Mysterious Samba

Topic

New Reply

I have a network of 5 computers all running Win10. Two days ago, a device labelled “Samba” showed up in the network. It couldn’t be accessed but was visible from at least two different machines. As far as I’m aware, I did nothing to create it. If my research is correct, it’s for connecting Ubuntu machines into the network, of which I have none. Today it’s gone. There was a Win 10 update about 4 days ago. Should I be worried about this? TIA

Reply | Quote

Replies

About 3 years ago, there were vulnerabilities discovered in Samba, which resulted in a topic on the subject. From there:

Kirsty wrote:

Samba is a software package for UNIX systems that provides file and printer sharing services via the SMB and CIFS protocols. Samba allows Linux, Mac, FreeBSD users to set up shared folders and access shared folders on Windows computers, acting as a liaison between the UNIX and Windows SMB protocol implementations.

From samba.org:

Samba is the standard Windows interoperability suite of programs for Linux and Unix.

Since 1992, Samba has provided secure, stable and fast file and print services for all clients using the SMB/CIFS protocol, such as all versions of DOS and Windows, OS/2, Linux and many others.

Samba is an important component to seamlessly integrate Linux/Unix Servers and Desktops into Active Directory environments. It can function both as a domain controller or as a regular domain member.

Samba is a software package that gives network administrators flexibility and freedom in terms of setup, configuration, and choice of systems and equipment. Because of all that it offers, Samba has grown in popularity, and continues to do so, every year since its release in 1992.

1 user thanked author for this post.

Alan Fitch

Reply | Quote

Alan Fitch wrote:

Two days ago, a device labelled “Samba” showed up in the network. It couldn’t be accessed but was visible from at least two different machines. As far as I’m aware, I did nothing to create it.

So… What else is there in the network?

A number of consumer-grade routers run Samba. As in probably most of the models with functionality to attach an USB storage device or printer and share that into the inside network.

Other things that I’ve seen run Samba would include media set-top boxes, smart TVs… air conditioning devices… surveillance cameras… LAN-enabled printers…

Actually there isn’t much out there nowadays that can attach to a network and couldn’t run Samba. It could run on a fairly low-end computer back in 1992, after all.

If you happened to get an automatic update that accidentally turned it on (with nothing shared so not actually accessible) and then another to fix that, well, yes… so please check the router logs at least?

(Hm, I’m fairly sure that I’ve seen a LAN-enabled printer model with USB-A and sdcard slots turn on Samba if you connected USB storage or inserted a sdcard…)

If you had no additional devices connected that you know of, then yes, there might be reason to worry.

Reply | Quote

As Kirsty’s message said, Samba is used by many Linux and Unix systems to communicate with Windows networks, not just Ubuntu.

Do you have the WSL (Windows subsystem for Linux) set up? Perhaps that is where the Samba thing came from. If so, there’s no harm to it being there, and if it’s gone now, perhaps MS fixed whatever made it appear.

Dell XPS 13/9310, i5-1135G7/16GB, KDE Neon 6.2
XPG Xenia 15, i7-9750H/32GB & GTX1660ti, Kubuntu 24.04
Acer Swift Go 14, i5-1335U/16GB, Kubuntu 24.04 (and Win 11)

Reply | Quote

Thanks for the reply. No, I do not have WSL set up, at least not intentionally. I do also have a NAS on the network that’s been working flawlessly for at least 6 years now. What I’m a wee bit concerned about is whether or not this could be an outside incursion into my system. I’ve found nothing to support that, but nothing to eliminate it either. Any insights would be appreciated.

Reply | Quote

Many (most?) routers are Linux-based so it’s conceivable this may have been a Samba share, especially if your router has a USB port for file/printer sharing.

Reply | Quote

At the last place I worked, I had a device that kept showing up on our internal private network (we had a public network too). We were very worried about this device as we knew every device that was on the network and this one would show up one day, be missing for a week then show up again out of the blue…

Turned out the Owner of the company had a TV installed in his office and hooked up to the network for some reason with out me knowing… It turned out the reason it was so sporadic was that he was not always in his office and would be gone for a week at a time…

Anyway, its probably something simple like your router or android phone…?

Reply | Quote

Also see https://en.wikipedia.org/wiki/Samba_TV which is a, well basically spying app on TVs . To serve you better of course.

Just because you don't know where you are going doesn't mean any road will get you there.

Reply | Quote