The IT Nerd

I posted a guest post yesterday that media streaming platform Plex is warning customers to reset passwords after suffering a data breach in which a hacker was able to steal customer authentication data from one of its databases. Related to this, Martin Jartelius, CTO at Outpost24, provided the following comment:

“In situations like this, the safest approach is to automatically invalidate all user passwords and force a reset. While this prioritizes security and privacy over usability and business convenience, it’s often the best way to minimize risk.

The biggest concern is for people who reuse the same password across multiple sites. Even if Plex passwords were securely hashed, weak or reused credentials may eventually be cracked and then exploited in password spraying attacks elsewhere. Users should not only reset their Plex password but also change it anywhere else it may have been used.”

Consider this a today a today problem. If you have a Plex account, you should take measure to protect yourself now.

If you run Plex Media Server, you should update all the things as per this warning from Plex themselves:

We recently received a report via our bug bounty program that there was a potential security issue affecting PMS versions 1.41.7.x to 1.42.0.x. Thanks to that user, we were able to address the issue and continue to improve our security and defenses.

We strongly recommend that everyone have their PMS updated to the most recent version as soon as possible, if you have not already done so.

The new version, 1.42.1, is now available to update through the PMS management page or you can download it here: https://www.plex.tv/media-server-downloads/

Plex hasn’t shared any details regarding the vulnerability. But it’s a safe bet that threat actors are revers engineering what has been patched in order to pwn anyone who hasn’t updated.

Kudos to the white hat hacker, which is another way of saying that he or she is a hacker that is on the light side of the force, for bringing this to the attention of Plex instead of going over to the dark side.