SMBv1 vs SMBv2

[nikkoaki]

I'm sorry if these questions were already answered, i browsed a bit but couldn't find what i really want to know.

I have a rather slow USB flash drive connected to the router.. either that or it's the router's fault because the cpu sticks to 100% when writing (at around 8.5MB/s) and 90% when reading (around 12MB/s).. anyway, using SMBv1 or SMBv2 get's me the same speeds and the same cpu utilization.

What i really wanted to know is if my network is really compromised if i instead used SMBv1 and why? Assuming that i trust every device in my network, is it still at risk? And what's exactly at risk, the router itself? Doesn't firmware 380.66_4 mitigate this by fixing CVE-2017-7494?

Also, every time i upload something to the same USB flash drive, the router's ram usage increases from 15% to 75% and will never drop again unless i reboot, is this normal?

Thanks in advance.

 

[ColinTaylor]

I have a rather slow USB flash drive connected to the router.. either that or it's the router's fault because the cpu sticks to 100% when writing (at around 8.5MB/s) and 90% when reading (around 12MB/s).. anyway, using SMBv1 or SMBv2 get's me the same speeds and the same cpu utilization.

That sounds about right for a USB flash drive. Plug it into a PC and try copying some files to see if the speeds are the same.

What i really wanted to know is if my network is really compromised if i instead used SMBv1 and why? Assuming that i trust every device in my network, is it still at risk? And what's exactly at risk, the router itself? Doesn't firmware 380.66_4 mitigate this by fixing CVE-2017-7494?

That's a tricky one to answer. SMBv1 has some fundamental security design issues (according to Microsoft). I think that there's a belief that it's only a matter of time until another SMBv1 vulnerability is discovered and exploited.

Also, every time i upload something to the same USB flash drive, the router's ram usage increases from 15% to 75% and will never drop again unless i reboot, is this normal?

Yes that's normal. It's working as designed.

 

[Marko Polo]

Assuming that i trust every device in my network, is it still at risk?

It is. Just read BleepingComputer a bit and you will be overwhelmed how much people got infected by ransomware just by copying files over LAN where they "trusted every device".
I was infected in my LAN: it happened with Win8 machine, but Win10 left untouched. Your vulnerability level is a complex set of small and big security factors, but SMB version matters.

 

[nikkoaki]

Ok guys, thanks.
I don't mind running in SMBv2 since it doesn't give me worse performance with that particular USB flash drive, i was just trying to understand how the malware worked. I also just disabled SMBv1 on my machines for added protection.