Plex Media Server is one of the most used software by NAS server users, thanks to this software, we will be able to set up our own Netflix at home with great image quality and magnificent usability. In order to use this service, it is necessary to register on its official website, either for the completely free version or for the premium version. The Plex security is emailing that they have had a security incident and that our account could be compromised. Next, we explain what has happened and what you should do as soon as possible.
Security incident in Plex
Plex Users woke up to an email telling us that there is very important news due to a security breach that they have detected in their systems. It seems that in this incident they have had access to our Plex account information, although they believe that the real impact of this incident is limited.
Yesterday, the Plex security team discovered suspicious activity in one of their databases. They immediately started an investigation and it seems that a cybercriminal accessed the database and was able to read some information, which includes usernames, passwords and also the email of the users. In other words, almost all the information that Plex stores in its databases seems to have been compromised, but only for some users and not all. A very important aspect is that the payment information (in case you have Plex Pass, the paid version) is not stored on their servers, so you should not worry about it.
What am I supposed to do now?
The security team recommends changing Plex access passwords as soon as possible, in order to minimize any possible intrusion into our account. The password of the users in the database is hashed, so they should first crack this password with methods such as brute force or dictionary, otherwise they will not be able to access our account.
Another very important aspect is that when changing the password there is a box that indicates «log out of connected devices after password change» that we must check for security. This will force us to log in again from all computers, and it will ask us to sign in again on each and every device. Although this can be annoying, it is the safest thing to do.
Next, the security team recommends us to enable two-step authentication, to add another layer of security when authenticating on the official website..Of course, the security team tells us that no one from the company will ever contact us to ask for a password, credit card number or anything similar. Now cybercriminals seem to have our email, so we have to be very careful.
He is a well-known expert in mobile security and malware analysis. He studied Computer Science at NYU and started working as a cyber security analyst in 2003. He is actively working as an anti-malware expert. He also worked for security companies like Kaspersky Lab. His everyday job includes researching about new malware and cyber security incidents. Also he has deep level of knowledge in mobile security and mobile vulnerabilities.
