Sure if you use no firewall and blank passwords but extremely unlikely in a
network that takes the most basic security precautions. Event the cheapest
firewall will keep attackers from the internet from accessing your
administrative shares.
Security needs to be constructed in rings. Entrance to the outer ring
should not provide a route to the inner ring. Firewalls are important,
but how many firewalls and firewall OS's have had security holes
discovered in them - including some of the best known and most popular
products ? Talk to a network security guy who is willing to be honest
and see what they say behind closed doors.
Also, most attacks are conducted by having internal users expose a
hole in a firewall from the back side. Lord knows there are enough of
those in Windows alone. As soon as that happens, there can be a big
hole in your firewall because there can be a "legitimate" request made
from inside the firewall.
To protect your internal network for the threat from
accessing administrator shares enforce password complexity and require
regular password changes which should require that passwords or pass phrases
be at least 15 characters in an environment that would need high security.
Agreed, but not unhackable. We should require physical access to a
secured location to start hacking the root drive of a secure machine -
not access across the network from any place behind the firewall.
Beyond that you can further increase security by regularly reviewing audit
logs, managing the user right for access this computer from the network,
implementing the built in Windows Firewall with exceptions that reflect the
principle of least privilege, and using ipsec which is all built into the
operating system. If more security is needed use smart cards and require
that the user logon with smart cards.
I agree with all that. But, good security is built using rings. We
build a ring, then we ask the question "OK, what if someone gets
access inside this ring?". At that point we look to have other levels
of security to protect the next ring. A worldwide known _default_
share to the root drive is about the biggest violation of ring
security I can think of.
Note that "hiding" a share only hides it from My Network Places and not from
command line tools. Hiding shares often gives users a false sense of
security. An attacker does not need the hidden admin shares to attack a
poorly secured computer via the network. By far a bigger threat to networks
is computers that are not physically secured, untrained employees, and
social engineering attacks. --- Steve
Agreed. I was thinking of removing those admin shares, not hiding
them. Hiding is just a step to keep amateurs out. Like they say "house
door locks keep honest people out". Same idea.
You are also right
about physical security - give me physical access to your machine and
you'd better have BIOS passwords... and if it's a serious security
situation, physical locks and measures that prevent me from simply
taking the hardware with me. But, providing me access to something as
important as the root drive in the default setup just seems foolish.
It seems very odd that MS has made such a show of restricting remote
admin of the web server (admittedly, a huge hole with their previously
moronic (alleged) security scheme for the web server and their
continuing tight integration of the web server with other system
facilities) while allowing this bigger hole to continue to exist.
If