What is an SMB vulnerability?
SMB overview
Server Message Block (SMB) is a Microsoft network file sharing protocol. Leaving an SMB service open to the public can give attackers the ability to access data on your clients’ internal network, and increases their risk of a ransomware attack or other exploit. Notably, SMB1 (a legacy version of the service) was used as an attack channel for both the WannaCry and NotPetya mass ransomware attacks in 2017. Server Message Block (SMB) allows devices on the same network to share files with each other. Printers, mail servers, and high-priority internal network segments use SMB to provide access to remote users.
If this protocol is identified as unsecured on a policyholder’s IT system, this triggers an alert from Corvus. Click here to learn about dynamic security alerts.
Best practices for securing SMB
Properly securing SMB services is the ideal resolution. We recommend that your clients take the following steps to address their SMB vulnerability.
- Work with their IT team to investigate the vulnerability
- Assess the version of SMB used. Best practices recommend:
- Disabling SMBv1 and
- Blocking all versions of SMB at the network boundary (more information on this here)
