When will Sonos put additional security measures in place?

Hi everyone, this is always an interesting topic to have come up, and though I can't provide a lot of specifics, for security reasons, I can assure you that making sure Sonos isn't "the weak link" in your home network is extremely important to us. We have teams dedicated to player security and maintaining that going forward. In fact, the latest public beta added an additional layer of Sonos account security on the household.

If you have any specific concerns let us know and we'll be happy to provide what details we can. Feel free to PM me if you'd like to chat in private too.

What about getting access to the play5 microphones as well?

You would have to duplicate the entire functionality of the Sonos firmware, add in your own mic monitoring functions, break into the individual Sonos units in the home (or substitute your firmware for the version at the Sonos servers, highly unlikely), somehow initiate an update of your own firmware, then you would be able to access the microphones. Compare this with simply breaking into laptop via telnet/ftp and loading a background app and you see why a hacker is going to pick an easier target.

Thank you Ryan S for responding.

Looking forward towards this "added layer". When home I am hoping I can figure out what this layer may be (release notes I assume are provided).

Thank you Ryan S for responding.

Looking forward towards this "added layer". When home I am hoping I can figure out what this layer may be (release notes I assume are provided).
If you install the Sonos beta that became public - Android and computer-based controllers only are available in public beta tests; iOS devices will have limited settings/functionality - it'll be pretty clear the additional level of security added. Just note that it's a layer of security between your Sonos devices and Sonos' servers with regards to your Sonos account.

Like others have mentioned, though, Sonos isn't likely to be a weak spot as far as the security of devices connected to your network. Most of the devices that have been compromised and involved in many of the attacks are internet-connected cameras, security camera DVRs, and routers, all of which have their passwords still set to the default, or have passwords that can't be changed. Open access to the device - like through Telnet or SSH - is often required for infection to be possible. Also, cameras and DVRs usually have port forwarding active to allow access to them from the internet, something which doesn't affect Sonos either.

In short, your Sonos devices are pretty secure on your home network, and aren't likely to be participating in any such attacks on the internet.

MikeV,

The fact that the Hidden Sonos page tells me more then I should need to know at first glance troubles me.
Granted security through obsurtity is neighter preffered. Still the Sonos status info pages of the device itself can be put behind a username/password enabled webpage (https preffered).
Also a personal mailaddress of whom I presume is an employee of Sonos within these pages.... It equals "Not done" in my book.

I still have not figued out how to change the root password of this Linux 2.6.35 kernel which seems to run on the device and I am not even sure if this kernel is still being maintenanced. If anything can be written/said about Linux and it's app/drivers etc it's that Linux is the most frequenly patched OS I have seen to date (macOS Sierra/Windows are not even close in numbers of times some patch/tweak is release for linux).

What I understood from the beta-notes so far is that an additional layer is put into place server-site to protect the data gathered and stored there. I have not looked at the client site implementations of the firmware itself. I lack a test Sonos system and I am not about to get an additional test Play:1 just to see what beta's will add.

Perhaps I expect too much from Sonos documentation concerning IoT's aka the release notes of the system(s) used. I am the kind of person who reads Microsoft patch-notes from the top to bottom. Same for macOS Sierra patch-notes for that matter.

Ryan S,

Perhaps I will try that chat you suggested.
However not sure when (you are USA based when I have a look at your profile info and I am an EU-citizen) or how to start a chat.

Nevermind.. the chat is a PM.
Misread your comment.

You're worried about security but you want users to be able to change the root password on the Sonos devices?

You're worried about security but you want users to be able to change the root password on the Sonos devices?
I want to change the password as the owner of the device so that I and I alone know it.
I will at this time assume all Play:1 devices have a standard/firmware embedded password

If this password is hardcoded into the device I see it even as worse.

Aka the device comes with a known but temporairy password in the owners manual. Upon configuration you are mandatory notified to change the password with certain best-practice guidelines of how a password/passphrase should look like.

(I was under the impression I wrote that earlier so I hope this clarifies it.)

Futhermore I have no idea if it is even possible to flush the devices of Sonos like you can WIndows Phone/iOS or Andriod devices.
I think it should.

The majority of people don't even change their router password and you're expecting them to provide a 16 digit password (current admin password length requirement at my place of work) for their Sonos system? And renew it every 90 days presumably? And then remember it when Sonos support require it in order to fix an issue? Good luck with that. How are hackers gaining access to your Sonos anyway, isn't your router secure?

The majority of people don't even change their router password and you're expecting them to provide a 16 digit password (current admin password length requirement at my place of work) for their Sonos system? And renew it every 90 days presumably? And then remember it when Sonos support require it in order to fix an issue? Good luck with that. How are hackers gaining access to your Sonos anyway, isn't your router secure?

When a phishing mail with malicent content is opened within the LAN your router security is already a non-issue.
That is the pet-peeve why i started this thread.

Again if you can reflush a Sonos device like you could a mobile Phone fixing is a non-issue. If a reflush would fail I would sent it to the manufacture for repair
I for one would never like the idea that they Sonos can directly access my device unless I and I alone granted them access.

Btw the fact that people still use default passwords on their routers is again all the more a reason to force manufactures to up their game. Router manufactures should make it a mandatory configuration action though.

Question though for you LHR:
Would you like it if you owned a TP-Link router that TP-Link support could directly access it?
Would it matter to me? Hell yes.
I for one would not like the idea of external people accessing my sonos like they can with certain cars (the kind of car with "convenient motormanagment software").

My router is a non-physical one running in cyberspace if you will. It is not directly accessable from the outside and I will make sure it never will be acessable.