Server Message Block

Yeah, you're right.

I think you've got the option to just access the files over SMB on the clients or have the Jellyfin server access them over SMB and serve them out, right?

Yeah.

I would, Belt and Braces it, personally, I'd kind of set both up.

But when it comes to the Azure AD Entra project specifically, They had a bunch of old Dell T320s or whatever they were, all running Windows Server 2012.

And the options were, do we do that CapEx of $30,000 or $40,000, get a bunch of servers, buy all the device CALs, user CALs, whatever, Or do we take the three softwares that run, which was like a licensing server for their GIS program, a backup script for their cloud storage, because they had already migrated everything from SMB to something called Lucid Blank.

which is mainly for creatives.

They have a Premiere Pro plug-in.

So then I go into threading, and then four threads, and then eight threads, and then large files.

So I'm going back and forth doing SMB, multi-channel connection.

Are

you telling AI, go figure out how to make it faster?

It took me four hours and then I kicked it off overnight.

I did a bunch of fails.

I learned about SMB multi-channel connection.

My old NAS has four 1 gig ports and my new NAS has one 10 gig port.

Because once the attacker was in, they used a valid domain account that they compromised.

Then they created their own local administrator account on the device And they granted themselves every single permission to use SMB, FTP.

Now they transfer their tools over FTP, SSH.

They escalated to root.

There should just be basic networking guides for MISTER.

I think you still would need a CIFS share thing, but just check that out.

But I think you might be asking, can you share files between MISTERs? And I believe that's theoretically possible, but I don't know how that would perform.

And I don't know if that's the best way to go about it.

Reduce the blast, right? Yeah.

yeah well and they're gonna try to get out they're gonna try and make some SMB connections am I alarming on that I better be right so yeah yeah yeah

I

think it's just table stakes right for compensating controls at this point yeah so yeah yeah last words on your son

FireAnt was using that Linux box to run repeated connection attempts and port probing against connected networks.

They were looking for SSH, HTTP, SMB, and RDP access.

They were mapping the internal environment.

And you know, Signia noted something pretty profound in their analysis of this behavior.