NAS

Despite what Sonos are doing with their new App, I wonder why BT do not send out an update, or upgrade their routers anyway, given the associated SMBv1 (alleged) risks mentioned online. Some of which are highlighted here…

https://www.tripwire.com/state-of-security/smb-protocol-explained-understanding-its-security-risks-and-best-practices

Netgear NAS boxes (different hardware, but it’s perhaps still worth mentioning) were upgraded from SMBv1 to SMBv2 and v3 via an OS firmware update... maybe BT can ask their router manufacturers to do that with their routers, although I suspect any manufacturer would rather BT used newer hardware instead, I guess.

Same reason why Sonos hasn’t fixed this on S1. 

Yes, at the time of the S1/S2 Sonos split, Sonos did mention that there would be no new features for S1 and chose to put the SMBv2 (and higher) protocol development just into their S2 App instead for customers to take advantage of it through upgrade. I’m not sure what BT are offering their customers - maybe an offer to upgrade to a new router would solve their customers issue, rather than them choosing to standstill, like some S1 only users.

Hi the wording of the update highlight an aspect here that may not be clear.

SMB3 by default - which is a good thing and what is needed, however the version of the protocol i negotiated automatically by devices, so it will have have dropped back to SMB2, or SMB1. With S1 - if it is still working then it fell-back to SMB1. S1 has no firmware updates to allow it to use SMB2 or SMB3. From extensive research this is due to memory limitations in teh Sonos S1 device itself.

I understand the sentiments around SMB1, andhave a technical understanding why SMB1 is vulnerable, bad and could lead to your home network being hacked - which is the crux of why the entire industry, including SONOS have moved away from it.In fact SONOS is late to the game in this regard.

However, some of us don’t buy into the throw away society. Yes my 2 * Sonos S1 are old, and from the point of view of playing music work just fine and I see no need to just chuck them out for a device that functions correctly from the musical perspective.

Surely a better solution would have been to provide an option so some users, with the appropriate warnings & disclaimer could keep using SMB 1 where there are old S1 speakers in the system.

I understand the risks, and I accept them. In the unlikely event someone does hack my network they will get bored very quickly with nothing to interest them and move on.Therefore give me the choice of that risk ….

Thank you! It is all working flawlessly on 2014 Sonos kit/S1/WD My Cloud, so the WD must be adapting to the best the client can use. Where the WD is used for just this NAS service, realistically, what is the risk I am exposed to in using SMB 1?

This is why I stepped off the Sonos bandwagon in 2020 with 12 Sonos units that were and still are in perfect working condition since 2011/14. Sonos wanted me to throw these on to a landfill to keep up with them. To me, because I see Sonos as just an audio system, stepping off was a no brainer.

The irony is that electronic hardware reliability is now very good - the WD is also working fine since 2014 - but the continual reinvention of what essentially is just a remote control, the app, makes the excellent Sonos hardware obsolete with years of service life still left in it.

I have a work around - but it is IT tech heavy so not for all.

Use the desktop app and use an SMB2 share to setup the music library from the NAS. (I was previously using SMB1).

I have a raspberry PI, running Raspian acting as a gateway for SMB1 - which the Sonos S1’s can use.

I can initiate play from the New App, and it will play to the S1 Sonos - due to the rapsberry PI supporting SMB1.

However, it is a complicated unless you have good IT knowledge:

1. Raspian recently deprecated SMB1 - so you will need to get an old version of Raspian (circa 6 months ago) and install that on the Raspberry PI.
2. Give the Raspberry PI a fixed IP (via DHCP in my case)
3. I set up an NFS read-only share (in addition to the SMB2 share) to the music folder on the NAS.You could just use the SMB2 share, but due to the security issues with SMB1 and the fact my SMB2 share is Read/Write I opted for an additional NFS share, read only, and restricted to only the Raspberry PI which has a fixed IP address.
4. Mark the samba package for do not upgrade on the Raspberry PI to ensure SMB 1 support isn’t removed.
5. Update Raspberry Pi to the latest version & packages - to ensure you have the most secure system with the exception of SMB1 of course
6. Setup the Raspberry Pi as an additional (to my main Wifi network) Wifi Access point
7. Configure the S1’s to use the Wifi AP from step - this was done before the New App and unfortuantely i don’t recall how i did this. This may be a stumbling block now!!
8. This results in my main network and Wifi running SMB2 - which is much more secure than SMB1, and the S1’s being the only devices using the weak SMB1 protocol.

I hope the above is of some help to tech savvy folk. Unfortuantely this is very unlikely to be a viable solution for those that don’t have IT expertise.

I hope this helps some, and appreciate it only helps relatively few.

I am not one of those few and I know this solution is beyond me!

So, if I am using my WD device for just storing some old rarely accessed photos, and as a NAS for old Sonos kit via S1, that is all working just fine today, what risk am I exposed to? Or, have been exposed to since 2015?!

Even my Mac back up is not on the WD. As I said, the only times WD is active is when Sonos wakes it for NAS duty.

Ok - well 2 things really

1. the new App will stop the Sonos S1 from accessing msuic on your NAS - others have suggested SonoPhone as an alternative
2. SMB1 (the network ‘language’) is weak and can easily be hacked. Therefore if you store any personal info on the NAS that could be at risk of being seen by a hacker. Secondly a malware could destroy the photos and music. That said risk is relative - your ISP router being up to date is most important as this is the most likely way for a hacker into your network.
3. The other thing with hackers/malware is your browsing habits - if you visit “dodgy” websites (malware), blogs/forums and speak loudly and critically about hackers you increase your risk of a hacker taking an interest in you.Things like social media - avoid upsetting people etc. I’d imagine there are 100,000s people with weak SMB1 based equipement in the world.
4. Assuming you do online banking always be careful, by preference use your mobile phone signal for carrying out banking. Definitely avoid using a device over wifi for banking.