Account Hack?

Plex Media Server
1

Server Version#: 1.42.2.10156
Player Version#: N/A

A random new Managed User account name showed up on my Home Screen moments ago that I am absolutely certain I did not add. Assuming someone was able to log into my server to create the new Managed User although I’m unsure how, and I’m pretty sure this happened at some point today.

I have changed my password and logged out of all devices as a precaution and have reclaimed the server. I’ve had 2FA enabled for quite some time, so I’m not sure how this could have occurred?

Am I safe for now, or are there any other actions I can or should take?

2

Maybe contact your ISP and ask for a new IP address?

1 Like
3

@AmazingRando24

What are your SSH command line skills like?

In the interim, Stop Plex while we sort through this.

1 Like
4

@AmazingRando24

Check your PM. Sent you a message there.

5

I’m competent enough to muddle my way through, but nowhere near an expert. I will respond to the PM, now.

6

To follow up… I think this falls into an interesting and semi-unique circumstances.

  • My Daughter has her own Plex account.
  • She lives in Minnesota, I live in Missouri.
  • I have her added to my Home Screen.
    • She can access local stations this way in Minnesota.
    • When she visits home she can watch her stuff without mucking my history.
  • Unfortunately she leaves herself logged in at friends houses on occasion. (bad Daughter)

Recently I decided to let a friend of hers have access to my Server. I require everyone to have their own accounts and I only allow them a single stream each. This new user got confused and as he was trying to “log in” he got her home screen, which includes me, and has a nice little “+” button to add a new Managed User account… which he did using his nickname, that I have never once ever heard anyone call him.

So… mystery solved… BUT… I do find it odd that a non server owner account can add Managed Users to my PMS in this way. Not something I think they should be able to do.

7

Look in the permissions.

Somewhere you’ve given her permission to add.

She should have viewing permission only. She should not be able to ADD anyone. That’s for you alone.

8

Digging in, I don’t see a setting that disables the Add User button in Home Screen settings (which I would happily disable if I could).

Also, looking at any setting for her account that I can find, either from the Home Screen settings, or for her individual account… I can’t find anything related to what she can and can’t do on her Home Screen.

I shall keep digging, but it’s not in the two places I would suspect. Will report back if I need to eat humble pie.