SMB1 Security Issue - LACK OF RESPONSE FROM SONOS

Not directly connected, no, but if they are going to crack open local library support anyway then that would be the time to update the file database code as well. We know that S2 devices have a ton more flash and memory, which was one of the problems with fixing it in S1.

It would give more incentive for folks to move to S2 as well.

I will try to run NMAP on some of my SONOS equipment to provide some additional details. I still have three Generation 1 Play 5’s that cannot be updated to S2.

A lot of the limits on Sonos internal data/storage could be relaxed in S2, much of it wouldn’t even require a newer kernel.

It would take programmer time and testing which are expensive so Sonos is only likely to do stuff that are popular requests.

+1

I am the happy owner of an old setup still running S1 (I have a Sonos Connect to feed my HiFi system) and I am using both streaming from online services and my local library (on a NAS).

Recently my girlfirend had an issue with her new MacBook that required to update the minimum SMB version on the NAS to SMB2. Then I realized that the Sonos products couldn't access my local library anymore (stored on the same NAS).

So far I have resisted the incentive to move to S2 since my setup was working perfectly (and I was several times upset about the pushy behavior of the app, but that's another story...) Nonetheless, I understand that 10+ years old products may not be upgradable to run “new” protocols  and would consider upgrading my Connect to run S2 if it would allow me to use SMB2/3.

If not, I am not sure what I would do… The RPi solution seems doable, but honestly, given the price tag of Sonos products, I think it shouldn't be required to fiddle with that kind of stuff. I haven’t looked into competition solutions yet, but I probably would.

I’m looking forward to further news from Sonos on this topic.

Just buy a cheap nas for storing your Sonos library only.  If you have an old hard drive you could use that.  Will work out far cheaper.

Have a look at the competition too, it may suit you, but don’t expect many of them to be working in 10 years time.

Cheap NAS is a solution BUT don’t get screwed like I did by WD, they sold me a MyBook Live and quickly stopped offering security updates making it risky to keep on-line. Then there were the RF noise issues, placing within a couple feet of a WiFi device would knock it off line.

The Pi SMB v1 gateway is the cheap solution if you have your music on a NAS already. Very low maintenance, just a few security updates needed if you pick the bare-bones Pi OS.

A  Pi SMB v1 server isn’t much more expensive and can use a salvaged hard drive and $10 USB-SATA cable.

Either one of these can be hosted on any SMB v1 capable machine, the same instructions apply.

Many folks are finding switching to the Mac or Windows non-SMB server option is their best option.

What Sonos did that made this mess is what almost every other embedded computer manufacturer did, cheaped out on RAM and ROM, limiting expansion. What Sonos has done differently that any other manufacturer I own gear from is to keep as much old gear usable as possible. Then they throw in the upgrade and trade options that nobody else I use has ever offered.

Many thanks for the answers. Indeed a cheap NAS would be an option, but I live in a small flat and try to avoid piling unnecessary devices. The Pi SMG gateway would work too especially that I already own one… So I will probably go for that.

> Many folks are finding switching to the Mac or Windows non-SMB server option is their best option.

Could you be more specific? What alternatives do you suggest?

Only ones I’m aware of are the Sonos software packages for the Mac or Windows.

https://support.sonos.com/s/downloads?language=en_US

I see, thanks.

By the way, I was able to setup my Raspberry Pi to serve the NAS files using SMBv1 thanks to your tutorial, so thanks for that too!

It’s almost reassuring that Sonos will tackle the SMB1 issue (finally!) - almost because we have no committed date yet.

Here’s a thought though….if Sonos have such little regard for the security of your home network, then what sort of regard do you think they have over your data that they hold?

They either haven’t grasped the issue and the risk they are imposing on their customers...or they just don’t care (I think its probably the latter…….)