SMBLoris

Hi. SMBLoris has no known attack vehicles, just a demo proof of concept. MSRC rated it as Moderate/DoS because it is blocked at the network edge by normal port 445 firewall rules. Inside of a network, its usage would only announce and pinpoint the attacker - a single node sending a large number of unauthenticated SMB connections. Those connections can then also be temporarily blocked by individual node's own software firewalls blocking 445 until the attackers inside the LAN are removed. Since the attack's novelty is that only a single node is involved, a network capture running against the target that you temporarily exposed would quickly identify the client. It would only be somewhat effective in an entirely unmanaged network with no permanent IT staff.

 

It is likely we will patch this in a later semi-annual release of Windows /Windows Server, in order to  prevent unmanaged consumer users with no firewalls configured from being affected. Moderate-rated vulnerabilities often get fixed in this manner for the same of completeness. To have that change backported is much less likely though. The patch itself carries some application compatibility risk (as do all rate limiters), perhaps leading to affecting customers unnecessarily, so it must be designed and test carefully.

Thanks for the question! The owner of SMB isn't in the room right now, but we've reached out to get your question answered.

Thank you. By the way, I had to edit my profile. I'm Torsten, not Alexei. Never entered this name...