A penetration test report includes a finding of 'SMB signing not required' on domain workstations. Why is this a security risk?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — b is correct because when SMB signing is not required, an attacker in a network position can relay SMB NTLM authentication from a victim to another server (e.g., using tools like Responder + ntlmrelayx), gaining access without cracking credentials. A is wrong because SMB without signing still encrypts data with NTLMv2 session security; the risk is authentication relay, not cleartext exposure.
Full explanation below image
Full Explanation
B is correct because when SMB signing is not required, an attacker in a network position can relay SMB NTLM authentication from a victim to another server (e.g., using tools like Responder + ntlmrelayx), gaining access without cracking credentials. A is wrong because SMB without signing still encrypts data with NTLMv2 session security; the risk is authentication relay, not cleartext exposure. C is wrong because SMB signing is optional for domain joining; systems join AD without it. D is wrong because SMB connections function normally without signing; the absence of signing is a security weakness, not a connectivity requirement.