Answered
Play:1 Possibly Hacked - Reimage / Flash Required
Thanks in advance for any help...
My computer systems have been under a surgical cyber attack for 2 months now with BIOS and Firmware modification techniques that identify this as a sophisticated bad actor. Therefore, a firmware modification to a SONOS speaker is easily in the realms of probability here.
Anyway, either an update screwed up (which I doubt) or the hacker appears to have modified a PLAY:1 as either a backdoor to tunnel back into the network or as a malware infection point. When doing a network scan, the compromised PLAY:1 does not OS fingerprint in the same manner as the other SONOS devices. The compromised PLAY:1 DNS Cache has a number of URL's and IP addresses in it that may or may not be legitimate (while the other SONOS device's DNS cache's are empty) and UPnP is turned off (but enabled on all the other SONOS devices).
So, (if nothing less than to eliminate it from the compromised device list) is there a way to reset / reimage the firmware on the PLAY:1 or force an update? I believe UPnP may have been turned off by the attacker to avoid updates, etc. - so while it reports the latest version, there is no way to confirm if it really is what it says it is.
Appreciate any feedback or responses...
My computer systems have been under a surgical cyber attack for 2 months now with BIOS and Firmware modification techniques that identify this as a sophisticated bad actor. Therefore, a firmware modification to a SONOS speaker is easily in the realms of probability here.
Anyway, either an update screwed up (which I doubt) or the hacker appears to have modified a PLAY:1 as either a backdoor to tunnel back into the network or as a malware infection point. When doing a network scan, the compromised PLAY:1 does not OS fingerprint in the same manner as the other SONOS devices. The compromised PLAY:1 DNS Cache has a number of URL's and IP addresses in it that may or may not be legitimate (while the other SONOS device's DNS cache's are empty) and UPnP is turned off (but enabled on all the other SONOS devices).
So, (if nothing less than to eliminate it from the compromised device list) is there a way to reset / reimage the firmware on the PLAY:1 or force an update? I believe UPnP may have been turned off by the attacker to avoid updates, etc. - so while it reports the latest version, there is no way to confirm if it really is what it says it is.
Appreciate any feedback or responses...
