Hackers use your computer to mine crypto: Plex warns

Hackers exploit serious vulnerabilities in Plex Media Server to sneakily mine crypto coins on other people's computers. Users who have not updated their software are at risk.

Attackers can even penetrate vulnerable systems without a password. Security researchers warn that a regular software update is not always enough to get the hackers out.

The attacks target Plex Media Server, popular software that allows people to watch their own movies, series and music on, for example, a television or smartphone.

Researchers discovered four security vulnerabilities collectively known asPlex2Shell. By combining these vulnerabilities, hackers can remotely execute commands on a computer or server without having to log in first.

On October 16, the technical details of the attack method were made public. A day later, the first attacks were already observed.

Once inside, the hackers install, among other things, XMRig, a program with which crypto coins such as Monero (XMR) can be mined.

Normally, cryptominers use their own equipment and pay for the necessary electricity themselves. These hackers do things differently. They let their victims' computers do the work and collect the proceeds themselves.

For the owner, the attack can go unnoticed for a long time. Sometimes there are only small signals, such as a computer slowing down, feeling hot more often, or suddenly consuming more power.

Moreover, the attackers are not limited to cryptomining. Researchers also saw that they were installing software that would allow them to redirect internet traffic through the victim's connection.

This allows hackers to use not only someone else's computing power, but also someone else's internet connection.

The vulnerabilities are in Plex Media Server version 1.43.2 and older. Especially people who have made their media server accessible from the internet are at risk.

The US cybersecurity agency CISA takes the threat seriously. On October 20, all four vulnerabilities were added to the official list of vulnerabilities known to be actively exploited by hackers.

QNAP, a manufacturer of devices that people use to store files at home or in the office, has also received reports from users whose systems are suspected to have been hacked.

The problem is not in the QNAP devices themselves, but in outdated versions of Plex running on them. Computers running Windows, macOS and Linux can also be vulnerable if they use the software in question.

Plex has now released a security update. Users should check that they have at least version1.43.3.10861have installed. A newer version is also safe from this specific attack method.

Anyone using Plex on a computer or home server can check the version number through the Plex Media Server settings.

For users who are still running an old version, quick updating is important. But there is a problem: if hackers have already penetrated, their malicious software does not automatically disappear after an update.

QNAP therefore advises users of potentially affected systems to check whether unknown programs are active. In case of suspected contamination, the manufacturer recommends a clean reinstallation and passwords must be changed.

It is also wise to disable external access to Plex when it is not needed. This makes it more difficult for attackers to reach the media server via the Internet.

Those who only use their Plex server to watch movies and series at home often do not need that remote access.

It is not yet known exactly how many systems have been affected. However, security researchers and manufacturers confirm that the vulnerabilities are actually exploited for cryptomining and other unwanted activities.