CATO Networks

MARCH 24, 2020

At the beginning of the month, Microsoft released an advisory and security patch for a serious Windows Server Message Block (SMB) vulnerability called the Windows SMBv3 Client/Server Remote Code Execution Vulnerability (AKA Windows SMBv3 RCE or CVE-2020-0796). Windows SMBv3 RCE isnt the first vulnerability in SMB.

SMB 52

SMB Port Server Protocol 52

CATO Networks

MAY 15, 2017

But what makes the attack so unusually virulent is how it exploits a vulnerability in the Windows SMB protocol. SMB is used by Windows machines for sharing files and the ransomware uses SMB to spread to other vulnerable devices on a network. Like many ransomware attacks, WannaCrypt leverage phishing as an attack vector.

SMB 52

SMB Cloud Server Firewall 52

CATO Networks

MARCH 22, 2023

An attacker can craft a.MSG file as a e form of a calendar invite that triggers an authentication attempt over the SMB protocol to an attacker-controlled endpoint without any user interaction. (.MSG Only SMB sessions terminating at known, trusted servers should be allowed.

SMB 52

SMB Firewall SASE Email 52

CATO Networks

MARCH 20, 2017

The POC was able to generate the so called Blue Screen of Death on Windows clients that connects into a compromised SMB server. Vulnerabilities in SMB servers should be treated very seriously. Organizations can best protect themselves by inspecting interbranch SMB traffic with an IPS.

SMB 52

SMB Server Access Point JavaScript 52

CATO Networks

AUGUST 15, 2024

Executive Summary Recently, security researchers published a proof of concept (PoC) for a critical remote code execution (RCE) vulnerability in Windows Server ( CVSS score 9.8 ), ranging all the way from Windows Server 2000 up to 2025.

SMB 52

SMB Server SASE Cloud 52

CATO Networks

JUNE 29, 2017

Like WannaCry, NotPetya leverages the SMB protocol to move laterally across the network, an EternalBlue exploit attributed to the National Security Agency (NSA) and leaked by the Shadow Brokers hacking group last April. Attackers allegedly planted the malware in the companys update servers.

SMB 52

SMB Cloud Encryption Email 52

CATO Networks

DECEMBER 16, 2024

One of the key features of RoboCopy is its ability to handle SMB (Server Message Block) traffic. When using RoboCopy over SMB, the tool can copy files between different systems on a network, leveraging the SMB protocol to ensure secure and reliable data transfer. dev cdn-server-2[.]wesoc40288[.]workers[.]dev

SMB 40

SMB IP Address SASE Protocol 40