IMPORTANT: Stop forwarding your LMS ports to the internet!

[pippin]

And that's an especially bad idea in this case because it's so easy to log the clear-text username and password from LMS...

[Squeezemenicely]

I had that problem, where my music player suddenly went whild in the middle of the night, I had forwarded my LMS ports to the internet. Now I use VPN and no problems at all anymore.
Shame, it was practical to use LMS on the road that way, but simply to unsafe.

Absolutely block those ports, this sort of thing does happen!

[drmatt]

I wonder if anyone has searched the darkwebs for LMS attacks..? There are probably "slurp all the music and set some annoying alarms" scripts out there.

[oyvindo]

You don't need a script for that. All you need is the IP.

[drmatt]

You do, you know the control protocol. The script kiddies know nothing, they just run scripts.

[SamS]

I've been doing this for years (mainly for iPeng playback), with no ill effects. I was using strong password. However, reading the recommendations, I just turned it off. Exactly how is an plain-text password compromised in this scenario?

I get the same functionality by installing the Plex iOS app, and my lifetime Plexpass subscription.

[Mnyb]

I've been doing this for years (mainly for iPeng playback), with no ill effects. I was using strong password. However, reading the recommendations, I just turned it off. Exactly how is an plain-text password compromised in this scenario?

I get the same functionality by installing the Plex iOS app, and my lifetime Plexpass subscription.

Exactly as i says ,its sent as plain text from for example a browser on your phone to your server . To be intercepted by who knows.
And the security in LMS is not the strongest kind anyhow...

[jo-wie]

Quick search for LMS

Please do not ALL disable it, I need some bad examples for security awareness trainings. (Sorry, only kidding)

[mherger]

IMPORTANT: Stop forwarding your LMS ports to theinternet!

> Please do not ALL disable it, I need some bad examples for security
> awareness trainings. (Sorry, only kidding)

Are you searching for LMS? Ugh... that's even worse than Squeezebox...

--

Michael

[jo-wie]

> Please do not ALL disable it, I need some bad examples for security
> awareness trainings. (Sorry, only kidding)

Are you searching for LMS? Ugh... that's even worse than Squeezebox...

--

Michael

The interesting point is, that I have the feeling that the number was falling the last months but now is raising again. I was really using it as bad example for trainings and so I had several times a look at. But maybe the search engine simply found more because it was scanning further areas.

[mherger]

IMPORTANT: Stop forwarding your LMS ports to theinternet!

> The interesting point is, that I have the feeling that the number was
> falling the last months but now is raising again.

Interesting indeed: I've been monitoring "squeezebox" rather than LMS.
But numbers seemed to grow in the past weeks, and significantly dropped
over the past few days (-15%).

I was wondering how I should handle this situation. These users have a
serious security issue they should know about. But am I allowed to
"hack" their system in order to protect themselves from the bad hacker?

--

Michael

[Jeff07971]

> The interesting point is, that I have the feeling that the number was
> falling the last months but now is raising again.

Interesting indeed: I've been monitoring "squeezebox" rather than LMS.
But numbers seemed to grow in the past weeks, and significantly dropped
over the past few days (-15%).

I was wondering how I should handle this situation. These users have a
serious security issue they should know about. But am I allowed to
"hack" their system in order to protect themselves from the bad hacker?

--

Michael

I'm afraid the simple answer is NO it would be extremely unwise !! If you "hacked" (not sure if thats even the right term as these systems are wide open) I'm very sure it would be seen as illeagal in many countries.

A large and sticky warning on the home page of the forums would be wiser.

Whilst the situation is quite serious I see noting that can really be done about it, if the "hacks" are just waking people up at obscene hours hopefully a message in the forums will get more attention.

I note that there are a lot of v7.9.0 and more than a few v7.9.1 in the list of open LMS's meaning people update (or is done automatically) so a software change may work to help.
I was thinking that not responding (unless specifically allowed) to the router address (or gateway) may work. That way those that use VPN can turn it on but those who forward ports will have to come to the forum to ask why their forwarding no longer works.

Edit: Nothing much can be done about the 7.7.5's

Jeff

[Jeff07971]

Hi Michael

Another idea !

Use a list generated by THAT search engine to grab a list of open LMS's and automatically sent a command to turn all player on and stream a file from Logitech saying something like "This system is compromised please see article on forum" repeatedly until stopped.

This idea is more agressive and would need to be run by legal but may have a better effect

Jeff

[Paul Webster]

You could change LMS to require a password if the IP address is not local and have a maximum number of password attempts before suspending such access for X hours - and a setting to disable all of this for someone who really insists on taking the risk.
At least those users who have auto-update enabled would have a bit better protection.

[mherger]

IMPORTANT: Stop forwarding your LMS ports to theinternet!

> A large and sticky warning on the home page of the forums would be
> wiser.

Unfortunately only a very small percentage of the SB community is
regularly visiting these forums. Even I wouldn't get to see that message!

> I note that there are a lot of v7.9.0 and more than a few v7.9.1 in the
> list of open LMS's meaning people update (or is done automatically) so a
> software change may work to help.

Interesting. In my list there are far more 7.7.x installations than
7.9.x. And many are really old, like 7.7.2/3.

> Use a list generated by THAT search engine to grab a list of open LMS's
> and automatically sent a command to turn all player on and stream a file
> from Logitech saying something like "This system is compromised please
> see article on forum" repeatedly until stopped.

This is about as far as my "hacking" would go: interact with LMS.

--

Michael