RE: Avoid sending current credentials automatically over the network

[Gadi Evron <ge () linuxbox org>]

On Tue, 13 Feb 2007, Shenk, Jerry A wrote:
> I would recommend blocking those ports (135, 137, 139 and 445) at the
> edge router so that at least they aren't sent over the internet.  For
> some machines, perhaps you want a host firewall to block them from
> leaving the box at all.

Erm, always a sound advice on a personal/desktop/local/whatever firewall,
but how about disabling the services? (those you can)

        Gadi.

> -----Original Message-----
> From: listbounce () securityfocus com [mailto:listbounce () securityfocus com]
> On Behalf Of Umil
> Sent: Tuesday, February 13, 2007 10:21 AM
> To: pen-test () securityfocus com
> Subject: Avoid sending current credentials automatically over the
> network
>
> Hi all
>
>
> When mapping a network share without any credentials parameter or when 
> clicking in a link for a internal app Windows and IE automatically send
> the 
> current users credentials automatically. Aparently for IE you can
> configure 
> to send anonymous creds (guest account) and then ask for creds.
> However over the network there is no option to avoid sending current
> users 
> creds automatically. I tried smb signing but it didn't work.
> Does anyone know a solution for it?
> Thanks
> Uno 
>
>
> ------------------------------------------------------------------------
> This List Sponsored by: Cenzic
>
> Need to secure your web apps?
> Cenzic Hailstorm finds vulnerabilities fast.
> Click the link to buy it, try it or download Hailstorm for FREE.
>
> http://www.cenzic.com/products_services/download_hailstorm.php?camp=7016
> 00000008bOW
> ------------------------------------------------------------------------
>
>
>
>
> **DISCLAIMER
> This e-mail message and any files transmitted with it are intended for the use of the individual or entity to which 
> they are addressed and may contain information that is privileged, proprietary and confidential. If you are not the 
> intended recipient, you may not use, copy or disclose to anyone the message or any information contained in the 
> message. If you have received this communication in error, please notify the sender and delete this e-mail message. 
> The contents do not represent the opinion of D&E except to the extent that it relates to their official business.
>
>
> ------------------------------------------------------------------------
> This List Sponsored by: Cenzic
>
> Need to secure your web apps?
> Cenzic Hailstorm finds vulnerabilities fast.
> Click the link to buy it, try it or download Hailstorm for FREE.
>
> http://www.cenzic.com/products_services/download_hailstorm.php?camp=701600000008bOW
> ------------------------------------------------------------------------


------------------------------------------------------------------------
This List Sponsored by: Cenzic

Need to secure your web apps?
Cenzic Hailstorm finds vulnerabilities fast.
Click the link to buy it, try it or download Hailstorm for FREE.

http://www.cenzic.com/products_services/download_hailstorm.php?camp=701600000008bOW
------------------------------------------------------------------------