Plex Hacked, Change Your Password Now

[MrKJLS]

If you use the Plex media server for your movie and TV library, you’ll need to change your password this morning. The company announced it’s forum servers were hacked, leaving email addresses, forum messages, and hashed passwords vulnerable.

The company sent out an email this morning to its users notifying them of the hack. While Plex says that the passwords that were stolen were hashed and salted and, thus, should be safe, it’s still a good idea to change your password. If you visit the site while logged in, you will be automatically redirected to the “Change your password” screen, so it shouldn’t be too hard.

You also should’ve gotten an email with a link to the page where you can change your password.

 

The affected users may be limited to those Plex users that have their account tied to the Plex forums.

That being said, it may still be worth resetting your password on the off chance you created a forum account and forgot (like I did). Here is the text of the email the company sent out:

 

Dear Plex User,Sadly, we became aware this afternoon that the server which hosts our forums and blog was compromised. We are still investigating, but as far as we know, the attacker only gained access to these parts of our systems. Rest assured that credit card and other payment data are not stored on our servers at all.

 

If you are receiving this email, you have a forum account which is linked to a plex.tv account. The attacker was able to gain access to IP addresses, private messages, email addresses and encrypted forum passwords (in technical terms, they are hashed and salted). Despite the password encryption measures, we take your privacy and security very seriously, so as a precaution, we’re requiring that you change your password.

 

Be sure to choose a strong password, never share it, and never re-use passwords for different accounts! Even better, use a password manager (1Password, for example) to manage a unique password for you. Access to your Plex account will be blocked until you do so.

 

Please follow this link to choose a new password.

 

 

We’re sorry for the inconvenience, but both your privacy and security are very important to us and we’d rather be safe than sorry!

We will post more detailed information on our blog shortly. Thanks for using Plex!

 

 

The Plex Team

 

Source: Plex Hacked, Change Your Password Now

 

You can reset your Plex.TV password using this URL: https://plex.tv/users/password/edit?reset_password_token=p3o7x24jNNyypS8zasmZ

[edutech4schools]

hmmm I thought I did have a forum account but have not received any emails, maybe not then.

 

Thanks for posting on eg

[Arthur]

You can reset your Plex.TV password using this URL:

 

https://plex.tv/users/password/edit?reset_password_token=p3o7x24jNNyypS8zasmZ

 

That URL looks like it is specific to you. I tried setting a new password but I don't think it worked.

[Arthur]

I have changed my plex.tv password. I don't remember linking it with forums.plex.tv however. Edited July 2, 2015 by Arthur

[MrKJLS]

That URL looks like it is specific to you. I tried setting a new password but I don't think it worked.

It was the reset link in the LifeHacker article.

 

Alternative password reset link: https://plex.tv/users/password/new

 

[LosOjos]

Sorry to be that guy, but it's generally a bad idea to follow a link to a password reset page unless in an email you know you requested; that's how phishing attacks work.

 

I'll just step away now (and reset my password of course...)

[MrKJLS]

The movie streaming service Plex has been hacked, with an attacker attempting to hold the service for ransom, according to an email sent out to subscribers earlier today. The hackers claimed to have gained control of the server hosting user forums, and demanded a bitcoin payment to prevent the full release of the server's data. Plex confirmed independently that the server housing its forum and blog had been compromised, but said any associated passwords were hashed and salted, making them unusable without serious and sustained decryption efforts. The service declined to pay the ransom, automatically resetting passwords for any affected users.

 

"I gave them until the 3rd of this month to send 9.5 BTC," said the attacker in a message posted to Plex's hacked forum. "This ransom is still active and on the 3rd: if no BTC payment is made, the ransom wll go up by 5 BTC. Eventually if no BTC payment is made, the data will be released via multiple torrent networks and there will be no more plex.tv."

 

Given the advance warning of the breach, it's unlikely users will be exposed to unauthorized charges or more comprehensive attempts at identity theft. The greatest threat is if users have repeated those passwords at other, more sensitive accounts, which might now be targeted by attackers after the salting is cracked. Still, it's a crucial reminder to use separate passwords for each account and change passwords as frequently as possible. It's also unwelcome news for Plex, which had recently inked partnerships with Tivo and Playstation, after rolling out new audio features earlier this year.

 

Correction 6:14pm ET: An earlier version of this post overstated the extent of the breach, which extends only to the server hosting the forum and website, and does not involve unencrypted passwords. The Verge regrets the error

 

Source: Plex's forum data is being held for ransom | The Verge

[Arthur]

The Plex forums are back online and they are have switched their forum software from IP.Board to VanillaForums.

 

https://blog.plex.tv/2015/07/11/welcome-to-the-new-plex-forums