WebUI code/media injection attack?

Server Version#: Version 1.42.2.10156
Player Version#: Version 4.160.0

When starting media, a plex logo-type thing displayed, which I disregarded, but after a few minutes, my media paused and plex web played a foreign sourced media on a timer. Plex web refused to play my local media until the timer expired.

I have a lifetime pass, streaming on the local network. Playing from google TV, no issues. When I play from the web-gui on Windows, weird ads are being injected midstream. I don’t have proxies or break/inspect configured, so the TLS connections should be good, browsers report no issues.

What tools should I run and information should I gather so this attacker can be traced and removed from the plex code?

Are you sure you weren’t watching ad-supported content from Plex? Similar to Why am I getting ads streaming my own content? - #2 by Azrayl

Hrm… That is possible? How do I tell? The show was in “Home” listed under “continue watching”; so I assume that means ‘continue your show’? but maybe it means ‘continue a show we feel like showing you’?

When I click on the show, it displays ‘Movies & Shows’ and ‘On Plex’ in the upper left, but clicking around in the … buttons in various places don’t give me any option to ‘play from’ or even describe the source. Is there a way to specify where to play from?

If I take the 15-click route to specifically select my library and show, it seems to play ok, so this is probably what you’re suggesting. It doesn’t have documentation of the behavior on the plex support site (at least not with a quick basic search).

grafik

“Movies & TV Shows” on Plex
does only exist on plex.tv.
It cannot be on your personal server, because that one doesn’t support movies and series in the same library.

If you un-pin the Movies & Shows library from your Home page, it will be no longer contributing content to the Continue Watching hub. https://support.plex.tv/articles/customizing-plex-web/

If you want to switch it off completely for all your clients, you can do so here: https://app.plex.tv/desktop/#!/settings/online-media-sources

it was already ‘unpinned’, but I did turn it off…

Apparently turning it off as a media source removed the ‘continue watching’ box? So I’m back to clicking through libraries to find where I was

Simply start watching something from your own libraries.
Ensure that these libraries have been favorited/pinned to the Home page.
https://support.plex.tv/articles/customizing-plex-web/
https://support.plex.tv/articles/manage-favorite-libraries/