Re: SMB Encryption and SMB Signing

Hello Jan,

The script smb2-security-mode only checks the message signing configuration but we have smb2-capabilities (https://nmap.org/nsedoc/scripts/smb2-capabilities.html) that does (or should) check if Encryption is enabled. 

Cheers.



> On Nov 26, 2018, at 06:07, Jan Rude <[email protected]> wrote:
> 
> Hey there,
> 
> I´m not sure, but I think that SMB Encryption is not checked in the SMB
> scripts of nmap (e.g. 'smb2-security-mode.nse'). It only checks, if SMB
> Signing is enabled, does it?
> 
> Background:
> With SMB3 (Windows 8, Windows Server 2012 and Windows 2016) Windows now
> provides 'SMB Encryption'.
> SMB Encryption provides end-to-end encryption of SMB data and protects data
> from eavesdropping occurrences on untrusted networks.
> It uses Advanced Encryption Standard (AES)-CCM algorithm to encrypt and
> decrypt the data. AES-CCM provides data integrity validation (aka signing)
> for encrypted file shares, regardless of the SMB Signing settings.
> Therefore, if SMB Encryption is enabled, explicit setting of SMB Signing is
> NOT required!
> 
> If SMB Encryption is enabled:
>> only SMB 3.0 clients are allowed to access the specified file shares
>    => the client will receive an 'Access denied' error message, if it does
> not support SMB3.
>> Downgrade attacks to SMBv2 (which would use unencrypted access) are
> mitigated.
>> It is possible to explicitly allow clients to access unencrypted SMBv2
> (for example if they dont support SMBv3). So in this case you have to enable
> SMB Signing again to secure the connection.
> 
> Would it be possible to integrate a check for enabled SMB Encryption?
> 
> Greetings,
> Jan
> _______________________________________________
> Sent through the dev mailing list
> https://nmap.org/mailman/listinfo/dev
> Archived at http://seclists.org/nmap-dev/

_______________________________________________
Sent through the dev mailing list
https://nmap.org/mailman/listinfo/dev
Archived at http://seclists.org/nmap-dev/