SMB (Server Message Block) is a protocol that allows users on the same network to share files, access resources like storage and apps, and communicate. It’s widely used in both businesses and homes to streamline and simplify resource sharing.
Don’t be put off by the fancy abbreviation — SMB is actually quite straightforward and worth understanding, as it plays a crucial role in network communication. Below, we’ll walk you through how it works, the different SMB versions, common uses, and tips to stay secure while using the protocol.
Table of contents
What is the SMB protocol?
SMB is a network protocol that enables you to communicate with remote computers and servers on the same network. It’s often used for sharing files, using printers, and accessing other resources.
Originally created by IBM (International Business Machines Corporation) in the 1980s, Microsoft later modified and enhanced SMB before making it the default file-sharing protocol for Windows. Since then, several SMB versions have been released, each offering different features and improvements.
At first, the protocol was used mainly to connect Windows computers. But now, many other operating systems — including macOS and Linux — also support it for resource sharing. This means you can use the protocol to share resources with devices running different operating systems.
How SMB works
SMB is a request-response protocol. In this setup, the client (like your computer) sends an SMB request to the server, which then replies with an SMB response. Here’s a closer look at how it plays out:
- Initiation request: the client sends an SMB request to the server to establish a connection.
- Authentication: the server receives this request and asks for authentication, which the client provides through credentials.
- Connection establishment: if the credentials are correct, a two-way communication channel is established.
- Resource request: the client can now interact with the server and request access to shared resources. The server checks permissions and processes the request.
- Data delivery: the server retrieves the requested data and sends it to the client, who then receives and uses the data.
Let’s consider how SMB works in a real-world setting. Suppose you have a small office network and need to share files with Andrew, Julie, and Taylor. To do this, you set up a shared folder on your computer using SMB.
With this arrangement, the trio can access that folder directly from their computers as if it were on their own devices. They can open, edit, or save files in the shared folder, making collaboration much more efficient.
Additionally, SMB allows you to manage permissions. For example, you can give Andrew and Julie full access, allowing them to open, edit, delete, or add files. Meanwhile, Taylor can be restricted to just viewing the folder without being able to make any changes. So, you have complete control over who can do what with the folder.
What are SMB protocol dialects?
SMB dialects are variations of the protocol released over the years, with new versions introduced to improve functionality, performance, and security. Let’s take a look at these dialects.
SMB 1.0 / CIFS (Common Internet File System)
IBM introduced SMB 1.0 in the mid-1980s — the first widely adopted version of the SMB protocol. It allowed basic file, printer, and resource sharing within a LAN (Local Area Network). However, it lacked advanced security features and received flak due to its vulnerabilities, some of which were exploited in ransomware attacks.
Microsoft later rolled out CIFS, an extension of SMB 1.0, with Windows 95. Unlike SMB 1.0, CIFS was designed to enable file sharing over the internet, not just within a LAN. It brought improvements such as support for larger files, better performance, and more robust client-server communication.
Today, both SMB 1.0 and CIFS are considered outdated.
SMB 2.0 and 2.1
SMB 2.0, introduced with Windows Vista, significantly ramped up the protocol’s efficiency and performance. For instance, it cut down the number of commands and subcommands needed for communication to reduce chattiness, making it faster and more scalable. SMB 2.0 also added support for symbolic links and improved reliability.
SMB 2.1, released alongside Windows 7, further sped up the protocol by supporting larger MTU (Maximum Transmission Unit) sizes for more efficient data transfer between client and server. Additionally, it introduced the client oplocks (opportunistic locks) feature for better file caching and reduced server communication.
SMB 3.0, 3.02, and 3.1.1
SMB 3.0, which debuted with Windows 8, marked a significant upgrade in both security and performance. Notably, it was the first version to support end-to-end encryption, protecting data transferred over the network from unauthorized access. Other upgrades include Transparent Failover, which ensures continuous availability of file shares.
Meanwhile, SMB 3.02, released with Windows 8.1, worked on enhancing stability, compatibility, and performance rather than adding new features. A key improvement was better tools and management options to fully disable SMB 1.0 for better network security.
The latest SMB 3.1.1 was introduced alongside Windows 10. This version stepped up security with pre-authentication integrity to protect against MitM (Man-in-the-Middle) attacks. It also bolstered encryption by adding support for AES-128 GCM and AES-128 CCM. Beyond security, SMB 3.1.1 includes various optimizations for more efficient data transfer and reduced latency.
Common uses of SMB
Because it works with a wide range of operating systems, handles multiple file types and sizes, and is easy to use, SMB is popular for sharing resources. Here are some common ways it’s used:
File sharing
SMB is often used to share files among users and devices on the same network, allowing you to access files stored on a remote server as if they were on your local system. Whether it’s a status report, sales inventory spreadsheet, or even a photo album, SMB makes it easy to access and manage files as long as you’re on the same network.
Additionally, SMB lets you set permissions, giving you full control over who can view or edit specific files, which helps keep your data secure.
Printer sharing
SMB also enables printer sharing across a network, allowing multiple devices and users to use a single printer. In an office, employees can send print jobs from their desks to a central printer in a shared space.
This setup reduces equipment and maintenance expenses while also promoting efficiency. Instead of purchasing a separate printer for each employee, multiple users can share one printer. Employees from different departments and floors can also easily connect to the shared printer without needing direct physical access.
Network resource access
With SMB, users can access network resources such as shared storage, apps, or services as if they were directly connected. This way, data spread across many individual devices and users can be consolidated into a single system for easier access and management.
With everything centralized, backups, updates, and security measures can be applied consistently across the board. Additionally, it facilitates collaboration by providing access to all relevant users while allowing you to set permissions, ensuring that only authorized users and devices can access specific resources.
SMB security considerations
SMB is generally considered secure and is widely used in both corporate and home network settings. However, like any security system, it isn’t bulletproof and can be vulnerable to new threats as they emerge. In the past, there have been instances where SMB vulnerabilities were found and exploited, leading to some high-profile incidents.
Notable vulnerabilities
Several SMB vulnerabilities have been exploited over the years:
- EternalBlue: discovered by the US National Security Agency (NSA) and leaked by the hacking group Shadow Brokers in 2017, this flaw in SMBv1 allows attackers to remotely execute malicious code without users noticing, giving them control over the infected computers;
- EternalRomance: also published by Shadow Brokers, this vulnerability enables attackers to take remote control of Windows systems by sending specially crafted packets to unpatched computers;
- SMBGhost and SMBleed: affecting the latest SMBv3, these two seriously damaging vulnerabilities can be exploited to execute remote code and extract sensitive kernel memory, potentially giving attackers full system control when combined.
High-profile incidents
There has been a string of major cyberattacks targeting SMB vulnerabilities. Here are some of the most significant ones:
- WannaCry ransomware (2017): exploiting the EternalBlue SMBv1 vulnerability, this attack encrypted users’ files and demanded ransom payments in bitcoin — ultimately impacting around 200,000 computers across 150 countries;
- Petya (2016): initially spread through phishing emails, later variants exploited the EternalBlue SMB vulnerability to encrypt files for ransom and used the protocol to move laterally from infected machines to other machines on the same network;
- NotPetya (2017): designed to cause maximum damage rather than merely extort money, NotPetya encrypted and destroyed data, making recovery nearly impossible even if the ransom was paid.
Types of attacks targeting SMB
In addition to ransomware, cybercriminals may also target the SMB protocol through other types of attacks. Let’s check out some common ones.
Brute force attacks
This is where hackers systematically try various combinations of usernames and passwords using automated tools to gain access to shared SMB resources. If successful, these brute force attacks can lead to data theft and unauthorized modifications. Worse, there’s also the risk of lateral movement to compromise other systems on the same network.
MitM attacks
MitM attacks involve an attacker intercepting and altering communications between two parties without their knowledge. In the context of SMB, attackers may position themselves between the SMB client and server. This can lead to stolen credentials, unauthorized access to proprietary documents, hijacked sessions, or manipulated data exchanges.
DDoS attacks
A DDoS (Distributed Denial of Service) attack floods your SMB services with a massive wave of fake requests, making it difficult to access shared files and resources. The goals of such attacks can vary widely, including causing operational disruptions, inducing downtime, or serving as a smokescreen for other malicious activities.
SMB and VPNs
As the SMB protocol is no stranger to vulnerabilities, it’s crucial to understand its weak spots and take steps to minimize them. One of the most effective ways to do so is by using a VPN. A reliable VPN like Surfshark adds a much-needed extra layer of protection.
Encrypts data
Surfshark encrypts all data, including SMB communications, between the client and the server. Once encrypted, any sensitive information — such as login credentials, confidential work files, or system backups — becomes complete gibberish without the encryption key. Even if someone intercepts the data, they won’t be able to read or modify it without the key.
Secures remote access
When employees access SMB resources remotely, it can expose these resources to various risks, including the dangers associated with using a public Wi-Fi network. Surfshark addresses this problem by creating a secure tunnel that isolates the data from potential threats, shielding it from prying eyes and tampering.
Provides malware protection
Using a VPN at work and home helps mitigate the damage from attacks that target SMB vulnerabilities, but preventing these attacks altogether is just as crucial. Surfshark’s CleanWeb blocks ads and malicious links, minimizing your exposure to malware-infected sites that could lead to attacks like WannaCry. Additionally, Surfshark Antivirus scans and removes malware from your devices, preventing them from exploiting SMB vulnerabilities.
Protect yourself while using SMB
From sharing work files and using the office printer to accessing a server-stored database, SMB is essential for easy and efficient resource sharing. However, its vulnerabilities and history of high-profile attacks can be worrying.
To make the most of SMB’s benefits while staying secure, use Surfshark to encrypt all SMB communications and shared resources. For added protection, upgrade to Surfshark One, which includes Surfshark Antivirus, to guard against malware and viruses that could exploit SMB vulnerabilities.
FAQ
What is SMB used for?
The SMB protocol is used to share files, printers, and other resources like storage and software among devices on the same network. It allows seamless access to these shared resources as if they were local to you.
What is an example of SMB?
An example of the SMB protocol is sharing a folder on your company server, allowing project members to access, edit, and save files from their devices. This streamlines the collaboration process by enabling everyone to work with the same documents and resources.
What does Microsoft SMB stand for?
Microsoft SMB stands for Server Message Block. Initially developed by IBM, this file and resource-sharing network protocol is now closely associated with Microsoft due to its extensive use in Windows.
