Chromatic Producer I

SMB1 Security Issue - LACK OF RESPONSE FROM SONOS

PLCMAN58 · 2021-08-15T00:54:35+00:00

How many people are considering moving away from SONOS due to the lack of an official response from SONOS on the SMB 1 security issue? I have been a long time supporter of SONOS and am dismayed at their lack of response at the many threads on the SMB1 security issues. I use a NAS to my music with SONOS and this was one of the primary reasons for my first purchase when they first introduced the product to the market. I had already stared upgrading my SONOS equipment to support S2 but have halted all purchases until I get an official response to the SMB1 issue. I have sent a E-Mail to the SONOS CEO requesting an official response and will update this thread when I get a response to my E-Mail.

40 replies
7240 views

How many people are considering moving away from SONOS due to the lack of an official response from SONOS on the SMB 1 security issue?
I have been a long time supporter of SONOS and am dismayed at their lack of response at the many threads on the SMB1 security issues.
I use a NAS to my music with SONOS and this was one of the primary reasons for my first purchase when they first introduced the product to the market.
I had already stared upgrading my SONOS equipment to support S2 but have halted all purchases until I get an official response to the SMB1 issue.
I have sent a E-Mail to the SONOS CEO requesting an official response and will update this thread when I get a response to my E-Mail.

SMB

This topic has been closed for further comments. You can use the search bar to find a similar topic, or create a new one by clicking Create Topic at the top of the page.

Show previous replies

106rallye

@Sotiris C. Are you looking at ending the 65k limit too?

Sotiris C.

Sonos Staff

Hey @106rallye,

Sotiris C. Are you looking at ending the 65k limit too?

I will forward this as a feature request to our development team.

Leaving a like and marking Best Answer might make someone's day. Who knows, that someone might be you.

B

beynym

World-Class Superstar

Hey @106rallye,

Sotiris C. Are you looking at ending the 65k limit too?

I will forward this as a feature request to our development team.

For the 82nd time in many years…

:rolling_eyes:

controlav

Lead Maestro

@Sotiris C. Are you looking at ending the 65k limit too?

The 64k limit is a tricky one. While the move to S2 means the devices now have the memory and storage for a much larger database, the way IDs and enumeration work is with a DWORD, ie a pair of WORDs. Those WORDs are the item index, and of course are limited to 64k. To fix this the DWORDs used on every single playable item would have to be widened to QWORDs throughout the code (so they can store a pair of DWORDs), and much of the Sonos hardware is 32-bit so the overhead in the compiled code is going to be notable. Its also a wire-protocol change for the UPnP API (something that hasn’t happened in a decade).

It should be trivial to increase the overall size limitations of the music database (thanks to the increase in storage), but breaking the actual 64k track limit is a notable engineering task. I’m not going to hold my breath.

Author of the leading independent Sonos apps for Android, MacOS, iOS, Windows and Xbox.

R

RJSUK

Enthusiast II

One solution is to the change your router for one with a USB port. I have a BT router and I have a 2TB hard drive with nothing but my FLAC music library on it plugged into to it. I had to enable smbv1 on my PC to map the drive and then disabled it afterwards. If I want to add new FLAC files to my library, I just disconnect it from the router, transfer them across on my PC and then plug it backs and rescan the library.

I know this doesn't solve the OP's problem, I'm just offering an alternative solution. It's the best thing I've done Sonos wise. The noise from my NAS was annoying and the HDD which is powered by its USB connection runs silently, sleeps after 20 minutes of inaction and wakes up again within a couple of seconds when called into action again!

el rubio

It’s almost reassuring that Sonos will tackle the SMB1 issue (finally!) - almost because we have no committed date yet.

Here’s a thought though….if Sonos have such little regard for the security of your home network, then what sort of regard do you think they have over your data that they hold?

They either haven’t grasped the issue and the risk they are imposing on their customers...or they just don’t care (I think its probably the latter…….)

no committed date but already works fine for me as stated here :grin:

salu2.eu

S

SimonKennedy

Lyricist II

I’m coming very late to this, as when I first stumbled upon the SMBv1 issue some time ago I just set my SAN to support SMBv1 and didn’t really worry about it, but the issue recurred after updating to Windows 11, and in resolving it the second time I came across this link from Synology, who manufacture my SAN, about how to enable SMB just for a specific IP address range (i.e. devices on your LAN) - in case any of the rest of you likewise have a Synology SAN thought I’d share the link, as seems to allow both SONOS S1 *and* reasonable security w/out the hassle of configuring a RPi or equivalent as a music server). https://www.synology.com/en-us/security/advisory/Precaution_for_a_PotentialSMBVulnerability

jgatie

I’m coming very late to this, as when I first stumbled upon the SMBv1 issue some time ago I just set my SAN to support SMBv1 and didn’t really worry about it, but the issue recurred after updating to Windows 11, and in resolving it the second time I came across this link from Synology, who manufacture my SAN, about how to enable SMB just for a specific IP address range (i.e. devices on your LAN) - in case any of the rest of you likewise have a Synology SAN thought I’d share the link, as seems to allow both SONOS S1 *and* reasonable security w/out the hassle of configuring a RPi or equivalent as a music server). https://www.synology.com/en-us/security/advisory/Precaution_for_a_PotentialSMBVulnerability

Sonos has supported SMB v2 and v3 for months.

Airgetlam

Note, however, that S1 devices do not have the capability to use anything higher than the version 1 of SMB, it does require S2 to use SMB v2 and SMB v3.

Bruce

controlav

Lead Maestro

Maybe the Admins can lock this thread now? Bruce’s last reply is accurate, succinct and covers the issue entirely.

Author of the leading independent Sonos apps for Android, MacOS, iOS, Windows and Xbox.

Sign up

Login to the community