Let's suppose on my computer was a connection to a smb network share, set to reconnect automatically on startup. Now one of the following things happens:

  • The computer is booted up in another network
  • An attacker has infiltrated my network

What prevents an attacker from posing as my file server to steal my credentials, in the second case possibly even relaying the traffic to the legitimate file server?

I see several possibilities, but don't know which them apply:

  • Does the server use a (self signed) certificate, and the client pins it?
  • No credentials are sent, instead authentication is handled via challenge-response?
  • Does the os (i.e. Windows) only try to connect when the same network profile is present? (Sounds pretty weak if it was the only measure)

I suppose on an Active Directory there is some kind of Kerberos wizardry happening, but what about setups where there is no Domain Controller, no Active Directory? Do Linux OSX or Windows handle this problem differently?

Bonus questions: how do other protocols like iscsi or nfs handle that?

I would greatly appreciate if somebody could give or link to some beginner-friendly explanations!

EDIT: Since the answer appears to be „it depends“ as @dandavis commented:

Are downgrade attacks possible (or do recent clients remember the authentication protocol used)?

What are the current best practices / recommendations for new deployments regarding protocols to use?

  • One would expect an SMB Server to use access credentials. A rogue server would not have those credentials. Commented Aug 19, 2021 at 17:18
  • @user10216038 can you elaborate?
    – md7
    Commented Aug 19, 2021 at 17:30
  • 1
    Responder is a tool designed to perform (among others) this type of attack.
    – Kate
    Commented Aug 19, 2021 at 18:26
  • the authentication protocol varies, which makes the answer "it depends". see en.wikipedia.org/wiki/Server_Message_Block#Security From a quick dig, it seems that indeed some setups, mostly older, would be easy to spoof with physical network access.
    – dandavis
    Commented Aug 19, 2021 at 21:26


You must log in to answer this question.