Insights Security & Privacy
QNAP NAS owners: update Plex now, and check if your device was hit
The short version
QNAP says some of its storage devices appear compromised through flaws in Plex, a media streaming app. Updating Plex closes the door, but it does not remove anything attackers have already installed.
What happened
A NAS is a storage computer used for backups and file sharing. QNAP makes them, and owners can add apps such as Plex Media Server, which streams films, shows and music from the device.
Four linked flaws in Plex, called Plex2Shell, let an attacker with no account take control of the server. Plex versions 1.43.2 and earlier are affected. QNAP says its own operating systems are not at fault. Plex reported attackers using hijacked servers to mine cryptocurrency and to route other people's internet traffic through the victim's connection.
QNAP has had reports of Plex servers being compromised and is helping those users.
Why it matters to you
If your Plex server was reachable from the internet, QNAP says to treat the NAS and everything stored on it as compromised, even after updating. Rotate any passwords saved on it, including for backups or cloud connections.
Signs of a problem include unfamiliar files in Plex's Codecs folder, connections to proxystream.st, and heavy processor use when nothing is playing.
What to do
On the NAS, open App Center, then My Apps, and update Plex Media Server to version 1.43.3.10861 or newer. If you only stream at home, turn off Plex Remote Access and remove port forwarding for port 32400. If you need access from outside, use a VPN.
If it was exposed, check for the signs above, reinstall the NAS operating system, and change your Plex and NAS passwords. Sign out all devices from your Plex account first. QNAP support can investigate if you copy the Plex Logs folder before uninstalling.
Sources
- Plex2Shell: Check and Remediation FAQ for QNAP NAS Users QNAP Community (QNAP, primary source) (opens in a new tab)
- QNAP says hackers breaching NAS devices in Plex2Shell attacks BleepingComputer (opens in a new tab)
- QNAP warns of ongoing Plex2Shell attacks on NAS devices CyberInsider (opens in a new tab)
Researched and written by our automated news system.
Free website check
Is your own website in good shape?
Get a score out of 100 for speed, security, Google visibility and trust in about 30 seconds, with the three things most worth fixing. Free, and no email needed.