Hacker News Reader

Comment by deanclatworthy | Hacker News Reader

I've been following this closely over the last couple of hours on Twitter as the news broke. What does it mean in practice?

From what I have read one of the vulnerabilities seems to be a 0day targeting SMB on Windows. One commentator suggested it's enabled by default on the majority of Windows machines (of that I am sceptical). Presumably most people are behind a router which would stop this in its tracks?

A lot of people (who I would probably take seriously) suggest disconnecting Windows machines from the internet for the time-being. Is it really this bad? Are there millions of Windows (home-)users who are vulnerable (by default) today?

View on HN

> one of the vulnerabilities seems to be a 0day targeting SMB on Windows.

If your computer's network profile is set to Public, it will be firewalled off. In other cases YMMV.

On corporate networks, AD Domain Controllers are (usually) the most highly privileged servers on the network and they will always have SMB enabled and accessible to the entire domain network because Group Policy relies on SMB shares. Compromise the Domain Controllers and you own the entire (Windows) network because they can administer everything.

> Presumably most people are behind a router which would stop this in its tracks?

Trouble is there are millions of IoT devices with terrible security some of which are alway owned and inside the network. They could be used as a delivery tool to attack multiple machines inside of a network.

I'm not sure how many folks connect directly to the internet anymore. Hopefully not many.

"Connect directly". Could you please elaborate on that?

Connecting a computer directly to a modem, not a router.

Thanks.

> One commentator suggested it's enabled by default on the majority of Windows machines (of that I am sceptical).

It's been a while since I used windows but there used to be such a thing as the administrative share.

https://en.wikipedia.org/wiki/Administrative_share

So I don't find that hard to believe at all.

All internet users are behind routers, their function is the opposite of blocking traffic.

Yes, but most NAT routers consumers use act as a firewall too (i.e. they block ingress traffic that is not related to a connection that was initiated from inside)

NAT is not really routing, routers are expressly forbidden from altering the address and port in IP packets.

Reply on news.ycombinator.com