2KKUU7ita

208
Part IV: Hacking Operating Systems
The shares displayed in Figure 11-5 are just what malicious insiders are looking
for because the share names give a hint of what type of files might be
accessible if they connect to the shares. After the bad guys discover these
shares, they’re likely to dig a little further to see whether they can browse
the files within the shares. I cover shares and rooting out sensitive information
on network shares and other storage devices in Chapter 15.
Countermeasures against NetBIOS attacks
You can implement the following security countermeasures to minimize
NetBIOS and NetBIOS over TCP/IP attacks on your Windows systems:
✓ Use a network firewall.
✓ Use Windows Firewall or some other personal firewall software on each
system.
✓ Disable NetBIOS — or at least Windows File and Printer Sharing.
Disabling NetBIOS might not be practical in a network where users and
applications depend on file sharing or in a mixed environment where
older Windows 2000 and NT systems rely on NetBIOS for file and printer
sharing.
✓ Educate your users on the dangers of enabling file shares for everyone
to access. I cover these risks in detail in Chapter 15.
Hidden shares — those with a dollar sign ($) appended to the end of the share
name — don’t really help hide the share name. Any of the tools I’ve mentioned
can see right through this form of security by obscurity. In fact, if you come
across such shares, you’ll want to look at them more closely, as a user may be
trying to hide something.
Detecting Null Sessions
A well-known vulnerability within Windows can map an anonymous connection
(or null session) to a hidden share called IPC$ (which stands for interprocess
communication). This attack method can be used to
✓ Gather Windows host configuration information, such as user IDs and
share names.
✓ Edit parts of the remote computer’s registry.
Although Windows Server 2008, Windows XP, Windows 7, and Windows 8 don’t
allow null session connections by default, Windows 2000 Server does — and
(sadly) plenty of those systems are still around to cause problems on most
networks.