Windows is a good thing but I'm curious as to specific vulnerabilities in SMB.

Thanks all,

--
Pete

MacBook Pro 17", iMac Alum 24", G4 Cube, Mac OS X (10.6.6)

Posted on Apr 9, 2011 12:21 PM

Reply

Answer 1

Best reply

Camelot

Level 9

54,339 points

Apr 9, 2011 5:22 PM in response to Pete Corelio

At face value, both protocols are equally insecure, however, I suggest that SMB represents a bigger problem. Let me explain.

There are few targeted attacks that focus on Mac OS X systems, compared to thousands (millions?) that target Windows.

By running a public-facing AFP server, an attacker can assume you're running a Mac OS X-based system (not necessarily, but likely), therefore most of his other attacks are going to fail.
By running a public-facing SMB server, an attacker will assume you're running a Windows-based server and will immediately start probing your server with all the other Windows-specific compromises/attacks, etc.

So even if the protocols themselves were identical from a security standpoint you're just waving a bigger 'Kick Me' sign by running SMB.

$0.02

Reply

Answer 2

Apr 9, 2011 6:52 PM in response to Pete Corelio

A common security goal is to reduce the attack surface; the amount of "stuff" that you have to monitor and maintain and track and keep updated. To close all possible ports, and to secure access.

This also isn't only about what might be wrong with AFP or SMB or another protocol (now), it's about what might be found wrong (in the future). And how fast that knowledge might spread; vulnerabilities can be nasty, and botnets are perpetually testing exposed servers, and variously ahead of the patches from the vendors.

As should be clear from the other thread, exposing one of my core file systems to direct attacks is not typically something I typically prefer to implement. VPNs are easy (particularly with an external gateway) and (while very far from a panacea) can help keep more ports plugged.

This port-level discussion is just one part of the whole; of having good and tested backups, of appropriate internal security controls and auditing, of certificates in preference to (or in addition to) user-selected passwords, of access revocations, data encryption, and of finding your core data and protecting that.

Reply

Answer 3

Pete Corelio Author

Level 1

105 points

Apr 15, 2011 3:58 PM in response to MrHoffman

Thanks for the input. I would agree it should be avoided but have the situation of supporting servers that someone else setup. Relatively speaking, I feel much less nervous about an Apple server being exposed than Windows, in which case they'd be compromised in minutes.

--
Pete

Reply

Answer 4

Angus Fox

Level 2

153 points

Apr 17, 2011 8:42 AM in response to Pete Corelio

I cannot really see any good reason to do this unless you have very very old windows machines which need to be connected. SMB was designed for local area networks and not for the Internet. ( See http://en.wikipedia.org/wiki/Server_Message_Block )

SMB2 is better able to work 'over' the Internet, but the SAMBA in Mac OS X Server 10.6.7 (3.0.28.a-apple) is old and does not appear to be SMB2 compatible. (Believe you need 3.5 or later).

I would be tempted to use something altogether different like dropbox for this kind of sharing, neatly avoiding all the firewalls, port hiding and attack surface management issues.

Angus

Reply