RE: SUMMARY: SMB overflow attacks

[pgut001 () cs auckland ac nz (Peter Gutmann)]

"Jason Coombs" <jasonc () science org> writes:

> UPDATE: I double-checked and in fact was able to stop port 445 from binding
> at all under Windows 2000 using the following Registry key:
>
> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NetBT\Parameters
>
> under this key remove the default value "\Device\" from the TransportBindName
> REG_SZ value. upon reboot, port 445 is gone completely, both TCP and UDP.

Wonderful!  One minor comment on this, removing the entire TransportBindName
has the same effect and can be done automatically with a regdel 
(http://www.flos-freeware.ch/regdel.html) script at boot time.  This is
somewhat safer than a one-off edit of a value entry, since these sorts of
things have a nasty self-healing capability which occurs when applying service
packs or making changes to network configs.

Peter.