PSA: Patch your Plex media server before someone hacks it

Recently fixed vulnerabilities in the Plex Media Server are under active exploitation in attacks that, when successful, install malware, including cryptominers and residential proxy apps, a researcher said. Plex fixed four vulnerabilities at the start of last month. Three weeks later, published CVE designations revealed five vulnerabilities, with one of them carrying a severity rating of 8.6 out of 10. A researcher last week revealed an exploit that chained four of them together to achieve remote code execution of the device running a vulnerable Plex version. The researcher named the chain “Plex2Shell.” Complex exploit chain The new details allowed a separate researcher to create a honeypot that could track attempts in the wild to exploit the vulnerability chain. Within a day, the researcher began seeing active scanning of the simulated Plex server and eventually successful attempts to infect devices. So far, successful attacks are installing two payloads. One is a cryptominer, which uses the device to mine cryptocurrency and deposit it into a wallet controlled by the attacker. The other payload is residential proxy software, which allows people to anonymize their Internet activity (much of it illegal) by connecting to the infected box and then using it to send the user’s traffic to a final destination. “Plex may be hosted on residential IP [sic] and I think threat actors would love to have residential IP proxy to access corporate VPNs and emails,” the second researcher wrote. The files .px_7c1e, cert.pem, cert_key.pem ce.sh, config.json, deploy.sh, libcow.so, k.sh, plexmediaserver.state, w3.sh & x.sh (among others) in/tmp along with the directory.pxb . Delete all the files and directories owned by the plex user in/tmp directory.Also look for /var/lib/plexmediaserver/ , especially the directorysoftwaretechreview . That contains a file namedwatchsoftware.sh that handles relaunching the miner. You should delete the wholeplexmediaserver directory and everything under it. Thewatchsoftware.sh file is called from the crontab of the plex user, which is located in/var/spool/cron/crontabs . There should be no entry for plex there, if there is one delete it.You'll also see extremely high load that can make doing things even from the command line via SSH difficult. For me it was w3.sh showing high load. That file doesn't appear to be the cryptominer itself, so I may have caught the hack as it was happening and nipped it in the bud. I couldn't actually find the cryptominer file (softwaretech ) that's referenced inw3.sh anywhere, so it's also possible their hack wasn't fully successful. Or that both are true and I killed the hack before it could complete.As for why it was out of date, the Debian source repository I used for Plex was no longer online, so it had stopped getting updated and I didn't notice it.