Skip to main content

Wolfcore Cyber Security

Try our phishing simulations free for 14 days. Start free trial →
Get Started

Port 445 (SMB): what it is, how it is attacked and how to secure it

Category hub: Ports, protocols and services

In one sentence: Port 445 is the network door for Windows file sharing and should never face the internet, because one unpatched flaw in it once let ransomware spread worldwide.

What runs on this port

Port 445 carries SMB, Server Message Block, the protocol Windows uses for file shares, shared printers and much internal admin traffic. NAS devices and Linux file servers using Samba use it too.

Inside an office network SMB is normal. Across the internet it should not be reachable. The older NetBIOS ports, UDP 137 and 138 and TCP 139, belong to the same family.

Why attackers look for it

If port 445 answers, a Windows or file-sharing machine sits behind it. Attackers scan for it from the internet, and again from inside any network they reach, to find the next machine. CISA’s WannaCry indicators describe the malware doing this. It built a list of local IP ranges, tried UDP 137 and 138 and TCP 139 and 445, and if 445 answered it tried to spread using the SMBv1 flaw.

How it gets attacked

  • Unpatched SMB flaws. The famous one is MS17-010, which includes CVE-2017-0144, known as EternalBlue.
  • Old SMBv1 left switched on.
  • Weak or reused passwords on shares.
  • Over-wide shares that every user can read.
  • Credential relaying inside the network when SMB signing is not required.

WannaCry spread in May 2017 using the SMB flaw patched in Microsoft bulletin MS17-010. NHS England Digital said it used the EternalBlue and DoublePulsar methods. Microsoft released the update on 14 March 2017, and CISA noted patches for older systems followed on 13 May.

Who it affects and how badly

  • Sole trader to 10 staff. A NAS or shared PC with port 445 forwarded is the typical mistake. Worst case: encrypted files and backups on the same share.
  • 10 to 250 staff. Flat networks let ransomware move between file servers fast. Schools, care providers, manufacturers and trades firms can lose a week.
  • 250 plus and regulated firms. The National Audit Office found WannaCry affected NHS services from 12 to 19 May 2017 and infected 595 GP practices. Before the attack NHS Digital had assessed 88 of 236 trusts on site and none had passed.

How to check whether yours is exposed

  1. Check the firewall and router for any inbound rule on TCP 445 or 139, or UDP 137 and 138.
  2. List which machines run SMB shares and who can reach them.
  3. Confirm the MS17-010 update is installed everywhere and SMBv1 is off.
  4. Review shared folders and who has access.

How to secure it

  1. Block ports 445, 139, 137 and 138 at the internet boundary. CISA advised this where the patch could not be applied at once.
  2. Apply Windows security updates, including MS17-010, and replace unsupported systems.
  3. Turn off SMBv1.
  4. Segment the network so a file server cannot be reached from every PC.
  5. Require SMB signing where your systems support it.
  6. Give users only the share access they need.
  7. Use strong unique passwords and MFA on admin accounts.
  8. Keep offline backups, tested regularly.

Related terms

FAQ

Should port 445 be open to the internet?
No. CISA advised blocking it at the boundary, noting this may obstruct shared files, so weigh the disruption.

What was EternalBlue?
The method that exploited CVE-2017-0144, an SMBv1 flaw fixed in Microsoft bulletin MS17-010, which WannaCry used to spread.

How much of the NHS did WannaCry hit?
The National Audit Office reports that 595 GP practices were infected and services were affected from 12 to 19 May 2017.

Sources

How Wolfcore helps

A Wolfcore penetration test finds this the way an attacker would, by hand, not with a scanner. Start with the free web vulnerability scan.