From: Clark Lebarge [LClark@HEINZE-INSTITUTE.COM]
Sent: Friday, May 05, 2000 3:01 AM
To: NTBUGTRAQ@LISTSERV.NTBUGTRAQ.COM
Subject: Re: More NetBIOS over TCP/IP in Win2K: TCP/IP NetBIOS Helper,
not just for NetBIOS?

I've received a few replies to my question about the TCP/IP NetBIOS Helper
service under Windows 2000.

A couple of people, Paul Leach from Microsoft being one, have asked what
this service has to do with disabling NetBIOS on Windows 2000.
A few people are confused as to what I'm getting at with mentioning the
problem of not being able to have a functional Windows 2000 network without
this service running.

So I'll try to clear up the picture so that everyone can get something out
of this.

As I see it, there are three issues in this thread. The first issue being:
Is information still available over NetBIOS when an Administrator selects
"Disable NetBIOS over TCP/IP" on the properties of a LAN connection?

I'll look at this first.

On 4/25/2000 Anthony Skipper reported that after disabling NetBIOS over
TCP/IP using a utility that scans for "NetBIOS Information" he could still
enumerate shares and discover the usernames on that system. The
functionality and purpose of this anonymous connection is described in MS
Knowledge Base article Q143474, this article along with article Q246261
describe how to restrict the access to this information to authenticated
users.

My attempts to verify this issue were done using the Cerberus Internet
Scanner using its NetBIOS test. My test setup consisted of two stand-alone
Windows 2000 computers running only TCP/IP on a 10BaseT network. On the
target system I disabled NetBIOS on the TCP/IP properties of the LAN
connection. I then restarted the computer and verified that no NetBIOS names
were registered on the target system.
On the target system I started Network Monitor to view what information was
being sent over the wire. I then started the NetBIOS scan on the attacking
host.

The results of the scan were as Anthony pointed out, CIS was able to
successfully read the list of shares and usernames on the target system.
However, the results in Network Monitor show a slightly different scenario
taking place. Network Monitor shows that all communication between the
attacking system and the target system occurred via direct hosting of SMB on
port 445.
This makes me wonder if the result Anthony was seeing was not due to NetBIOS
ports still being open but due to SMB still being enabled. As he pointed
out, the surest way to stop the enumeration of this information was to stop
the Server service. I would like Anthony to confirm whether his test of
anonymous access was performed on the NetBIOS ports or not. If like in my
situation the attacking system was a Windows 2000 computer then it may be
that it also was connecting via direct hosting of SMB on port 445.

Now, onto the second issue: Is NetBIOS truly disabled in Windows 2000?

To decide whether NetBIOS is truly disabled in Windows 2000 it must first be
decided at what point is a function considered disabled. In computer terms I
consider disabled to mean not functioning in any manner.

Does disabling NetBIOS over TCP/IP on the properties of a LAN connection
truly disable NetBIOS throughout the OS?
To make it simple and short, the answer is no.
After performing this task it can still be seen through Device Manager that
the NetBIOS over TCP/IP device is still enabled and functioning.
Does disabling NetBIOS over TCP/IP on the properties of a LAN connection
stop NetBIOS from being transmitted on the network?
Yes, it seems to have this effect. However based on the fact that the device
is still functioning in the OS the conclusion that I draw is that the
disabling of NetBIOS over TCP/IP is in fact the enabling of a filter that
blocks the NetBIOS communication from reaching the wire. This is just
conjecture however as it is not possible to view what is happening inside
the code of the OS.

So then, what if you go into Device Manager and disable the NetBIOS over
TCP/IP device?
Well, this does have the desired effect of completely nuking the NetBIOS
functionality of the OS. However it also renders the OS useless on a
Microsoft network as you can no longer use UNC names to connect to Windows
2000 based servers. This is caused by the fact that the TCP/IP NetBIOS
Helper service is dependant on the NetBIOS over TCP/IP device. As I pointed
out in my original message to NTBugTraq disabling this service causes the
loss of UNC resolution via host names.

This takes us to our last issue: Why is the TCP/IP NetBIOS Helper service
needed for host name resolution in a UNC path?
I've been told by Joern Wettern, a person under contract with Microsoft to
produce curriculum for Microsoft training, that the function of resolving
names in a UNC is performed by the TCP/IP NetBIOS Helper service.
The problem that I have with this answer is not that it is necessarily
incorrect but that there is no documentation, available to all
administrators, existing for Windows 2000 that states that this service is
required for host name resolution. Not in the included help files, not in
the Resource Kit, and not on Microsoft's Knowledge Base at Support Online.
Without this documentation it is only time before an unknowing administrator
thinking this is an unneeded service will disable this service on his
servers and workstations leaving them unable to connect to any UNC path.
After all, the description, which is the most documentation on this service
in any one place, states that it is for NetBIOS name resolution.
Don't forget that in addition to losing the ability to connect to UNC paths
Group Policy is not applied. The fact that Group Policy is not applied is a
major security concern as this is the primary method of applying security
settings to all computers in an organization. Any system that is not running
this service will not have any Group Policy applied to it.

The lack of concern about this potential situation from Microsoft has not
impressed me at all.