Let's suppose on my computer was a connection to a smb network share, set to reconnect automatically on startup. Now one of the following things happens:
- The computer is booted up in another network
- An attacker has infiltrated my network
What prevents an attacker from posing as my file server to steal my credentials, in the second case possibly even relaying the traffic to the legitimate file server?
I see several possibilities, but don't know which them apply:
- Does the server use a (self signed) certificate, and the client pins it?
- No credentials are sent, instead authentication is handled via challenge-response?
- Does the os (i.e. Windows) only try to connect when the same network profile is present? (Sounds pretty weak if it was the only measure)
I suppose on an Active Directory there is some kind of Kerberos wizardry happening, but what about setups where there is no Domain Controller, no Active Directory? Do Linux OSX or Windows handle this problem differently?
Bonus questions: how do other protocols like iscsi or nfs handle that?
I would greatly appreciate if somebody could give or link to some beginner-friendly explanations!
EDIT: Since the answer appears to be „it depends“ as @dandavis commented:
Are downgrade attacks possible (or do recent clients remember the authentication protocol used)?
What are the current best practices / recommendations for new deployments regarding protocols to use?
