Windows File Sharing - Facing The Mystery

For one reason or another, there is quite a bit of confusion surrounding the technologies that allow File Sharing to take place on a Windows machine. The hodgepodge of terms ranging from NetBIOS, NBT, and SMB serve to confuse not only junior admins, but many more experienced professionals as well. We've all been there when a newcomer to IT has asked difficult questions like, "If I disable x, but leave y, will I still be able to do z?" Most times the professional being asked will try and either change the subject or exit the room as quickly as possible so as to avoid showing their ignorance.

Of course, nearly everyone is familiar with one main concept -- the well-worn and widely known view that Windows file sharing services are potentially very dangerous. Steve Gibson and his website can be credited mostly for this becoming largely common knowledge. Unfortunately, however, the fact that "it's bad" is about the extent of most people's knowledge of the subject. As a friendly test, see if you know the answers to the questions below:

These should be simple questions for anyone who deals with Windows in an administrator role, but unfortunately they are not. In fact, I'd be willing to bet that less than a quarter of Windows admins can confidently answer all five questions. In this short article, I intend to get readers up to speed on the basics of this highly critical area of knowledge. Often times, knowing the how and why makes all the difference when it comes to making sound security decisions.

Windows 9x - The Old Way

As with many disciplines, the best way to start is with a bit of history. Before going into how file sharing is handled on the current generation of Windows operating systems, let's take a look at how it was handled previously.

NetBIOS

The beginning starts with a protocol called NetBIOS. Originally pushed by IBM, it was put together for the purpose of sharing information between a very limited number of machines on a LAN. Early on, NetBIOS ran on a number of protocols, to include DECnet, and it's important to note that it was not designed to scale to large organizations. Unfortunately, once Microsoft released its products based on it, and computers became a crucial part of the business world, NetBIOS became the backbone of file sharing on business networks everywhere.

In Windows 9x (Windows 95, 98, and ME), the primary ports for sharing resources were 135, 137, 138, and 139. Below we take a look at each:

NetBIOS was benign enough initially because they were bound to a protocol called Netbeui. NetBIOS was somewhat harmless when it ran over Netbeui because the protocol is limited to local networks. It couldn't cross routers, and therefore couldn't cross the Internet. For this reason, any problems associated with file sharing while running Netbeui were relatively limited.

NetBIOS over TCP/IP

This all changed when Microsoft started binding NetBIOS to TCP/IP -- a system referred to as NBT. What this did was take a potentially dangerous but hobbled system (NetBIOS) and gave it wings. Now, instead of just having to worry about someone in the next cube gaining information about your system and/or connecting to your file shares, you now have to worry about someone in New Jersey, Russia, or China doing the same thing.

Essentially, if the interface that connected you to the Internet had both TCP/IP and File and Print sharing on it, and you didn't have a decent password configured, you were in line to get scanned and pillaged at will by anyone on the Internet.

File and Print Sharing

Ok, so what's File and Print Sharing? Where does that fit in? Good question. File and Print Sharing is little more than a service that enables file/folder and print shares to be made available to clients. It's that simple. Think of it as a daemon that runs on a machine -- similar to a web or mail server.

Remember, daemons aren't useful unless requests can make it to them. That's where SMB over TCP (or in the 9x world -- NetBIOS over Netbeui or TCP/IP) come in. They are the means of getting requests over the network to the "server" machine, i.e. the box that has a folder or a printer shared out.

Basically, two things are needed in order for there to be a successful file transfer, 1) a transport allowing a client to make it to the machine in question, and 2) the machine to be listening for requests while it has shares available. It's important to understand these two pieces of the puzzle and where each technology fits.

Countermeasures

Steve Gibson's site, while quite informative, sensationalized the risk to some degree. All one needed to do to keep from sharing files over the Internet is unbind File and Print sharing from the TCP/IP protocol within network properties for the adapter that faces the outside. This could be done while leaving the binding intact for the internal adapter(s) so that you could benefit from file sharing on the internal, trusted network while having it disabled for the untrusted one(s).

The bits about disabling the Client For Microsoft Networks and such were simply over the top. Aptly enough, the "Client For Microsoft Networks" is nothing more than a client (hence the name). Disabling it had nothing to do with whether or not the server portion of File Sharing was enabled (File and Print Sharing).

Windows 2000/XP - The New Way

For most of us, Windows 9x is thankfully ancient history. The vast majority of us deal with Windows 2000 and XP these days, and the way these versions of Windows handle File Sharing is significantly different.

First off, the big difference that many notice is the use of port TCP/445 vs. the ports in the 130 range. This change was part of a new Microsoft paradigm designed to eliminate the dependency on NetBIOS. In fact, one can completely disable NetBIOS over TCP/IP on a Windows 2000/XP machine since these new operating systems (via TCP/445) have SMB riding directly on top of TCP rather than on NetBIOS. Microsoft calls this the "direct hosting" of SMB. This enhancement allowed for a few benefits, such as less clutter in the protocol stack, a lack of NetBIOS broadcasts, and the ability standardize on DNS entirely for name resolution.

As can be expected, most of the functions taken care of by ports 135-139 when NetBIOS was used are now taken care of by the single port 445. This means that not only file and print sharing take place over 445, but also network browsing functionality and RPC.

Old vs. New

When connecting to a Windows 2000/XP machine that has both NetBIOS over TCP and direct hosting enabled (from a client machine that's also using them), both types of connectivity will be attempted. The service responding first will be accepted and continued, i.e. if NetBIOS responds first then an RST will be sent to TCP/445, and vice versa.

Summary

Ok, now that we've covered a few different topics here, let's touch on some key points:

Well, that about sums it up. The goal here was to either refresh or bring up to speed anyone who deals with Windows networking on a daily basis. In the event that I've made an error, or you'd just like to comment, please feel free to contact me at daniel@dmiessler.com.: