A penetration test report includes a finding of 'SMB signing not required' on domain workstations. Why is this a security risk?
Select an answer to reveal the explanation.
Short Explanation
Here's the deal — if SMB signing isn't required, an attacker in a network position can relay NTLM authentication from a victim to another target and gain access without cracking credentials. The risk is authentication relay, not cleartext exposure.
Full Explanation
The finding is a security risk because when SMB signing is not required, an attacker in a network position can relay SMB NTLM authentication from a victim to another server, for example using tools like Responder and ntlmrelayx, gaining access without cracking credentials. The option claiming attackers can read SMB traffic in cleartext even without a network position is wrong because SMB without signing still encrypts data with NTLMv2 session security; the risk is authentication relay, not cleartext exposure. The option claiming it prevents Windows systems from joining the Active Directory domain is wrong because SMB signing is optional for domain joining; systems join Active Directory without it. The option claiming it causes SMB connections to fail when connecting to servers outside the domain is wrong because SMB connections function normally without signing; the absence of signing is a security weakness, not a connectivity requirement.