Plex HACKED

[beeman]

Plex, a company mainly known for their versatile Media Server application, which even Linus uses at home, has been hacked, resulting in users panicking after their cloud-based instances became inaccessible while signing out. The company's website went down just mere hours after the first emails went out to customers, and has since left people manually claiming their servers. https://swizzin.ltd/applications/plex#manual-claiming instead of using the plex PIN and claim tokens to login to their apps. If you are using the LSIO or Hotio docker image, see these instructions https://info.linuxserver.io/issues/2022-08-24-plex/.

 

This hasn't been the first time that Plex has had issues like this, where authentication remains the central business they can't seem to just get it quite right. In June, the company also had issues with their API, leaving people unable to access their servers due to authentication being down. Hopefully this stops happening soon. This is the second breach that Plex has suffered, the last being in 2015, where their forum data was held for ransom and user credentials were not using strong salt.

 

Plex authentication continues to have issues, presumably due to their 4 digit pin system being overloaded with requests. Issues extend to both sign-ins and automated claims of servers. The password reset is not mandatory for users, but the company is pushing it to the community pretty hard.

 

The Email

Quote

Dear Plex User,

We want you to be aware of an incident involving your Plex account information yesterday. While we believe the actual impact of this incident is limited, we want to ensure you have the right information and tools to keep your account secure.

What happened

Yesterday, we discovered suspicious activity on one of our databases. We immediately began an investigation and it does appear that a third-party was able to access a limited subset of data that includes emails, usernames, and encrypted passwords. Even though all account passwords that could have been accessed were hashed and secured in accordance with best practices, out of an abundance of caution we are requiring all Plex accounts to have their password reset. Rest assured that credit card and other payment data are not stored on our servers at all and were not vulnerable in this incident.

What we're doing

We've already addressed the method that this third-party employed to gain access to the system, and we're doing additional reviews to ensure that the security of all of our systems is further hardened to prevent future incursions. While the account passwords were secured in accordance with best practices, we're requiring all Plex users to reset their password.

What you can do

Long story short, we kindly request that you reset your Plex account password immediately. When doing so, there's a checkbox to "Sign out connected devices after password change." This will additionally sign out all of your devices (including any Plex Media Server you own) and require you to sign back in with your new password. This is a headache, but we recommend doing so for increased security. We have created a support article with step-by-step instructions on how to reset your password here.

We'd also like to remind you that no one at Plex will ever reach out to you to ask for a password or credit card number over email. For further account protection, we also recommend enabling two-factor authentication on your Plex account if you haven't already done so.

Lastly, we sincerely apologize to you for any inconvenience this situation may cause. We take pride in our security system and want to assure you that we are doing everything we can to swiftly remedy this incident and prevent future incidents from occurring. We are all too aware that third-parties will continue to attempt to infiltrate IT infrastructures around the world, and rest assured we at Plex will never be complacent in hardening our security and defenses.

For step-by-step instructions on how to reset your password, visit: https://support.plex.tv/articles/account-requires-password-reset

Thank you, The Plex Security Team

 

Sources

https://status.plex.tv/history?page=1

https://www.theverge.com/2022/8/24/23319570/plex-security-breach-exposes-usernames-emails-passwords

https://www.engadget.com/plex-reset-passwords-potential-data-breach-082347517.html

https://www.xda-developers.com/plex-reveals-data-breach/

https://www.reddit.com/r/PleX/comments/wwb8uy/plex_breached_were_passwords_encrypted_or_hashed/

https://www.reddit.com/r/PleX/comments/wwcekh/ive_leveled_my_fair_share_of_criticism_against/

https://www.reddit.com/r/PleX/comments/wwf9oy/plex_down/

https://www.reddit.com/r/PleX/comments/wwchdc/changed_password_now_server_not_found/

https://www.reddit.com/r/PleX/comments/wwfjqm/how_to_reclaim_your_server_after_resetting_your/

https://www.reddit.com/r/PleX/comments/wwf5o9/plex_website_is_down_and_preventing_password/

https://www.reddit.com/r/PleX/comments/wwje5x/i_cant_claim_server_after_password_update/

Email Correspondance

 

Updates

Add hotio/lsio docker instructions

[linkboy]

I have 2FA enabled on my Plex account, so I'm just going to wait a bit to update my password (I haven't had any attempts to log into my account).

 

Their website is getting slammed right now.

[Arika]

wait, i thought PLEX was just a piece of software that you run on your own computer, not an internet connected service (unless you want to access your media outside of your house).

[Senzelian]

Just logged into my account, works just fine and got the email only a few minutes ago.

Will probably reset my password next weekend as I'm currently not at home and need my music for the drive home, otherwise I go crazy without music.

 

4 minutes ago, Arika S said:

wait, i thought PLEX was just a piece of software that you run on your own computer, not an internet connected service (unless you want to access your media outside of your house).

Yeah, but accessing your media outside your house is something almost everyone does. I use Plex instead of a music streaming service.

There is even a subscription that goes with it.

[Spotty]

7 minutes ago, Arika S said:

wait, i thought PLEX was just a piece of software that you run on your own computer, not an internet connected service (unless you want to access your media outside of your house).

Technically you don't need an account, but they do try to push it these days. Think of it like windows where you technically don't need a Microsoft account but they try to force it on you when you set it up.

If you're just streaming locally through a web browser I believe you can still access it directly that way without an account. If you're using the app version to access Plex on a smart TV I think it will require an account even if it's on the same local network.

 

https://support.plex.tv/articles/207538527-do-i-need-a-plex-account-to-stream-locally/

[ToboRobot]

Glad I picked Jellyfin!

