SMB NTLM blocking means an admin can prevent any use of NTLM in the SMB client, effectively restricting users & apps to Kerberos. No NTLM challenge response/"hash" will go on the wire, meaning no phishing, relaying, or cracking of NTLM /2
Details: aka.ms/SmbNtlmBlock
SMB NTLM blocking differs from classic Windows (7+) NTLM blocking by implementing a new option that overrides SPNEGO negotiation on a per app/service/protocol basis. This means very flexible control for "NTLM must work here, but not here" scenarios for an org. /3
CVE-2022-26809 has nothing to do with SMB, it's an RPC vuln where a variety of transports can be used, like TCP/135, SMB/445, etc.
But I want to use this opportunity to talk about good techniques to stop an attacker from abusing SMB & the future of SMB security 🧵 /1
The SMB-related CVEs from this month are relying on a user's client being tricked into talking to an evil server via remote file system. That means "block inbound at your edge firewall" likely doesn't help. The attacker doesn't need your network & risks detection using it /2
What you really want is a strategy of device & edge firewall network segmentation. Inbound, outbound, and lateral protection. Computers don't need to talk to most computers in your org or the world. For SMB, I wrote docs.microsoft.com/windows-server… (originally: techcommunity.microsoft.com/t5/itops-talk-…) /3