{"id":171720,"date":"2021-02-05T15:42:00","date_gmt":"2021-02-05T12:42:00","guid":{"rendered":"https:\/\/en.buradabiliyorum.com\/hackers-might-be-turning-your-plex-server-into-a-powerful-ddos-botnet-review-geek\/"},"modified":"2021-02-05T15:42:00","modified_gmt":"2021-02-05T12:42:00","slug":"hackers-might-be-turning-your-plex-server-into-a-powerful-ddos-botnet-review-geek","status":"publish","type":"post","link":"https:\/\/buradabiliyorum.com\/en\/hackers-might-be-turning-your-plex-server-into-a-powerful-ddos-botnet-review-geek\/","title":{"rendered":"#Hackers Might Be Turning Your Plex Server Into a Powerful DDOS Botnet \u2013 Review Geek"},"content":{"rendered":"

“#Hackers Might Be Turning Your Plex Server Into a Powerful DDOS Botnet \u2013 Review Geek”<\/strong><\/p>\n

\n
\"A
LuckyStep<\/a><\/span><\/figcaption><\/figure>\n

If you like the idea of creating your own \u201c<\/span>Netflix\u201d or \u201cSpotify\u201d from the many DVDs and CDs you have lying around, Plex is one of the best and most beautiful options you can choose. But, as security firm Netscout revealed, your Plex Media<\/a> Server may already be a tool<\/a> in the next powerful DDOS attack.<\/span><\/p>\n

A Distributed Denial of Service<\/a> (DDOS) attack works by flooding a site or service with traffic. The overwhelming surge can bring down a service unprepared to handle the wave of traffic. One of the main reasons DDOS attacks aren\u2019t more common than they already are is bad actors need the resources to send all that traffic.<\/span><\/p>\n

That\u2019s where Plex Media Servers come into play. Hackers are using vulnerable Plex Media Servers to amplify what would otherwise be a weak DDOS attack into a powerful DDOS attack. The idea isn\u2019t a new one: instead of sending the small amount of traffic bad actors can manage on their own directly at their final target, they direct it to vulnerable servers.<\/span><\/p>\n

When they send requests to the vulnerable server, it will respond with an answer. That\u2019s important because the \u201canswer\u201d often amounts to a larger amount of data than the original request. Hackers then trick the vulnerable server into sending that answer to the intended target\u2014that is, they make it seem as though the request originated from the site the hacker wants to bring down. Thus a small amount of traffic gets amplified into a huge amount of traffic, making the DDOS attack more powerful.<\/span><\/p>\n

According to Netscout, hackers have turned to looping Plex Media servers into this process. By default, when you set up a Plex Media Server, it uses the GDM (G\u2019Day Mate) protocol to discover other devices on your network compatible with Plex.<\/span><\/p>\n

During that scan, if it discovers your router has UPNP (Universal Plug and Play<\/a>) and SDDP (Service Discovery Protocol), it will automatically configure your router for remote access. That\u2019s a convenience factor that will let you watch your Plex content even when you\u2019re away from home.<\/span><\/p>\n

But unfortunately, that convenience doubles as a vulnerability\u2014it makes Plex servers a predictable target for the DDOS attack. The hacker sends a small request (about 52 bytes) over the port Plex created to your server. The server responds with a data packet around 281 bytes, nearly five as large as the originating attack.<\/span><\/p>\n

According to Netscout, it discovered evidence that hackers already took advantage of the vulnerability and have been since November. When the security firm scanned the internet, it found over 27,000 Plex Media Servers open for attack.<\/span><\/p>\n

We contacted Plex for comment but haven\u2019t heard back yet. Over at Plex\u2019s forums, an employee did respond to a thread<\/a> suggesting changing default port settings to mitigate the attack:<\/span><\/p>\n

We are aware of the reports and are investigating it closer. We where not made aware of this in advanced so we don\u2019t have more information than the rest of you right now. Changing ports might be a mitigation \u2013 but it\u2019s certainly security by obscurity. We will update the forums when we know more.<\/span><\/p>\n<\/blockquote>\n

According to the employee, Netscout didn\u2019t adequately disclose the information to Plex before publishing the report. And changing your default port might mitigate the problem, but hackers could likely adapt their attack to account for that action. Right now, the only viable solution is to disable SDDP on your router and remote play on your Plex Server. But you\u2019ll lose one of Plex\u2019s best features in the process.<\/span><\/p>\n

We\u2019ll update this post if we hear back from Plex about a permanent fix that maintains remote play features.<\/span><\/p>\n

Source: Netscout<\/a> via ZDNet<\/a><\/small>\n<\/div>\n