EDIT: plex released a fix to prevent this. Greetings to whom it may concern: Netscout (Arbor) has just published a blog post in which they show / explain / claim how SSDP on the WAN port of a Plex Media Server that uses uPNP/NAT-PNP to expose its port to the internet, can be used to reflect+ampli…

[image] sojab0on: i know there is a fix for this issue keeping pms updated to newest and indeed not setting things trough UPNP will help allot. If your server is not connected directly to the open internet, there is 0 need for a fix. Even the UPnP request of Plex doesn’t create a forwarding o…

My automatic public port isn’t 32400 for some reason, so am I good?

We have some really good engineers looking into this right now. As far as we can understand so far it’s not a huge issue for the individual user. But if you host it on a open network you might want to firewall the GDM port. We will update with our findings as soon as we have it.

[image] UndarkAido: My automatic public port isn’t 32400 for some reason, so am I good? Same. My open ports that Plex automatically opened publicly are 21640 13468 26216 All forward to 32400 so presumably I’m Ok?

I am attempted to say “yes”, but let’s wait for the results of the internal investigation.

Plex Media servers are being abused for DDoS attacks | ZDNet The problem comes when a Plex Media Server discovers a local router that has SSDP support enabled. When this happens, the Plex Media Server will add a NAT forwarding rule to the router, exposing its Plex Media SSDP (PMSSDP) service direc…

The verdict is in: [image] Security: Regarding SSDP Reflection/Amplification DDoS Announcements What is it? We recently became aware of an issue reported by security researchers . It was not disclosed to us prior to the publication. It describes an issue in which Plex Medi…

Docker has zero influence on the matter, if your server is running inside a private network (and you haven’t exposed it either via DMZ). Because the relevant firewall then is in your router. And Docker cannot override this. Just make sure that your port forwarding rule is only forwarding the main …

[image] JuiceWSA: forwarding of a ‘Non-Standard’ public port Nearly useless, as your Internet IP is being port scanned multiple times a day by bad actors who can easily find that port. Just make sure you are only forwarding TCP and not UDP as well.

As stated by Otto, TCP-only port forwarding. TCP-only firewall rules Additionally: HTTPS - required connections. (lock it down) If you have NO ports open to the outside world , use Plex Relay (at most), there is nothing to fear. Get a good firewall. You want one which DROPs unsolicited…

Good read. Thank you. So, where’s the fault? UFW? Docker? Plex? Am I reading that correctly in that Plex was the victim here because of a combinatorial vulnerability in the Docker+UFW pair?

[FIX] PMS leveraged for amplified dDoS attack (SSDP)

Plex Media Server

OttoKerner February 5, 2021, 8:22pm 45

The verdict is in:

Topic		Replies	Views
Plex opens random UDP port numbers that change with each restart, and I see UFW packet denies Plex Media Server server-linux	14	128	August 27, 2023
REPORT! SlyPlex General Discussions	49	138	January 7, 2020
Alert about Plex servers is flagged in my Google news alerts General Discussions	2	255	February 5, 2021
Security: Regarding SSDP Reflection/Amplification DDoS Announcements security-notices	0	15248	February 5, 2021
Docker mit Plex als 2. Instanz auf einem Server Deutsch - German	16	1489	May 11, 2019

[FIX] PMS leveraged for amplified dDoS attack (SSDP)

Related topics