Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email email@example.com
From: Jim Harrison (Jimisatools.org)
Date: Thu Mar 22 2007 - 08:41:34 CDT
Drive mapping isn't guaranteed to use NetBIOS - this depends on the OS
For instance, Windows began using SMB (TCP:445) on Windows 2000 and
later for remote file shares (although NetBIOS connections are still
supported for downlevel compatibility.
The problem with allowing either or (FSM help us) both across one; much
less two firewalls is that file shares aren't the only things that use
Remote registry, remote service control are two of my favorite examples
of SMB-carried traffic.
My favorite p1553d-0ff domain admin trick is:
for %i in (list of dcs) do sc \\%i config netlogon start= disabled & sc
\\%i stop netlogon
You won't reverse this action without a recovery console, since the DCs
in question can no longer authenticate any logon attempt. Of course,
you have to order your list properly so as to do the GCs last, but for a
domain admin, that's trivial info gathering.
The point is; if you allow direct file share access between your
security zones (or else why have a firewall between them), you create a
much larger threat than simple file mangling.
You might consider using FTPS or SSH connections; they're relatively
secure, depending on the server/client package you select.
From: listbouncesecurityfocus.com [mailto:listbouncesecurityfocus.com]
On Behalf Of aehealdgmail.com
Sent: Wednesday, March 21, 2007 7:01 PM
Subject: Shared drives through a firewall
I am trying to persuade a client NOT to map a drive through two
an untrusted server in a DMZ to run an application. I've tried Googling
Netbios and security, but get so many entries as to be useless.
Other than the latency issues, and my ten cents that it seems to me to
enormously foolish idea, can you folks offer me any further ammunition?
Big Thanks if you can
All mail to and from this domain is GFI-scanned.