How secure is our registration information? Is Mirai a possibility for Sonos speakers?

Great question! Following.

Hi Peter,

Security concerns are always valid in this day and age. The Sonos account information is managed on our servers, not InSided. We use an SSO so that you don't need multiple accounts, but the account credentials are managed mostly on our end of things. The spam is being done by people manually creating accounts and posting spam.

As to the most recent attacks, there is zero evidence to suggest that Sonos speakers were compromised. If you have any questions or concerns you're more than welcome to DM me too.

...the account credentials are managed mostly on our end of things.

Mostly? Where else are they managed? And is this a security risk?

...the account credentials are managed mostly on our end of things.

Mostly? Where else are they managed? And is this a security risk?

There has to be a handshake to confirm the account is authenticated, but I don't have all the details there, so "mostly" is just to cover my lack of knowledge. The specifics may be something that the team would prefer not posted here as well, but I'll check in with them. I can assure you though that they're definitely concerned with your privacy and security.

Thanks Ryan. I'm sure the Sonos team are concerned with our privacy and security. But the fact that after 2 weeks the forum is still being spammed doesn't generate a lot of confidence. Expressions of concern and absence of spam are two very different things.

As I remarked elsewhere, product -- specifically firmware -- development and customer services are typically entirely different parts of an organisation. There's no logical reason why the shortcomings of this particular choice of forum software should affect the behaviour of the player firmware.

Nor should there be any relationship between account security and spam posted on a board. Two very separate things. Posting spam doesn't require any access to account information.

That's not to absolve them from needing to be concerned about account security, but there really isn't any reason to link the two in your mind.

Ratty and "Bruce" - I would very much like to agree with you. So let me outline my concerns and you can point out where you think I'm wrong.

If InSided are sufficiently technically incompetent as to be unable to control some very simple spamming within 2 weeks, then I have trouble trusting they can manage other more complicated aspects of their software. One of these aspects is managing the SSO (single-sign on) required to authenticate forum users. As Ryan states above, this is done via a handshake with servers at Sonos that must be connected with our account information there. So there is the possibility for a hack of Sonos computers this way. Once inside Sonos, presumably it would be possible to access Sonos devices remotely (if Sonos can do it, so can a hacker), and/or alter firmware maliciously.

Now I confess this is all low probability stuff but it does happen. The Australian Bureau of Meteorology was recently hacked, despite already being vigilant and competent in IT security. As well as stealing IP and research, the alleged Chinese hackers were looking for a way into other Government agencies such as Defense because they are connected; Defense uses weather forecasts!

Cheers, Peter.

p.s. I have nothing but admiration for Ryan and all the other Sonos staff having to deal with this. It must be very frustrating.

If InSided are sufficiently technically incompetent as to be unable to control some very simple spamming within 2 weeks, then I have trouble trusting they can manage other more complicated aspects of their software. One of these aspects is managing the SSO (single-sign on) required to authenticate forum users.
I agree. Even the great and mighty have been hacked, and they are neither of those things. At the beginning of this year they were described as a startup with 60+ employees.
https://medium.com/@wouterinsided/insided-6m-series-a-investment-round-founders-notes-29654454da29#.27z9tpl50

Sonos themselves have already had their own brush with data exposure. Just 4 years ago they were transmitting the user ID and password credentials for our streamed services, between zones, in plain text. Not just when the account was created, but each time a track was opened.
https://en.community.sonos.com/troubleshooting-228999/sonos-security-patch-27627

The exposure of that was probably an excellent wake-up call, and with no embarrassing data breach apparently, other than just a few techie types sending each other network transaction dumps. I think that it is good that our account info is in-house, but it is concerning that Insided is handling more than just forum traffic and archives.

At the beginning of this year they were described as a startup with 60+ employees.
https://medium.com/@wouterinsided/insided-6m-series-a-investment-round-founders-notes-29654454da29#.27z9tpl50
Oh dear.

We are on a mission to communitize the world.

Lots of fancy words, but nothing about the fact that the "traditional old school (1st generation) forums" actually provided the features that regular board users (and admins) really needed. Such as a useful advanced search, to take one glaring example. Or an auto-moderator.

And from http://www.insided.com/news/insided-raises-6m-round/:

While traditional forum-based communities have been around for decades, inSided has added technology to reach existing company business goals, with results like 80% less calls to the contact centre

Could this be by 'deflection into peer-to-peer interactions', encouraged by those badges and scores? The tragic irony is that the "ambassadors and super users" found their efforts so hamstrung by the quality of the supporting platform that a lot of the old forum regulars evaporated.