I got hit with a cryptominer on my mac mini the other day. I only noticed because I happened to sitting in the room with it and noticed the fans were working overtime. There was a process, "icloud-services", which was using 100% of the CPU. It's sort of an indictment of Apple that my first inclination was "they've got a bug that's got an infinite loop" instead of "this is malicious software".
After a reboot, I traced it back to a folder in `Library/Application Support` which included a `config.json` that mentioned gulf[.]moneroocean[.]stream, so I knew I'd been popped. Cleanup was easy enough (the files themselves, plus the launch daemon), but it's annoying.
I don't do dev work on that machine (it's really just for plex & stuff) so it must have been some sort of vulnerability in Plex (but not the one described in OP) or macOS itself. Interestingly, I was up to date on my Plex install, but my macOS version was behind what was apparently an important security update related to an RCE (Sequoia 15.8).
> This is terrifying. Who runs things like this open to the outside?
Probably the majority of people with a Plex Pass subscription and most Plex users in general.
As far as I see it, Plex's primary purpose is to allow people who have extensive collections of legally obtained digital media to conveniently access it and share access to their friends and family on pretty much any random device from anywhere in the world.
All my home media devices run Kodi, they run Jellyfin, they run all sorts of fully open stuff, but when I travel Plex wins because it runs on basically anything that can stream video and I can sign in to it in seconds without needing to connect a VPN or enter my password on someone else's device.
Plex in particular is notoriously insecure. It should never be accessible to the open internet unless via a vpn like WireGuard. Just playing with fire otherwise.
Almost all selfhosted services are in that bucket now. Everything from Plex, Jellyfin, to nextcloud or gitea/forgejo. Few months ago I went through all my setup and moved everything to a vpn. The only service I kept public is a static directory served by nginx where I keep some html food recipes I shared with a friend before.
It's less convenient to use and pretty much impossible to share with others. I can figure out a VPN on all my devices for the most part (except for a Boox ereader). Trying to get "family and friends" to install and maintain a VPN on their devices to be able to access services I share with them is a pipe dream.
That may be true, but how do you grant non-technical family/friends access? They don't even understand what a VPN is, let alone how to toggle one on/off to access the Jellyfin instance.
Additionally, if they try to connect from an Android TV / Fire Stick, where you can't configure a VPN (and use their ISP's modem, so no wireguard client on the router to transparently route to the subnet), what are you supposed to do?
I feel it may be easier long-term to just contain the Jellyfin daemon to only r/o access to media, putting it behind a subdomain like jellyfin.example.com, and use the dns-01 challenge via LE to only provision a wildcard cert for the domain (IE *.example.com).
Then, have nginx listen on 80/443 with a default server directive that returns 444 for any requests not to the (correct) jellyfin hostname (due to bots hammering 80/443 across the internet on webserver's direct IPs).
Its the only solution I can think of to make it easy for nontechnical users (everything just described is completely invisible to a regular client) while reducing the attack surface area of the daemon.
FWIW, with the aforementioned setup, I got 0 unauthorized requests to my jellyfin server. Just a bunch of bots hammering my IP's 80/443 ports directly with exploits for old (usually wordpress) vulns, but they were all served 444 (IE an immediate TCP connection close without nginx even responding to the request).
Did you miss the point about working on random devices? That's the key to why I use Plex at all. If I have to install and set up a VPN client on it I'd just use Jellyfin because at that point I've limited myself to only my devices.
Also of course friends/family. The most technologically useless people I know can operate Plex and can access my collection with basically no support necessary.
I do. I like to stream music from my server onto my phone when I'm out and about. And it's authenticated, so there's nothing terrifying about exposing it (security vulnerabilities aside, but that can happen to any software you expose).
Plex themselves literally recommend it and show a warning icon if it’s not accessible outside your local network. I always thought it was insane. To make matters worse their Synology package doesn’t auto update itself. I would guess there are a ton of vulnerable boxes sitting out there.
What get me the most, are the rabid Plex fanbois swearing that having jellyfin open on the internet is such a baaaad idea and you should spend ~50~ ~100~ 500 bucks for a sub to Plex which totally don't expose the same risk
If you’re exposing anything on Synology to the Internet, you’re already playing with fire. Their packages (like Container Manager) are usually very far behind on security patches.
