logo
logo
Sign in

MICROSOFT PLEASE NETWORK ADMINISTRATORS TO DISABLE AN OLD PROTOCOL THAT ALLOWS YOU TO HACK WINDOWS

avatar
ciber tip

The lack of maintenance, or security updates is one of the main causes of attacks on operating systems such as Windows. In one of his publications más recent Microsoft has requested the system administrators to disable the protocol of communication’n network SMBv1 on the Exchange servers, as a way to protect yourself against the deployment of some of the attacks of malware and other threats in cyber security.

The main cause of this st’is that SMBv1 not account with the additional security measures that were added to later versions of the protocol. According to specialists in cyber security, SMBv1 lacks encryption, mechanisms, proof of integrity, blocking, authentication’n of users invited, among other protections.

 

In his message, the team in charge of Exchange mentioned that it is necessary to disable the protocol to protect the servers from some of the threats más common: “we Recommend you disable SMBv1 to maintain your organization’re safe from threats such as Emotet, WannaCry, TrickBot, among others; there is no need to run this protocol (almost 30&bath;os de antigüage) if the Exchange 2013/2016/2019 está installed in your system”, mentioned.

M&number;multiple reports claim that, in 2017, the National Security Agency E. U. (NSA) develops’ various exploits that abuse the protocol SMBv1, what the end to help win’ the massive attack of this implementation’re. Among the vulnerabilities más exploited in this protocol are EternalBlue and EternalRomance. Además, these exploits are used to infect the implementations of Exchange with m&number;multiple variants of malware such as Emotet, WannaCry, Retefe, NotPetya, Olympic Destroyer, among others, spreadéhaving to many other máquinas to encrypt or destroy files and steal login credentials of sesi’re.

starting with Windows 10 1709 and Windows Server 1709 The protocol dej’ to be installed by default, so the versions más recent of the Windows operating systems use SMBv3. The users concerned can check to see if SMBv1 está enabled on a system running the following PowerShell command on different versions of Windows Server:

<, ul> the
  • Windows Server 2008 R2: SMBv1 está enabled in this version’n of Windows Server. Therefore, if the following command does not return a value SMB1 or SMB1 1, the protocol está enabled. If it returns a value SMB1 0, está disabled.
  • Get-Item HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters |

    ForEach-Object {Get-ItemProperty $_.pspath}

    <, ul> the
  • Windows Server 2012: if the command returns a false, SMBv1 not está enabled.
  • Get-SmbServerConfiguration | Select EnableSMB1Protocol

    <, ul> the
  • Windows Server 2012 R2 or later: If the command returns a false, SMBv1 not está enabled.
  • (Get-WindowsFeature FS-SMB1).Installed

    Get-SmbServerConfiguration | Select EnableSMB1Protocol

    In the event that SMBv1 está enabled on your server, you can disable it using the following commands.

    <, ul> the
  • On Windows Server 2008 R2:
  • Set-ItemProperty –Path

    “HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters” -Name SMB1 -Type DWORD -Value 0 –Force

    <, ul> the
  • On Windows Server 2012:
  • Set-SmbServerConfiguration -EnableSMB1Protocol $false -force

    <, ul> the
  • On Windows Server 2012 R2 or later:
  • Disable-WindowsOptionalFeature -Online -FeatureName smb1protocol

    Set-SmbServerConfiguration -EnableSMB1Protocol $false

    Source:https://www.cibertip.com/ciberseguridad/microsoft-ruega-a-los-administradores-de-red-inhabilitar-un-antiguo-protocolo-que-permite-hackear-windows/

    collect
    0
    avatar
    ciber tip
    guide
    Zupyak is the world’s largest content marketing community, with over 400 000 members and 3 million articles. Explore and get your content discovered.
    Read more