0

About a year ago, Microsoft has disabled guest access to NAS devices in Windows 10. As their community website explains, this was done for security reasons:

While the server may be fine not distinguishing among clients for files [...], this can actually put you at risk elsewhere. Without an account and password, the client doesn't end up with a secure connection to the server. A malicious server can put itself in the middle (also known as the Man-In-The-Middle attack), and trick the client into sending files or accepting malicious data.

I must admit I don't understand this argument. How hard is it to create a malicious server that accepts any username/password? It looks like this explanation is dumbed down to the point it doesn't explain anything. Could someone explain how disabling guest access prevents MitM attacks in this case?

2

Consider the following scenario:

  1. You set up your NAS box at home with guest access.
  2. You set up your laptop to connect to the NAS box with guest access.
  3. You configure your backup program to back up your data to the NAS box.
  4. You take your laptop to a coffee shop and join the free WiFi.
  5. An attacker sets up a NAS box on the coffee shop network.
  6. Your laptop thinks this is your home NAS box, connects to it successfully using guest access, and backs up your data to the attacker's NAS box.

The attacker now has a backup of your system, including pictures, documents, etc. By disabling guest access, you prevent your laptop from successfully connecting and making the backup.

This security fix is a patch that now requires that all connections be "authenticated". For most home users of Windows, that means they must set up a HomeGroup. The coffee shop attacker cannot set up a fake NAS box that would fool your computer, because he does not know your HomeGroup's password.

HomeGroup uses SMB to mutually authenticate peers, and SMB uses a challenge/response protocol to ensure that passwords are never sent over the network. Instead, challenge/response uses math to prove the client knows the password without actually sending the actual password.

  • What prevents the attacker from setting up a NAS box which blindly accepts my username/password? – Dmitry Grigoryev Jan 24 '17 at 17:03
  • At least for some accounts / systems; nothing. Here's a metasploit module to launch a rogue server: rapid7.com/db/modules/auxiliary/server/capture/smb. This also makes the challenge string predictable so the password can be decrypted quicker. – J.A.K. Jan 24 '17 at 22:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.