How does disallowing guest NAS access mitigates MitM attack?

Question

About a year ago, Microsoft has disabled guest access to NAS devices in Windows 10. As their community website explains, this was done for security reasons:

While the server may be fine not distinguishing among clients for files [...], this can actually put you at risk elsewhere. Without an account and password, the client doesn't end up with a secure connection to the server. A malicious server can put itself in the middle (also known as the Man-In-The-Middle attack), and trick the client into sending files or accepting malicious data.

I must admit I don't understand this argument. How hard is it to create a malicious server that accepts any username/password? It looks like this explanation is dumbed down to the point it doesn't explain anything. Could someone explain how disabling guest access prevents MitM attacks in this case?

Answer 1

Consider the following scenario:

1. You set up your NAS box at home with guest access.
2. You set up your laptop to connect to the NAS box with guest access.
3. You configure your backup program to back up your data to the NAS box.
4. You take your laptop to a coffee shop and join the free WiFi.
5. An attacker sets up a NAS box on the coffee shop network.
6. Your laptop thinks this is your home NAS box, connects to it successfully using guest access, and backs up your data to the attacker's NAS box.

The attacker now has a backup of your system, including pictures, documents, etc. By disabling guest access, you prevent your laptop from successfully connecting and making the backup.

This security fix is a patch that now requires that all connections be "authenticated". For most home users of Windows, that means they must set up a HomeGroup. The coffee shop attacker cannot set up a fake NAS box that would fool your computer, because he does not know your HomeGroup's password.

HomeGroup uses SMB to mutually authenticate peers, and SMB uses a challenge/response protocol to ensure that passwords are never sent over the network. Instead, challenge/response uses math to prove the client knows the password without actually sending the actual password.