SMB1 Security Issue - LACK OF RESPONSE FROM SONOS

GOOD NEWS:

I just received a E-Mail response from SONOS from one that I sent to the CEO.

S2 supporting SMB 2 and 3 will definitely happen, so I don't think there's an issue with you letting the community know. It's just the time line that isn't set, so there's no set date.

He was hopeful that this might happen by the end of the year.

The E-Mail came from Matthew G “SONOS Supervisor Customer Care”


 

The 64k limit is a tricky one. While the move to S2 means the devices now have the memory and storage for a much larger database, the way IDs and enumeration work is with a DWORD, ie a pair of WORDs. Those WORDs are the item index, and of course are limited to 64k. To fix this the DWORDs used on every single playable item would have to be widened to QWORDs throughout the code (so they can store a pair of DWORDs), and much of the Sonos hardware is 32-bit so the overhead in the compiled code is going to be notable. Its also a wire-protocol change for the UPnP API (something that hasn’t happened in a decade).

It should be trivial to increase the overall size limitations of the music database (thanks to the increase in storage), but breaking the actual 64k track limit is a notable engineering task. I’m not going to hold my breath.

Not directly connected, no, but if they are going to crack open local library support anyway then that would be the time to update the file database code as well. We know that S2 devices have a ton more flash and memory, which was one of the problems with fixing it in S1.

It would give more incentive for folks to move to S2 as well.

Just buy a cheap nas for storing your Sonos library only.  If you have an old hard drive you could use that.  Will work out far cheaper.

Have a look at the competition too, it may suit you, but don’t expect many of them to be working in 10 years time.

Maybe the Admins can lock this thread now? Bruce’s last reply is accurate, succinct and covers the issue entirely.

I don’t think YOU’VE grasped the issue here……

• It’s now 2021, not 2006 - they’ve had 15 years to consider this
• Redo the ENTIRE software stack?  Really? Haven’t they had plenty of time to add this to a release train?  Maybe at the time of developing S2?  After all the community have been asking for this for a very long time….
• In 2006 Sonos was pretty much the only show, now there is far more competition.  I put it to you that they, like most companies, probably didn’t care about security of their systems back then (maybe they’re waking up to it now...).  Perhaps they still don’t care (I believe they don't) - remember the “Recycle Mode” fiasco?  They only started to care when it backfired on them.
• You might be happy to sacrifice your home security to support your aging systems….I however would prefer not to.  I’m more than happy to see obsolete systems bricked if it means having a more secure system, 
• I don’t get what your final comment about the “S1 / S2 split is as good as it ever is going to get”  are you saying S2 supports SMB 2/3?  Have I missed an important setting here?

And, just to clarify, if you do not use let Sonos connect to your NAS to play your music (a function that is for many also hampered by the 65k limit), but use a computer or Plex, there is no security risk.

Hey everyone, I’m happy to announce that thanks to the introduction of our S2 platform, we've now added support for SMBv3. Sonos S2 devices will use the highest version of SMB supported by your NAS device. To access this update, you may need to manually change the configuration of your NAS device.

If you can show me the evidence to the contrary I will happily stand corrected @106rallye, but my SMB traffic is restricted to transfer of my music inside my secure network - so to intercept it, someone has to first breach the perimeter anyway - my access to the internet is via a third party (paid) monitoring service - my emails are scanned separately before I receive them (paid service too) and like everyone I try to do my level best (within my own knowledge) to stay secure.

I guess anything, or everything, is hackable given time, but I try to apply a bit of common sense. I’m sure even ‘old’ hardware devices on anyone’s network are just as easily hackable too and by old, I mean anything perhaps over 12 months old, as that most probably provides enough time for its vulnerabilities to come to light.

The router Superhub-2 from the ISP provider VirginMedia in the U.K. was recently reported as being hacked, just as an example … but many folk are likely still using that device without addressing its recently identified vulnerability. So if that was my router (it isn’t by the way) I would rush to sort the issue ASAP, but the SMB vulnerability is not one I see as being that urgent… if the hacker can get into my secure network to begin to exploit it, then in my book my security will have already failed anyway.

The SMB issue is certainly not going to turn me away from Sonos, that’s for sure.

+1

I am the happy owner of an old setup still running S1 (I have a Sonos Connect to feed my HiFi system) and I am using both streaming from online services and my local library (on a NAS).

Recently my girlfirend had an issue with her new MacBook that required to update the minimum SMB version on the NAS to SMB2. Then I realized that the Sonos products couldn't access my local library anymore (stored on the same NAS).

So far I have resisted the incentive to move to S2 since my setup was working perfectly (and I was several times upset about the pushy behavior of the app, but that's another story...) Nonetheless, I understand that 10+ years old products may not be upgradable to run “new” protocols  and would consider upgrading my Connect to run S2 if it would allow me to use SMB2/3.

If not, I am not sure what I would do… The RPi solution seems doable, but honestly, given the price tag of Sonos products, I think it shouldn't be required to fiddle with that kind of stuff. I haven’t looked into competition solutions yet, but I probably would.

I’m looking forward to further news from Sonos on this topic.

Many thanks for the answers. Indeed a cheap NAS would be an option, but I live in a small flat and try to avoid piling unnecessary devices. The Pi SMG gateway would work too especially that I already own one… So I will probably go for that.

> Many folks are finding switching to the Mac or Windows non-SMB server option is their best option.

Could you be more specific? What alternatives do you suggest?

I see, thanks.

By the way, I was able to setup my Raspberry Pi to serve the NAS files using SMBv1 thanks to your tutorial, so thanks for that too!

It may be a drop in protocol, but that assumes that you have space in the memory of the device to increase the size of the kernel. One presumes that Sonos did not have the available memory to update the kernel. They have, however, indicated that it is being worked on for S2, which does run on devices that have larger memory footprints.