Check Point Advisories

Brute Force Scanning of CIFS Ports

Check Point Reference: SBP-2011-03
Date Published: 27 Feb 2011
Severity: Medium
Last Updated: 26 Oct 2016
Protection Provided by:

Security Gateway
R80, R77, R76, R75, R71, R70

Who is Vulnerable?
Vulnerability Description CIFS is an extension to the Message Block Server (SMB) protocol, a network protocol native to Windows systems which allows sharing of files and printers across a network. By trying to repeatedly authenticate to a SMB connected server using different passwords, it is possible to crack user accounts on the remote target or compromise the target.Scanning machines on a network involves the same Brute Force technique - sending a large emount of packets for various protocols, and deducing which services are listening from the responses received.A host port scan is directed at a specific host or network. A scan on CIFS ports can determine which services a host offers. Attackers can then direct their efforts against those services on that machine.

Protection Overview

This protection will detect and block Brute Force scanning of CIFS ports.

In order for the protection to be activated, update your Security Gateway product to the latest IPS update.For information on how to update IPS, go to SBP-2006-05, click on Protection tab and select the version of your choice.

Security Gateway R80 / R77 / R76 / R75 / R71 / R70

  1. In the IPS tab, click Protections and find the Brute Force Scanning of CIFS Ports protection using the Search tool and Edit the protection's settings.
  2. Install policy on all modules.

This protection's log will contain the following information:

Attack Name:  Windows SMB Protection Violation.
Attack Information:  Brute Force scanning of CIFS ports

This website uses cookies to ensure you get the best experience. Got it, Thanks! MORE INFO