Yet another Hacker News

Plex vulnerabilities being exploited in the wild to drop a cryptominer

60 points mindracer 4 hours ago 11 comments

2OEH8eoCRo0 2 hours ago | parent

Reddit discussion here: https://www.reddit.com/r/PleX/comments/1x95krg/inthewild_exp...

Affects an older version of Plex and was patched in August.

foobarian 1 hour ago | parent

> internet-facing Plex servers

This is terrifying. Who runs things like this open to the outside?

dewey 1 hour ago | parent

Many people, as your TV and sometimes friends have to connect to it and you don't want to explain Tailscale to them.

bigstrat2003 1 hour ago | parent

I do. I like to stream music from my server onto my phone when I'm out and about. And it's authenticated, so there's nothing terrifying about exposing it (security vulnerabilities aside, but that can happen to any software you expose).

benoau 1 hour ago | parent

You largely have to for Plex themselves to middleman access to your media collection.

symlinkk 47 minutes ago | parent

Plex themselves literally recommend it and show a warning icon if it’s not accessible outside your local network. I always thought it was insane. To make matters worse their Synology package doesn’t auto update itself. I would guess there are a ton of vulnerable boxes sitting out there.

iAMkenough 25 minutes ago | parent

If you’re exposing anything on Synology to the Internet, you’re already playing with fire. Their packages (like Container Manager) are usually very far behind on security patches.

I think the current version of Docker engine Synology uses was end-of-life 2.5 years ago.

chrisweekly 11 minutes ago | parent

Synology NAS - an ugly doorstop with data loss resulting from its half-baked post-purchase attempts to enforce hardware vendor lock-in. (Was working fine w/ a Western Digital drive, the next day, boom.)

blntechie 45 minutes ago | parent

I do run it open to the outside through cloudflare tunnels. I don't want to connect my TVs to tailscale every time to play a movie.

wolrah 1 minute ago | parent

> This is terrifying. Who runs things like this open to the outside?

Probably the majority of people with a Plex Pass subscription and most Plex users in general.

As far as I see it, Plex's primary purpose is to allow people who have extensive collections of legally obtained digital media to conveniently access it and share access to their friends and family on pretty much any random device from anywhere in the world.

All my home media devices run Kodi, they run Jellyfin, they run all sorts of fully open stuff, but when I travel Plex wins because it runs on basically anything that can stream video and I can sign in to it in seconds without needing to connect a VPN or enter my password on someone else's device.

xavdid 1 minute ago | parent

I got hit with a cryptominer on my mac mini the other day. I only noticed because I happened to sitting in the room with it and noticed the fans were working overtime. There was a process, "icloud-services", which was using 100% of the CPU. It's sort of an indictment of Apple that my first inclination was "they've got a bug that's got an infinite loop" instead of "this is malicious software".

After a reboot, I traced it back to a folder in `Library/Application Support` which included a `config.json` that mentioned gulf[.]moneroocean[.]stream, so I knew I'd been popped. Cleanup was easy enough (the files themselves, plus the launch daemon), but it's annoying.

I don't do dev work on that machine (it's really just for plex & stuff) so it must have been some sort of vulnerability in Plex (but not the one described in OP) or macOS itself. Interestingly, I was up to date on my Plex install, but my macOS version was behind what was apparently an important security update related to an RCE (Sequoia 15.8).