Skip to main content
CaptainLeonidas_Sonos
CaptainLeonidas_Sonos
Contributor I
Nov 1, 2016 12:41 PM UTC

When will Sonos put additional security measures in place?

Today a read an article (https://www.ncsc.nl/actueel/nieuwsberichten/iot-botnets-veroorzakers-nieuwste-ddos-aanvallen.html for those able to read dutch) in which the dutch Nationaal Cyber Security Center (NCSC) is taken steps to track down security issue's of home used Internet of things devices.
So my question is wether Sonos will step up to the plate.

Far as I know the only counter-measure in getting access to any Sonos product is the locally used WiFi SSID-name / password.
This topic has been closed for further comments. You can use the search bar to find a similar topic, or create a new one by clicking Create Topic at the top of the page.

74 replies

Show previous replies
CaptainLeonidas_Sonos
CaptainLeonidas_SonosAuthor
Contributor I
Jun 28, 2018 5:05 AM UTC
Funny how now Sonos is patching it's product next month. Though weird I am clueless and made a post way back when and I was the deadbeat.

Well enjoy.
https://medium.com/@brannondorsey/attacking-private-networks-from-the-internet-with-dns-rebinding-ea7098a2d325
Translate
Security is mainly found in a correct mindset and policies applied.
MikeV
MikeV
Jun 28, 2018 11:40 AM UTC
This DNS rebinding "attack" (it's not really an attack, it's taking advantage of common device hostnames and using cross-site scripting methods to access local network devices) was just recently found a couple of weeks ago... oh, and it also affects Chromecast and other devices as well, so Sonos definitely isn't alone in having the issue. But they've acknowledged it and have plans to fix it.

Once again, the most an attacker would have been able to gather is data about your Sonos system... your other Sonos speakers and their IP addresses on your network. They still don't have a way in to turn your Sonos speakers into bots or other attacking devices.
Translate
The S in IOT stands for Security.
jgatie
jgatie
Jun 28, 2018 12:50 PM UTC
Funny how now Sonos is patching it's product next month. Though weird I am clueless and made a post way back when and I was the deadbeat.

Well enjoy.
https://medium.com/@brannondorsey/attacking-private-networks-from-the-internet-with-dns-rebinding-ea7098a2d325

This patch has absolutely nothing to do with your first post. You gloating over this is like stating an earthquake is imminent in Iowa and then coming back a year later to say "told you so" about a recent tornado warning.
Translate
inopinatus
inopinatus
Prominent Collaborator I
Jun 29, 2018 9:00 PM UTC
removed, duplicate
Translate
uncooked meat prior to state vector collapse
Terms & ConditionsAccessibility statement