What is SMB Protocol?

Server Message Block is the protocol behind Windows file shares, printer sharing and named pipes, and is implemented on Linux and Unix by Samba. Modern SMB listens on TCP port 445; older deployments also used NetBIOS over TCP on ports 137 to 139. It is a local-network protocol by design, and there is essentially no legitimate reason for it to be reachable from the internet.

Why internet-exposed SMB is critical

SMB has a long history of severe vulnerabilities, the most consequential being MS17-010 — the flaw behind the EternalBlue exploit used by the WannaCry and NotPetya campaigns in 2017. Exposed SMB also enables share enumeration where guest or null sessions are permitted, credential relay and capture attacks, and outbound authentication leaks when a client is tricked into connecting to an attacker-controlled server.

The protocol is additionally a favoured path for lateral movement and for distributing ransomware payloads once an attacker is inside a network, which is why internal segmentation of SMB matters as well as blocking it at the boundary.

What to do

Block 445 and 137 to 139 inbound and outbound at the perimeter — most internet service providers already filter them, but cloud security groups often do not. Where file access is needed remotely, route it over a VPN gateway or replace it with a purpose-built service rather than publishing the share. Internally, use network segmentation to limit which hosts may speak SMB to which, disable the obsolete SMBv1 dialect, and keep Windows and Samba patched.

Finding 445 open externally is usually a misconfigured cloud security group, a forgotten port-forwarding rule, or a host placed outside the firewall by accident — so the fix is often a rule change rather than a project.

Related concepts

See RDP, telnet and database exposure for other services that should stay off the public internet, plus port scanning, attack surface reduction and the KEV catalogue.