SMB1 Security Issue - LACK OF RESPONSE FROM SONOS

I’d say it is more likely you haven’t grasped the complexity of the SMB version upgrade issue. It is not a simple swap but requires a massive re-do of the entire Sonos software stack as well as lots of hardware that would need to be replaced.

Go back to 2006 or so and look at some of the older discussions on what would be needed on the hardware and software sides of the issue.

Sonos has been taking hits on this since back then, if it was possible they’d have done this long ago to silence the critics.

Do I want SMB 3 or better yet NFS? Yes.

Am I willing to see all my older Sonos gear become worthless paperweights to get it? No.

The S1 / S2 split is as good as it ever is going to get, the S1 gear is just too limited in memory.

I don’t think YOU’VE grasped the issue here……

• It’s now 2021, not 2006 - they’ve had 15 years to consider this
• Redo the ENTIRE software stack?  Really? Haven’t they had plenty of time to add this to a release train?  Maybe at the time of developing S2?  After all the community have been asking for this for a very long time….
• In 2006 Sonos was pretty much the only show, now there is far more competition.  I put it to you that they, like most companies, probably didn’t care about security of their systems back then (maybe they’re waking up to it now...).  Perhaps they still don’t care (I believe they don't) - remember the “Recycle Mode” fiasco?  They only started to care when it backfired on them.
• You might be happy to sacrifice your home security to support your aging systems….I however would prefer not to.  I’m more than happy to see obsolete systems bricked if it means having a more secure system, 
• I don’t get what your final comment about the “S1 / S2 split is as good as it ever is going to get”  are you saying S2 supports SMB 2/3?  Have I missed an important setting here?

You’ve clearly got an axe to grind. If you know exactly what needs to be done and how, why don’t you offer Sonos your technical services?

“

• You might be happy to sacrifice your home security to support your aging systems….I however would prefer not to.  I’m more than happy to see obsolete systems bricked if it means having a more secure system, 

Yes of course you are 

Sonos are more than capable of reaching out to me, if they choose to do so….

Yes I do have an axe to grind here, and a responsibility too.  I’m both a customer and a cyber security expert.  They should be making products and providing services that protect their customers, not ignoring gaping security holes.  It begs the question that if they’re ignoring this then what else are they ignoring?

Look I see you’re a big Sonos fanboi, so I don’t expect you to be bothered by this, although I recommend you should be.

No problem with ax grinding, just sucks a bit when you completely fail to understand the issue, even when given (admittedly somewhat minimal) assistance in finding the details.

At this point your posts are basically ranting about things you have failed to understand.

[quote]Haven’t they had plenty of time to add this to a release train?[/quote]

Seriously how in the world should Sonos add memory to the old players with a software update?

I guess they could re-write the Linux kernel and the Samba code trimming non-essentials bits but that is kinda a big job and then they must maintain both forks on their own. Not practical but at least it is not impossible as the “add memory” option.

[quote]I don’t get what your final comment about the “S1 / S2 split is as good as it ever is going to get”  are you saying S2 supports SMB 2/3?  Have I missed an important setting here?[/quote]

Yes. The S1 / S2 split is all about keeping the old S1 gear working as is, while splitting off the more capable S2 gear into a new branch that has the memory space to allow enhancements.

I’m saying the S2 level gear has the memory to support the newer Linux kernel and Samba code needed to enable newer versions of SMB. Not that it is coming soon though.

You could go back either here or in other embedded systems discussions and look at the difficulties, costs and time needed to move an existing hardware platform running a forked and privately patched kernel to a current kernel that includes any of the patches required by the platform.

[quote]You might be happy to sacrifice your home security to support your aging systems….I however would prefer not to.[/quote]

Why in the world would I do something like that when it only takes a few minutes and under $50 to install a NAS to SMB v1 gateway eliminating the security issue?

And, just to clarify, if you do not use let Sonos connect to your NAS to play your music (a function that is for many also hampered by the 65k limit), but use a computer or Plex, there is no security risk.

Or use a PC or a Mac.

Enabling smbv1 on a NAS is  a security risk. smbv2 came out in 2006. It’s a drop in protocol, you don’t have to write it yourself. S2 was no improvement on S1 and in fact the UI of v1 is friendlier. I would like to go back but my s/o updated and no I can’t. wtfbbq, there is no real excuse for having to enable an insecure protocol 15 years after a secure on was released.

It may be a drop in protocol, but that assumes that you have space in the memory of the device to increase the size of the kernel. One presumes that Sonos did not have the available memory to update the kernel. They have, however, indicated that it is being worked on for S2, which does run on devices that have larger memory footprints. 

Hey everyone, I’m happy to announce that thanks to the introduction of our S2 platform, we've now added support for SMBv3. Sonos S2 devices will use the highest version of SMB supported by your NAS device. To access this update, you may need to manually change the configuration of your NAS device.