I think the current version of Docker engine Synology uses was end-of-life 2.5 years ago.
Synology NAS - an ugly doorstop with data loss resulting from its half-baked post-purchase attempts to enforce hardware vendor lock-in. (Was working fine w/ a Western Digital drive, the next day, boom.)
I’ve had a synology NAS that’s been running for 8 years. No data loss. I use random drives I had laying around. It’s not the fastest or fanciest, but I never had any experience with lock in. It’s got a 3rd party 10g card, more memory … nothing locked in.
> This is terrifying. Who runs things like this open to the outside?
A budy of mine has got 30 000 movies and series. Better offer than Netflix (what, easily 4x more choice!?). He's got a 42U rack. He gives free access to his server to his friends and family: it's not a business (so what he risks is also very limited in the country he lives in, for he's not making a business out of it).
It's not because you and I don't run Plex servers accessible from the big bad Internet that others don't enjoy doing it.
Now concerning this miner: I've posted about it in the past here on HN but I only run Jellyfin on my LAN and it's only with throwaway containers: I've got a script that sets up movies/series named/organized the way Jellyfin likes it, then that volume is passed read-only to a transient podman container.
When we're done watching the movie, the podman container is deleted. It's over: it doesn't exists anymore.
All that I care about are data: like family pictures and movies (and, say, other movies).
My Jellyfin server is just a temporary "view" on my actual data.
I don't trust it and don't need to trust it: for it's only future after I'm done watching the movie is to be destroyed.
I got hit with a cryptominer on my mac mini the other day. I only noticed because I happened to sitting in the room with it and noticed the fans were working overtime. There was a process, "icloud-services", which was using 100% of the CPU. It's sort of an indictment of Apple that my first inclination was "they've got a bug that's got an infinite loop" instead of "this is malicious software".
After a reboot, I traced it back to a folder in `Library/Application Support` which included a `config.json` that mentioned gulf[.]moneroocean[.]stream, so I knew I'd been popped. Cleanup was easy enough (the files themselves, plus the launch daemon), but it's annoying.
I don't do dev work on that machine (it's really just for plex & stuff) so it must have been some sort of vulnerability in Plex (but not the one described in OP) or macOS itself. Interestingly, I was up to date on my Plex install, but my macOS version was behind what was apparently an important security update related to an RCE (Sequoia 15.8).
> internet-facing Plex servers
This is terrifying. Who runs things like this open to the outside?
> This is terrifying. Who runs things like this open to the outside?
Probably the majority of people with a Plex Pass subscription and most Plex users in general.
As far as I see it, Plex's primary purpose is to allow people who have extensive collections of legally obtained digital media to conveniently access it and share access to their friends and family on pretty much any random device from anywhere in the world.
All my home media devices run Kodi, they run Jellyfin, they run all sorts of fully open stuff, but when I travel Plex wins because it runs on basically anything that can stream video and I can sign in to it in seconds without needing to connect a VPN or enter my password on someone else's device.
Plex in particular is notoriously insecure. It should never be accessible to the open internet unless via a vpn like WireGuard. Just playing with fire otherwise.
Almost all selfhosted services are in that bucket now. Everything from Plex, Jellyfin, to nextcloud or gitea/forgejo. Few months ago I went through all my setup and moved everything to a vpn. The only service I kept public is a static directory served by nginx where I keep some html food recipes I shared with a friend before.
It's less convenient to use and pretty much impossible to share with others. I can figure out a VPN on all my devices for the most part (except for a Boox ereader). Trying to get "family and friends" to install and maintain a VPN on their devices to be able to access services I share with them is a pipe dream.
Gitea got hit with a similar issue about a month back.
That may be true, but how do you grant non-technical family/friends access? They don't even understand what a VPN is, let alone how to toggle one on/off to access the Jellyfin instance.
Additionally, if they try to connect from an Android TV / Fire Stick, where you can't configure a VPN (and use their ISP's modem, so no wireguard client on the router to transparently route to the subnet), what are you supposed to do?
I feel it may be easier long-term to just contain the Jellyfin daemon to only r/o access to media, putting it behind a subdomain like jellyfin.example.com, and use the dns-01 challenge via LE to only provision a wildcard cert for the domain (IE *.example.com).
