Saint SMBGhost, Phantom of Compression

Patron of Windows file sharing, services exposed to the internet, and worms waiting to be born.

Life

On 10 March 2020 Microsoft fixed CVE-2020-0796, a flaw in how SMBv3 handled compression. Scored 10, no interaction required, potentially able to spread machine to machine like a worm: so much so that it was at once compared to EternalBlue. A crafted compressed packet was enough to run code on clients and servers. It ended up in CISA's catalogue of exploited vulnerabilities.

Prayer

O Saint SMBGhost, who haunts packet compression, keep file sharing from ever facing the internet. Amen.

How to celebrate

Celebrated by installing the March 2020 patch, disabling SMBv3 compression, and blocking port 445 at the network edge.

Ghost in the packet, worm in the network.