Unrestricted netbios access remediation

Using Console

To remediate the “Unrestricted Netbios Access Should Not Be Allowed” misconfiguration in AWS using the AWS console, you can follow these steps:

Log in to your AWS Management Console.
Go to the Amazon VPC dashboard.
Click on “Security Groups” from the left-hand menu.
Select the security group that has unrestricted NetBIOS access.
Click on the “Inbound Rules” tab.
Locate the rule that allows unrestricted NetBIOS access (usually port 137-139).
Click on the “Edit” button next to the rule.
Change the source IP address to a specific IP address or range of IP addresses that should be allowed to access NetBIOS.
Click on the “Save” button to save the changes.

By following these steps, you have successfully remediated the “Unrestricted Netbios Access Should Not Be Allowed” misconfiguration in AWS.

Using CLI

To remediate the unrestricted NetBIOS access issue in AWS using AWS CLI, follow these steps:

Open the AWS CLI and run the following command to list all the security groups in your AWS account:
aws ec2 describe-security-groups
Identify the security group that has unrestricted NetBIOS access.
Run the following command to revoke the inbound rule that allows unrestricted NetBIOS access:
aws ec2 revoke-security-group-ingress --group-id <security-group-id> --protocol tcp --port 139 --cidr 0.0.0.0/0
Note: Replace <security-group-id> with the ID of the security group that you identified in step 2.
Run the following command to revoke the inbound rule that allows unrestricted NetBIOS access:
aws ec2 revoke-security-group-ingress --group-id <security-group-id> --protocol tcp --port 445 --cidr 0.0.0.0/0
Note: Replace <security-group-id> with the ID of the security group that you identified in step 2.
Verify that the inbound rules have been revoked by running the following command:
aws ec2 describe-security-groups --group-ids <security-group-id>
Note: Replace <security-group-id> with the ID of the security group that you identified in step 2.
Repeat steps 3-5 for all the security groups in your AWS account that have unrestricted NetBIOS access.
Once you have revoked the inbound rules for all the security groups, the unrestricted NetBIOS access issue will be remediated.

Using Python

To remediate the “Unrestricted Netbios Access Should Not Be Allowed” misconfiguration for AWS using python, you can follow these steps:

Import the necessary AWS SDK and modules in your python script.

import boto3
from botocore.exceptions import ClientError

Create an AWS client for EC2 service.

ec2 = boto3.client('ec2')

Get a list of all the security groups in your AWS account.

response = ec2.describe_security_groups()
security_groups = response['SecurityGroups']

Loop through each security group and check if it has unrestricted NetBIOS access. To do this, check if any of the inbound rules of the security group has the protocol set to “UDP” or “TCP”, the port range set to “137-139”, and the source IP range set to “0.0.0.0/0” or ”::/0”.

for sg in security_groups:
    for rule in sg['IpPermissions']:
        if rule['IpProtocol'] in ['tcp', 'udp'] and rule['FromPort'] <= 139 and rule['ToPort'] >= 137:
            for ip_range in rule['IpRanges']:
                if ip_range['CidrIp'] in ['0.0.0.0/0', '::/0']:
                    print(f"Security group {sg['GroupId']} allows unrestricted NetBIOS access.")

If you find any security group that has unrestricted NetBIOS access, remove the offending inbound rule from the security group using the revoke_security_group_ingress() method of the AWS EC2 client. You will need to provide the security group ID, the protocol, the port range, and the source IP range of the offending rule as parameters to this method.

try:
    ec2.revoke_security_group_ingress(
        GroupId=sg['GroupId'],
        IpPermissions=[
            {
                'IpProtocol': rule['IpProtocol'],
                'FromPort': rule['FromPort'],
                'ToPort': rule['ToPort'],
                'IpRanges': [
                    {
                        'CidrIp': ip_range['CidrIp']
                    }
                ]
            }
        ]
    )
    print(f"Removed unrestricted NetBIOS access from security group {sg['GroupId']}.")
except ClientError as e:
    print(f"Error removing unrestricted NetBIOS access from security group {sg['GroupId']}: {e}")

After removing the offending rule, you can verify that the security group no longer allows unrestricted NetBIOS access by repeating step 4.

Note: Make sure you have the necessary permissions to modify security groups in your AWS account.

Using Terraform

resource "aws_security_group" "NETBIOS_SAFE_SG" {
  name        = "netbios-safe-sg"
  description = "Example SG with no unrestricted NetBIOS access"
  vpc_id      = AWS_VPC_ID  # replace with your VPC ID

  # EXAMPLE: some allowed ingress (HTTP) kept for context
  ingress {
    description = "HTTP from anywhere"
    from_port   = 80
    to_port     = 80
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
    ipv6_cidr_blocks = ["::/0"]
  }

  # IMPORTANT: DO NOT define any of the following rules:
  # - TCP 139 from 0.0.0.0/0 or ::/0
  # - UDP 137 from 0.0.0.0/0 or ::/0
  # - UDP 138 from 0.0.0.0/0 or ::/0

  # If NetBIOS is still required, scope it to a trusted range instead, e.g.:
  # ingress {
  #   description = "NetBIOS Session Service from trusted IPv4 range"
  #   from_port   = 139
  #   to_port     = 139
  #   protocol    = "tcp"
  #   cidr_blocks = ["YOUR_TRUSTED_IPV4_CIDR"]  # e.g. "203.0.113.0/24"
  # }
  #
  # ingress {
  #   description = "NetBIOS Name Service from trusted IPv6 range"
  #   from_port        = 137
  #   to_port          = 137
  #   protocol         = "udp"
  #   ipv6_cidr_blocks = ["YOUR_TRUSTED_IPV6_CIDR"]  # e.g. "2001:db8::/64"
  # }

  egress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
    ipv6_cidr_blocks = ["::/0"]
  }

  tags = {
    Name = "NETBIOS_SAFE_SG"
  }
}

If your existing aws_security_group currently has ingress rules with cidr_blocks = ["0.0.0.0/0"] or ipv6_cidr_blocks = ["::/0"] for TCP 139 or UDP 137/138, delete those specific ingress {} blocks (or narrow their CIDRs as shown). This mirrors the CLI revoke-security-group-ingress by permanently removing those inbound rules; the security group itself is not replaced, only its rules change, but loss of those ports may impact any workloads relying on them.Verification: terraform plan should show the security group being updated with the offending ingress rules removed (or modified to trusted CIDRs), and no new rules for TCP 139 / UDP 137 / UDP 138 open to 0.0.0.0/0 or ::/0.

AWS Introduction

AWS Pricing

AWS Threats

AWS Misconfigurations

Unrestricted netbios access remediation

Triage and Remediation

Remediation

​Triage and Remediation

​Remediation

​

Triage and Remediation

Remediation