EDIT: plex released a fix to prevent this. Greetings to whom it may concern: Netscout (Arbor) has just published a blog post in which they show / explain / claim how SSDP on the WAN port of a Plex Media Server that uses uPNP/NAT-PNP to expose its port to the internet, can be used to reflect+ampli…

[image] sojab0on: i know there is a fix for this issue keeping pms updated to newest and indeed not setting things trough UPNP will help allot. If your server is not connected directly to the open internet, there is 0 need for a fix. Even the UPnP request of Plex doesn’t create a forwarding o…

[image] JuiceWSA: forwarding of a ‘Non-Standard’ public port Nearly useless, as your Internet IP is being port scanned multiple times a day by bad actors who can easily find that port. Just make sure you are only forwarding TCP and not UDP as well.

As stated by Otto, TCP-only port forwarding. TCP-only firewall rules Additionally: HTTPS - required connections. (lock it down) If you have NO ports open to the outside world , use Plex Relay (at most), there is nothing to fear. Get a good firewall. You want one which DROPs unsolicited…

Good read. Thank you. So, where’s the fault? UFW? Docker? Plex? Am I reading that correctly in that Plex was the victim here because of a combinatorial vulnerability in the Docker+UFW pair?

[image] jebrossard: Nearly useless, as your Internet IP is being port scanned multiple times a day by bad actors who can easily find that port. Just make sure you are only forwarding TCP and not UDP as well. According to this I have no worries as I meet NONE of conditions that would worry me: …

[image] JuiceWSA: [image] jebrossard: Nearly useless, as your Internet IP is being port scanned multiple times a day by bad actors who can easily find that port. Just make sure you are only forwarding TCP and not UDP as well. According to this I have no worries as I meet NONE of condition…

[image] bunklung: Where did you get this information? I edited my post to contain this Pinned Forum Announcement: [image] Security: Regarding SSDP Reflection/Amplification DDoS Announcements What is it? We recently became aware of an issue reported by security rese…

That having been said, Presume Plex in docker is vulnerable – IF – UDP is accessible from WAN. Plex does use UDP for discovery on the RFC-1918 subnet the server is on. Whose fault is that for opening up UDP ports and forwarding them? Where I’m going with this is: Whose responsibility is it f…

There will be a greater general understanding and agreement over time that users must become educated about network security and take full responsibility for everything they implement. This hasn’t even fully penetrated the enterprise space yet, though they’ve come a long way. Home users will take e…

[image] gbballpack: The point of concern I am specifically trying to raise is Docker in the default bridge mode + UFW/iptables for security, on machines at data centers. These machines would appear to be wide open to the world for the reflection attack. I agree with @ChuckPa ’s comment that th…

[image] Black-Dahlia: If it’s already being used in the wild, they did the right thing. Not true at all. It was a small percentage of hackers that knew this existed. Now they all know it exists and how easy it is to exploit. I can do it and I’m not THAT competent. They could’ve given PLEX a …

[FIX] PMS leveraged for amplified dDoS attack (SSDP)

Plex Media Server

JuiceWSA February 5, 2021, 10:03pm 60

I edited my post to contain this Pinned Forum Announcement:

Topic		Replies	Views
Plex opens random UDP port numbers that change with each restart, and I see UFW packet denies Plex Media Server server-linux	14	128	August 27, 2023
REPORT! SlyPlex General Discussions	49	138	January 7, 2020
Alert about Plex servers is flagged in my Google news alerts General Discussions	2	255	February 5, 2021
Security: Regarding SSDP Reflection/Amplification DDoS Announcements security-notices	0	15248	February 5, 2021
Docker mit Plex als 2. Instanz auf einem Server Deutsch - German	16	1489	May 11, 2019

[FIX] PMS leveraged for amplified dDoS attack (SSDP)

Related topics