Wishlist for Sonos Controller Improvements

One potential option missing from your list is ongoing security maintenance. Sonos is still stuck at SMB1 for access to local NAS-based music data. SMB itself has moved on to version 4.7 by now and Microsoft deprecated all use of SMB1 in 2013 due to security concerns. Now, WannaCry and similar malware is exploiting the many weaknesses in SMB1 (NTLM v1 authentication, among others) to install ransomware.

Could the Sonos team please also focus on security? I get that Sonos doesn't earn an income stream from maintaining security the way it does by adding yet another subscription service... but Sonos will destroy customer goodwill if it prevents good IT security hygiene practices. Currently, use of its premium appliances with a NAS enables a known attack vector for malware!

Yes, there are lengthy workarounds (Plex, subsonic) but they create holes / vulnerabilities of their own. I would prefer to see Sonos take the SMB1 bull by the horn and upgrade its SMB stacks to at least version 3 or higher.

One potential option missing from your list is ongoing security maintenance. Sonos is still stuck at SMB1 for access to local NAS-based music data. SMB itself has moved on to version 4.7 by now and Microsoft deprecated all use of SMB1 in 2013 due to security concerns. Now, WannaCry and similar malware is exploiting the many weaknesses in SMB1 (NTLM v1 authentication, among others) to install ransomware.

Could the Sonos team please also focus on security? I get that Sonos doesn't earn an income stream from maintaining security the way it does by adding yet another subscription service... but Sonos will destroy customer goodwill if it prevents good IT security hygiene practices. Currently, use of its premium appliances with a NAS enables a known attack vector for malware!

Yes, there are lengthy workarounds (Plex, subsonic) but they create holes / vulnerabilities of their own. I would prefer to see Sonos take the SMB1 bull by the horn and upgrade its SMB stacks to at least version 3 or higher.

Sonos doesn't have an "income stream from adding yet another subscription service". Sonos makes money from selling hardware, that's it. They don't get kick-backs or paid for having particular services available.

There may well be validity in what you say about SMB1 I can't say as it's not my area of expertise.

As stated many times, there are no fees or kickbacks, or any other kind of "income stream" from services added to Sonos. Membership in the Sonos Music Partners program is free and open to any service that wishes to take part.

Also, SMB1 is fine for anyone concerned enough about security to apply the proper updates.

As stated many times, there are no fees or kickbacks, or any other kind of "income stream" from services added to Sonos. Membership in the Sonos Music Partners program is free and open to any service that wishes to take part.

I stand corrected. Thank you.

Also, SMB1 is fine for anyone concerned enough about security to apply the proper updates.

How do *I* apply the proper updates to a Sonos? It is Sonos that insists on the use of a protocol that its own developer expressly deprecated 4 years ago due to ongoing security concerns! So what if Microsoft fixed *this* particular issue with SMB1 this time? There likely are far more that they have yet to discover.

The point is that SMB1 is inherently much less secure than later revisions and hence should not be used. The latest open-source SMB server implementations turn off SMB1 compatibility by default for a reason. Wannacry and similar ransomware exploiting these SMB1 authentication issues is now circulating and has the potential to make a lot of Sonos customers unhappy.

To me, potentially jeopardizing customer data is simply irresponsible. Network infrastructure should not be prone to being penetrated and multiple revisions out of date . A layered defense against malware is better than allowing for single-point failures, such as relying on Microsoft to keep patching SMB implementations that have been deprecated for years (and especially on operating systems that they officially discontinued support on).

Has Sonos even made a commitment re: updating the network stack? Every official response I have seen here so far seems 100% non-comittal. As best as I can tell, without Sonos' help, this network share access issue cannot be fixed short of disabling SMB access and using an alternative like Plex.

Sigh.

There may well be validity in what you say about SMB1 I can't say as it's not my area of expertise.
I too have no clue about this; but is it the concern that in the present state a virus can be injected into my Sonos kit when it is streaming music from my Apple music subscription, as an example? Or, into my Mac because of sharing the broadband pipe?

I too have no clue about this; but is it the concern that in the present state a virus can be injected into my Sonos kit when it is streaming music from my Apple music subscription, as an example? Or, into my Mac because of sharing the broadband pipe?

Neither, if I understand your question. correctly. No, my security upgrade request is for users who still use a local file server (NAS, computer, etc.) to supply music to the Sonos (for example, with a shared iTunes library). IIRC, this was one of the original methods for using a Sonos, predating streaming support.

If this topic interests you, simply google "SMB1 Microsoft". The first entry is from a blog at Microsoft that details why SMB1 should not be used. How it is unsafe, how it cannot be made safe. Etc. It's starting paragraph is likely a good summary of the rest of the page:



This, from one the principals at Microsoft that deal with SMB every day, Ned Pyle.

Here's the problem: If you want to use a NAS as a file repository for your music collection, Sonos forces you by default to use a unsafe protocol to access said music. Yes, there are kludgy workarounds, but the principal issue remains, i.e. Sonos has not even announced that they're working on SMB2+ support.

The libraries for Linux are out there (i.e. SMB 2-3.11 for server and client), so the libraries are not the issue. That some NAS' still only ship with SMB1 support is also no reason to lag behind. SMB1 support by Sonos could be a opt-in function with the relevant warnings to let users know what they're letting themselves into. That's the responsible way to support options that potentially undermine the data of your customers.

Here's the problem: If you want to use a NAS as a file repository for your music collection, Sonos forces you by default to use a unsafe protocol to access said music.
I use a WD MyCloud that was added to my Apple Time Capsule founded Wifi network when I bought and set up the WD. All my music is copy/pasted from a computer HDD into a folder on the WD, that Sonos uses after indexing.

Where is the security hole?

SMB1 provides opportunities for Man-In-The-Middle attacks, see https://blogs.technet.microsoft.com/filecab/2016/09/16/stop-using-smb1/ The Time Capsule has only one password, no multiple user classes. etc. so the entire share is potentially affected.

Is this a general issue, or one which has arisen because I have put my music in the shared music folder on the NAS via a copy/paste action? If it is general, what has Sonos to do with it? If not general, what is the consequence to my Mac in general and to music files on the NAS in specific?