0

Running Windows 10 LTSC. Forwarded 445 port on the router to Windows SMB.

Assuming that:

  1. My machine has no viruses in it (fresh Windows installation)
  2. It has been updated to the latest OS release
  3. I am using a secure, hard to brute force, password

How secure is my setup?

Provided that my computer has some sensitive data in it. Is there a better way to manage files on a remote computer that I'm missing?

Specific questions:

  1. Is data I'm transferring encrypted? PS: heard that starting with SMB 3.0 it is, but how do I check what version I have on my current Windows installation?
  2. Does the latest version of Windows 10 LTSC contain any unpatched vulnerabilities that would allow privilege escalation?
0
2

how secure is my setup?

0-day exploits notwithstanding you're secure as long as your users/passwords combinations are secure as well and you install Windows updates immediately after they are released and reboot afterwards.

Provided that my computer has some sensitive data in it.

People generally oppose having CIFS ports wide open to the Internet, however I haven't heard any strong arguments against it. In the past, people had often had trouble keeping their Windows NT/2000 installation secure because the Internet was in its infancy, which meant that many servers had glaring vulnerabilities. Nowadays it has long become a non-issue unless you meddle with Windows updates.

Is there a better way to manage files on a remote computer that I'm missing?

SSH/SCP/SFTP with private keys could be a tad more secure.

Is data I'm transferring encrypted? PS: heard that starting with SMB 3.0 it is, but how do I check what version I have on my current Windows installation?

Windows 10 uses 128 bit AES SMB encryption by default if you're using SMB 3.1.1.

SMB 2.0 or SMB 1.0 connections are not encrypted.

Does the latest version of Windows 10 LTSC contain any unpatched vulnerabilities that would allow privilege escalation?

Not a single person in the world could answer this question but if we're talking about publicly available data, then the answer will be "no".

0
0

Using SMB shares over internet is often throwned upon because it causes headaches to firewal admins. While (more) standard protocol like SSH (including SFTP), SMTP, or IMAP only require opening one single port server side (22 for SSH), or one port for raw protocol and a distinct one for the SSL version, SMB requires a bunch of ports.

Simply finding which ones are required for a specific use case if far from a trivial issue. In fact you will have to dive into Microsoft reference docs (many pages to find that...) and probably a bit of trial and error tests. For that reason, this protocol is seldom directly opened on Internet, and is much more ofter only made available through a VPN access: the authentication is made at the VPN level, and the VPN protected access is then seen as a local one with the same privileges (no firewall involved)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.