SMB1 Security Issue - LACK OF RESPONSE FROM SONOS

I’m not considering moving away from Sonos - I have a NAS that just has my modest music library stored on it and the fact it’s inside a (hopefully) secure monitored home network, I’m not too bothered by the SMB-1 vulnerability. My understanding is that the benefits of SMB-2, or higher, is that the music files transverse the network encrypted, rather than unencrypted, and so can presently be read and/or possibly diverted to a hacker that manages to breach my network in the first place. Seems like a lot of effort just to listen to a few songs?

I’m not going to lose sleep over that and I’m quite sure there are many vulnerabilities around us all, both known and perhaps unknown, that can likely be far worse. I do many things of course to keep the entire network perimeter secure and have things guarding the inside and monitoring the WAN traffic too, looking for intruders and trying to do my level best to keep things safe. This issue certainly isn't going to cause me to move away from my home sound system.

I’m quite sure there’s lots of other types of hacking to worry about, but I’m certainly not going to let the scaremongering around SMB change anything here. I’ve been using the music library for years and will no doubt continue to do so, as my now-old NAS will unlikely support the upgraded version of the protocol anyway.

I’m not moving away from Sonos because of this, but I would like te see it repaired - including a solution for the 64k limit. In this respect I expected more from the much hyped S2 software……

@Ken_Griffiths At this moment I do not have the time to investigate, but are you sure you represent the dangers of SMBv1 right? I seem to remember SMBv1 is also possibly opening up your system to viruses.

If you can show me the evidence to the contrary I will happily stand corrected @106rallye, but my SMB traffic is restricted to transfer of my music inside my secure network - so to intercept it, someone has to first breach the perimeter anyway - my access to the internet is via a third party (paid) monitoring service - my emails are scanned separately before I receive them (paid service too) and like everyone I try to do my level best (within my own knowledge) to stay secure.

I guess anything, or everything, is hackable given time, but I try to apply a bit of common sense. I’m sure even ‘old’ hardware devices on anyone’s network are just as easily hackable too and by old, I mean anything perhaps over 12 months old, as that most probably provides enough time for its vulnerabilities to come to light.

The router Superhub-2 from the ISP provider VirginMedia in the U.K. was recently reported as being hacked, just as an example … but many folk are likely still using that device without addressing its recently identified vulnerability. So if that was my router (it isn’t by the way) I would rush to sort the issue ASAP, but the SMB vulnerability is not one I see as being that urgent… if the hacker can get into my secure network to begin to exploit it, then in my book my security will have already failed anyway.

The SMB issue is certainly not going to turn me away from Sonos, that’s for sure.

If you go back and look at past posts on SMB v1 you will see that if Sonos does move to fix it it will only be for S2 and the Sonos devices that have the internal memory needed to support the newer Linux kernel and the newer Samba software.

That is going to be a major project, lots of details are available in past posts too.

My bottom line is that the SMB v1 issue can be easily worked around and doesn’t require you to set your NAS to unsecure settings or expose your data to SMB v1 related security risks.

I’m just not dumping my house full of Sonos gear when a $35 Canakit Raspberry Pi Zero W kit will fix the problem with a few minutes of setup effort. Cheaper if you don’t need the full kit too.

Pi Setup guide: https://stan-miller.livejournal.com/357.html

Canakit Pi: https://www.amazon.com/CanaKit-Raspberry-Wireless-Complete-Starter/dp/B07CMVDHWB/ref=sr_1_8

You can also just make a dedicated Pi NAS for Sonos by adding an external drive:

https://stan-miller.livejournal.com/650.html

GOOD NEWS:

I just received a E-Mail response from SONOS from one that I sent to the CEO.

S2 supporting SMB 2 and 3 will definitely happen, so I don't think there's an issue with you letting the community know. It's just the time line that isn't set, so there's no set date.

He was hopeful that this might happen by the end of the year.

The E-Mail came from Matthew G “SONOS Supervisor Customer Care”


 

Well finally some positive news on this. We know the One SL already has the updated SMB stack, but sadly it is buggy right now. Has anyone tried SMBv2 with a One SL? Maybe that works already. (For an accurate test you would need to power down everything that isn’t a One SL and do a Library Scan).

Might be fun to run some network probes against the newest Sonos gear too, see if they can return any OS info that points to changes from older gear.

Well I just lost 45 minutes of a long post with the version details from the nmap program, most of the time spent sanitizing personal info from the scans. <word the admins would have to remove!>

What I can recover:

Play 1:

Running: Linux 3.X

OS CPE: cpe:/o:linux:linux_kernel:3
OS details: Linux 3.2 - 3.16

Arc and One SL

Running: Linux 3.X|4.X

OS CPE: cpe:/o:linux:linux_kernel:3 cpe:/o:linux:linux_kernel:4
OS details: Linux 3.2 - 4.9

Be interesting to see these lines from other Sonos kit, particularly Legacy / S1 stuff.

Command:  sudo nmap -A -v -O -sV 172.16.1.122
 

Since I made a backup of this post it is sure to go with no problems. :-(

For me this is great news, not because I need the SMB upgrade, like Ken I have a sacrificial raspberry Pi.

However that fact that Sonos is going to resolve this issue means they are still committed to supporting local Music libraries, which is a relief.  And who knows but maybe they will be voice assistant, which maybe could select music from local libraries?

Great news. Would this also mean an end to the 65k limit? Or are these two things not connected?