Then, have nginx listen on 80/443 with a default server directive that returns 444 for any requests not to the (correct) jellyfin hostname (due to bots hammering 80/443 across the internet on webserver's direct IPs).
Its the only solution I can think of to make it easy for nontechnical users (everything just described is completely invisible to a regular client) while reducing the attack surface area of the daemon.
FWIW, with the aforementioned setup, I got 0 unauthorized requests to my jellyfin server. Just a bunch of bots hammering my IP's 80/443 ports directly with exploits for old (usually wordpress) vulns, but they were all served 444 (IE an immediate TCP connection close without nginx even responding to the request).
Tailscale is easy to explain.
"Install this app on your Apple TV or Android TV, login with your Gmail, and let me know your email address."
Did you miss the point about working on random devices? That's the key to why I use Plex at all. If I have to install and set up a VPN client on it I'd just use Jellyfin because at that point I've limited myself to only my devices.
Also of course friends/family. The most technologically useless people I know can operate Plex and can access my collection with basically no support necessary.
Any citation for that or is that notoriety something that grew in your head?
I don't think any more than 5% of Plex users are using it for legally-obtained content.
Many people, as your TV and sometimes friends have to connect to it and you don't want to explain Tailscale to them.
I'll fully admit I do.
The point of Plex is sharing your library with less ... technical users.
If I didn't want to do that, I'd not even use Jellyfin- SMB share and mpv would be fine with me.
You largely have to for Plex themselves to middleman access to your media collection.
Feeling very validated that I went with Iroh @ https://pixelbrite.site
This is my first time hearing about Pixel Brite, what's the history behind it?
I do run it open to the outside through cloudflare tunnels. I don't want to connect my TVs to tailscale every time to play a movie.
I do. I like to stream music from my server onto my phone when I'm out and about. And it's authenticated, so there's nothing terrifying about exposing it (security vulnerabilities aside, but that can happen to any software you expose).
Essentially every technical person I know.
Plex themselves literally recommend it and show a warning icon if it’s not accessible outside your local network. I always thought it was insane. To make matters worse their Synology package doesn’t auto update itself. I would guess there are a ton of vulnerable boxes sitting out there.
What get me the most, are the rabid Plex fanbois swearing that having jellyfin open on the internet is such a baaaad idea and you should spend ~50~ ~100~ 500 bucks for a sub to Plex which totally don't expose the same risk
I wouldn't go that far. It's just Jellyfin is ugly as shit.
If you’re exposing anything on Synology to the Internet, you’re already playing with fire. Their packages (like Container Manager) are usually very far behind on security patches.
I think the current version of Docker engine Synology uses was end-of-life 2.5 years ago.
Yeah, please avoid Synology, really. If you have it or need it DONT expose it to the internet.
Synology NAS - an ugly doorstop with data loss resulting from its half-baked post-purchase attempts to enforce hardware vendor lock-in. (Was working fine w/ a Western Digital drive, the next day, boom.)
I’ve had a synology NAS that’s been running for 8 years. No data loss. I use random drives I had laying around. It’s not the fastest or fanciest, but I never had any experience with lock in. It’s got a 3rd party 10g card, more memory … nothing locked in.
> This is terrifying. Who runs things like this open to the outside?
A budy of mine has got 30 000 movies and series. Better offer than Netflix (what, easily 4x more choice!?). He's got a 42U rack. He gives free access to his server to his friends and family: it's not a business (so what he risks is also very limited in the country he lives in, for he's not making a business out of it).
It's not because you and I don't run Plex servers accessible from the big bad Internet that others don't enjoy doing it.
Now concerning this miner: I've posted about it in the past here on HN but I only run Jellyfin on my LAN and it's only with throwaway containers: I've got a script that sets up movies/series named/organized the way Jellyfin likes it, then that volume is passed read-only to a transient podman container.
When we're done watching the movie, the podman container is deleted. It's over: it doesn't exists anymore.
All that I care about are data: like family pictures and movies (and, say, other movies).
My Jellyfin server is just a temporary "view" on my actual data.
I don't trust it and don't need to trust it: for it's only future after I'm done watching the movie is to be destroyed.
Reddit discussion here: https://www.reddit.com/r/PleX/comments/1x95krg/inthewild_exp...
Affects an older version of Plex and was patched in August.