SMB 1.0/CIFS question.

[GTP]

Is SMB 1.0/CIFS safe to enable for a basic home network?

Thanks

 

[Sky-Knight]

It's safe, if you're OK with Print Nightmare level exploits running at home. I am not...

My next question is why? SMB 1.0 was Windows XP / Server 2003's file and print sharing protocol. What do you have around that you still need that ancient mess to access?

 

[Metanis]

Is SMB 1.0/CIFS safe to enable for a basic home network?

Thanks

Yes if none of the machines will be attached to the Internet. Ever.

 

[GTP]

Yes if none of the machines will be attached to the Internet. Ever.

Thanks, just confirming what I already know.
Have a client that wants to use it and I'm trying to convince her otherwise.

 

[YeOldeStonecat]

SMB 1 has many vulnerabilities that are exploited by various old malware, that SMB 2 and 3 fixed.
So, letting a network run with SMB 1 is like....letting a network run without many Microsoft security updates.

Having all computers of a network have their security updates installed allows the computers to shrug off lots of malware like water off a ducks back. As does just running the network on SMB 2/3. Ransomware like WannaCry exploit the limitations of SMB 1, and cannot on SMB 2/3. There are many...many other exploits out there which do their damage exploiting SMB 1.....and they cannot do anything with SMB 2/3.

 

[nlinecomputers]

Thanks, just confirming what I already know.
Have a client that wants to use it and I'm trying to convince her otherwise.

Why do they want to use it? Old Printer?

 

[GTP]

Its an old Toyota knitting machine.

 

[Markverhyden]

Its an old Toyota knitting machine.

That's why those old Corolla's held together so long......

 

[nlinecomputers]

Its an old Toyota knitting machine.

Ok so why are you trying to get her to stop using SMBv1? That machine is too expensive to replace. Take the machine that runs it off the internet and put it on a separate VLAN.

 

[Markverhyden]

Ok so why are you trying to get her to stop using SMBv1? That machine is too expensive to replace. Take the machine that runs it off the internet and put it on a separate VLAN.

I'd actually be far more concerned about having verified full disk images and replacement hardware for hardware/software failures rather than an SMB1 exploit. It's almost certain that kit will only run on 32 bit, possibly even 16. And that hardware will only keep getting harder to source as time goes by.

 

[nlinecomputers]

I'd actually be far more concerned about having verified full disk images and replacement hardware for hardware/software failures rather than an SMB1 exploit. It's almost certain that kit will only run on 32 bit, possibly even 16. And that hardware will only keep getting harder to source as time goes by.

I would see if you can hypervisor it.

 

[Sky-Knight]

Yeah, isolate on a VLAN with a tagged guest somewhere. New hardware, old stuff in a nice safe offline bubble and done.

Pretty cheap to do with Unifi or HP Aruba instant on switches.

 

[Markverhyden]

The catch with hypervisors is a lot of that older stuff used hardware based license keys. Initially using parallel ports, serial and even dedicated PCI/ISA cards. When they moved to USB sticks it's easy because you can choose to expose a USB device directly to the VM.

 

[Sky-Knight]

You can connect a host's parallel port to the guest, and if that isn't good enough there are USB to Ethernet bridging device you can slap an LPT port adapter on.

It's often really fiddly... but it usually can be done. And for old manufacturing gear like this, it's very much worth the effort to do so.

But yeah, hardware keys are a bit of a chore.

 

[nlinecomputers]

The catch with hypervisors is a lot of that older stuff used hardware based license keys. Initially using parallel ports, serial and even dedicated PCI/ISA cards. When they moved to USB sticks it's easy because you can choose to expose a USB device directly to the VM.

Been there got the tee shirt.

 

[GTP]

Ok so why are you trying to get her to stop using SMBv1? That machine is too expensive to replace. Take the machine that runs it off the internet and put it on a separate VLAN.

This is what I have done. There is no reason for it to be on the internet now.
All sorted, thanks for the responses.