[Arcomador]

10 minutes ago, Spotty said:

If you're just streaming locally through a web browser I believe you can still access it directly that way without an account. If you're using the app version to access Plex on a smart TV I think it will require an account even if it's on the same local network.

On some devices you can go to advanced settings and configure manual connection to a plex server on your own network via ip address/port.

[Arika]

29 minutes ago, Senzelian said:

Yeah, but accessing your media outside your house is something almost everyone does. I use Plex instead of a music streaming service.

There is even a subscription that goes with it

I meant "internet connected" by way of needing an account on a server you don't control. There's other services that allow you to stream from a home PC to a remote PC without needing to log into someone else's service to make the connection.

[Senzelian]

19 minutes ago, Arika S said:

I meant "internet connected" by way of needing an account on a server you don't control. There's other services that allow you to stream from a home PC to a remote PC without needing to log into someone else's service to make the connection.

Oh, well that's sorta what I meant too. The public Plex servers act basically as a tunnel to your Plex server at home. Sort of like a dynDNS.

It's the same basic principle that Synology uses aswell (I use Synology as an example because i have my Plex server running on my NAS)

[Middcore]

51 minutes ago, Senzelian said:

Yeah, but accessing your media outside your house is something almost everyone does.

I don't. 

[Senzelian]

2 minutes ago, Middcore said:

I don't. 

 

Do you not for example listen to music on the go or do you use a different streaming service or just not bother with one at all and listen to the radio?

[Middcore]

Just now, Senzelian said:

 

Do you not for example listen to music on the go or do you use a different streaming service or just not bother with one and listen to the radio?

 

B and C. 

 

I honestly didn't know anyone used Plex for music though. It's always been "your library of movies and TV that you definitely acquired through fully legal means" application to me. 

 

 

[CTR640]

Oh, Plex got hacked? Now I am perPlexed!

[Senzelian]

25 minutes ago, Middcore said:

B and C. 

 

I honestly didn't know anyone used Plex for music though. It's always been "your library of movies and TV that you definitely acquired through fully legal means" application to me. 

They even have an app specifically for music called Plexamp. It's really good!
After Google shut down Google Play Music I had to look for a seperate solution and since I already had a NAS, Plex was the best choice. Basically unlimited storage, I own the music and I get the best quality possible. 

But I'm also really oldschool as I still rip my own CDs with Exact Audio Copy.

[GuiltySpark_]

I just recently got rid of Plex after realizing Jellyfin offered hardware transcoding without having to pay a fee. Looks like I left just in time.

[WhitetailAni]

33 minutes ago, Senzelian said:

They even have an app specifically for music called Plexamp. It's really good!
After Google shut down Google Play Music I had to look for a seperate solution and since I already had a NAS, Plex was the best choice. Basically unlimited storage, I own the music and I get the best quality possible. 

But I'm also really oldschool as I still rip my own CDs with Exact Audio Copy.

I use the iOS default Music app on my iOS 7 5S, since usually I don't have any connection where I listen to music.

Love you 1990s concrete boxes!

[AnonymousGuy]

3 hours ago, Arcomador said:

On some devices you can go to advanced settings and configure manual connection to a plex server on your own network via ip address/port.

I wasn't able to get it to work with the browser version no matter what I tried in the server settings or account settings.  It always needed a login. 

Which sucked when the device I was trying to use had plex.tv blocked so I couldn't access my own media.

[BuckGup]

3 hours ago, Middcore said:

 

B and C. 

 

I honestly didn't know anyone used Plex for music though. It's always been "your library of movies and TV that you definitely acquired through fully legal means" application to me. 

 

 

I agree and ISPs get pissed when they see you streaming movies externally and if you fully legally acquired that movie they will send some fun letters in the mail. Personally if I was to stream externally it would only be with a VPN connection to that network

[Arcomador]

48 minutes ago, AnonymousGuy said:

I wasn't able to get it to work with the browser version no matter what I tried in the server settings or account settings.  It always needed a login. 

Which sucked when the device I was trying to use had plex.tv blocked so I couldn't access my own media.

I wasn't referring to the browser version, example the Xbox plex app you can skip sign in, go to advanced settings and establish a manual connection to a server using ip and port.

[GhostRoadieBL]

I was lucky enough to get the email later last night and swapped passwords, from the sounds of it I got lucky with timing compared to everyone dealing with it in the morning.

[Bad5ector]

One thing I'm not entirely clear on. I used my Google Account to 'single-sign on' to Plex, does this mean I need to change my Google account password? Or am I gucci?

 

From what I'm reading on this random Reddit page, I should be good? Shrug?

 

 

[AnonymousGuy]

2 hours ago, Arcomador said:

I wasn't referring to the browser version, example the Xbox plex app you can skip sign in, go to advanced settings and establish a manual connection to a server using ip and port.

Do you still need to sign in though to the server?  Like I have my plex server accessible on its own domain name from anywhere on the internet but ultimately it still wants the sign in through plex.tv:

 

 

(I think you're describing the plex.tv/authorize thing where you enter in a 4 digit code or whatever and it handshakes)

[SeriousDad69]

7 hours ago, ToboRobot said:

Glad I picked Jellyfin!

Me too lol, I cant imagine hosting my own media server to get away from Netflix and Disney, and then choosing the solution that requires you to register an account with them and charges you for basic shit like hardware transcoding and smartphone apps.

[Arcomador]

2 hours ago, AnonymousGuy said:

Do you still need to sign in though to the server?  Like I have my plex server accessible on its own domain name from anywhere on the internet but ultimately it still wants the sign in through plex.tv:

 

 

(I think you're describing the plex.tv/authorize thing where you enter in a 4 digit code or whatever and it handshakes)

Under advanced settings in the server you can specify a network/mask that can connect without authentication.

ie 10.2.5.0/24