SMB Security and the gaps within...

It must be said that in todays environment, computer networking isn't what it was a few years ago. Most people find that an obvious fact, I find it dashing to see how bloody fast it all went.

First we were quite happy that computers could be connected together! You could actually type on a terminal that was connected to a mainframe in the basement - or talking from a home-user point of view, connecting a BNC-cable between two desktops at a speed of around 1 Mbit was astonishing to say the least.

Now I sip my coffee in the morning, reading the newspaper on a flat glass thing that even pops up my e-mails when I don't need them:-)

Well hey, we should be happy about it? No really, we should be. But it has consequences, some of them good, some of them really bad if you don't take them into account.

Interconnecting everything has become so evident, cheap and easy that we just hook up to our company network from our laptop, from the iphone in the car, and move around information around the biggest internetwork around - the internet itself. Now the hotshot companies, they have everything. Big expensive firewalls and a bunch of smart guys locking it all up so damn good that half of the time they don't get in themselves. Well, that might be a bit over the top, but some of it is useful, even in the segment most of us reside in, the small business and the home users. In my feeling, not enough people halt to the fact that you're moving your idea's, secrets, pricing information and... your private life, around the net.

Designing a secure networking environment

I guess it all starts with how you put one and one together. There's obviously more than one way to connect your pc's together and there's more than one way to get out of your campus. How you get out isn't really what you should be worried about... I guess the question is "how does the ugly stuff get in?"

Your data is your knowledge - and scientia potentia est

If you wouldn't have anything to store and share, you probably wouldn't build a network at your workplace. How weird as it all seems, some people still don't do "it".

What I mean to say is I guess: be careful what you store on your servers and where you store it. Some data is obviously open to anyone who wants to see it, other data is only for your "crew" and other data, it must be said, is probably for your eyes only. You really want to keep these apart. Always consider the "sensitivity" of the things you plan to store when you think about where you're going to put them at.

Network segmentation

Where you can, split it up. Imagine: You have your company network in building block A and you rent block B to your subcontractor which wants to have it's offices connected to... the internet. The cheapest and quickest way to do this is just to plug them into the same switchequipment as you do now. Well, you still can do that these days, only some "gap" between both might be at its place. Create V-lans, various subnets or whatever is apropriate in your organisation. But if user A has no business with the network of user B, lock him out of there.

Wireless connections and security

Wifi is a great thing! But it's also a great way to get in without physical network access, to spread viruses and to consume expensive bandwidth. So also there, some security is at its place. In my opinion, building a separate network for your wifi connections is what works best. People who come in with their unprotected laptop spreading the latest viruses around, downloading the latest movies from bittorrent using your much too expensively payed bandwidth are better far away from your production network. If this is not an option, or if you need your wireless users to be able to access network shares, protect your wifi and snif your packets for the ugly stuff. QoS is also a great way to limit bandwith / tcp session.At least you still have some bandwith left for your own processes:-)

To be continued in part 2:)

IPv4 Network space down to 5%

Here's an interesting article about the currently used IP-addressing space.

W32/Conficker.worm

Surprise!

The critics will say: you should have known this would happen. Some people think Windows is a fighting word when you use it in relation to web servers. Well I don't:) If you use some ASP or .Net stuff, you're bound to end up in that street.

So last week, Microsoft issued some new updates to the W2k3 os. I never install this stuff directly on production network, call it precaution or bad luck but I always end up to be the one that has problems with new stuff.

Since I've tested the updates first on the test network, I had something like "what the heck, let's go ahead, right?"

So I want to surf to the microsoft website and I get this "Unable to connect" message. My bell doesn't ring directly, the DNS might be down or somethin'... So I hop nameservers... Nothing there:)

So there it was, my very first production infection. Everything works smoothly but nothing seems to be able to update. Not the windows itself, not the expensive anti-virus I'm running.

After a bit of websurfing, I come down to this site:

https://kc.mcafee.com:443/resources/sites/MCAFEE/content/live/CORP_KNOWLEDGEBASE/60000/KB60909/en_US/Combatting_W32_Conficker_worm.pdf

So some smart guys with too much time on their hand managed to write this really sticky worm that hangs onto some vital windows services and reproduces flawlessly over SMB-shares.

Pretty smart, huh?

After multiple hours of virus scanning, rebooting and "hotfixes", everything was back to normal.

The solution is time-consuming but in fact quite simple:

-You need security update MS08-067 installed on your system. This is included in even the first service pack of Win2k3 (and is a included package in Win2k8 or Win7 so there you shouldn't worry too much - if the rest of the terms are met, that is - which wasn't the case with my production network).

- Once you've got the hotfix active, just run your full system scan as much as necessary.

- Follow the extra protection steps found in the useful PDF on the McAfee website.

That should do the trick. But there's more to it. Since this virus is network-aware (only on the presentation-layer), you need to be sure about who and what you give access to your SMB-shares. I see a lot of people opening network shares to "Everyone" with RW-permissions, this is ot something you want to do! It will certainly spread worms around without you even knowing about it. In that case, if you haven't scrongly secured every single end-device on your network, it is bound to get infected.

Welcome to my new blog

Hi folks,

As I have been encountering several security issues and attacks over the last few days, I've been playing with the idea to start this spot on the web. Is this just another blog over network security? Well, that's yet to be seen, I guess:) As I am mostly in the SMB branch, I've got the feeling that a lot of people in the SMB-segment, or the home-user segment pay little or no attention to their security risks in and around their network. With the vastly evolving security threats around, it seems to me that this is something we just need to be paying attention to.

So here's the idea. I'll just be posting whatever happens around the different workstations and servers I work with and hopefully it'll be somewhat helpful to what you may be encountering yourselves. Also, it'd be great if we could share some idea's. If you encounter issues at your side of the fence, please post them in here.

Just maybe, we can make this place a little safer for everyone, right?:)

Take care,

Dietrich