SMB : Sharing more than your files... - Archive ouverte HAL Accéder directement au contenu
Communication Dans Un Congrès Année : 2015

SMB : Sharing more than your files...

Jonathan Brossard

Résumé

In this white paper, we present a new attack vector against the Windows Single Sign On (SSO) feature of Microsoft Windows, leveraging the venerable Microsoft Server Message Block (SMB) protocol, affecting all versions of Windows, including Windows 10. While attacks involving SMB have long time been common in local networks, this new attack allows complete user compromise from the Internet. By leveraging a series of bugs and malfunctions, we shall see how remote redentials theft or user impersonation an be performed with minimal user interaction, extremely reliably, and from the Internet. This is in particular believed to be the first attack against Windows 10 and its web browser Spartan. Finally, we will contemplate a strategy to contain the problem at perimeter level and why it is doomed to largely fail, as well as suggest additional hardening to remediate this vulnerability more consistently at host level.
Fichier principal
Vignette du fichier
Jonathan_Brossard_Blackhat_2015_SMBv2_Sharing_More_Than_Just_Your_Files.pdf (1.4 Mo) Télécharger le fichier
Origine Fichiers produits par l'(les) auteur(s)
Licence

Dates et versions

hal-04606162 , version 1 (09-06-2024)

Licence

Identifiants

  • HAL Id : hal-04606162 , version 1

Citer

Jonathan Brossard. SMB : Sharing more than your files.... Blackhat USA, Blackhat, Jul 2015, Las Vegas, United States. ⟨hal-04606162⟩
0 Consultations
0 Téléchargements

Partager

Gmail Mastodon Facebook X LinkedIn More