RetroFed Forum
Your home away from modern life.
Plex vulnerabilities being exploited in the wild to drop a cryptominer
Post Reply
AuthorMessage
Psythik lemmy.world Psythik@lemmy.world
Joined: 2023-12-21
#52 · Quote Reply

[deleted]

That's not how this works. If you don't want a shit bitrate, don't pick a file with a shit bitrate to stream. I go for the REMUX every time. I have no issues streaming a 70GB file over my gigabit 5G home internet connection. If you have slow internet, then I can understand why you'd prefer Jellyfin.

0
electric_nan lemmy.ml electric_nan@lemmy.ml
Joined: 2022-01-15
#53 · Quote Reply

IDK why everyone here is in love with Jellyfin when we have Stremio/Nuvio. Jellyfin is a lot of work; with Nuvio all you do is browse like Netflix, and stream. No existing media library required.

I'm stoked on my Jellyfin setup, but I'll check on Stremio again in case I want to recommend it to anyone. Never heard of Nuvio, but at a glance it seems like you have to connect it to a media library.

3
Psythik lemmy.world Psythik@lemmy.world
Joined: 2023-12-21
#54 · (edited) Quote Reply

I'm stoked on my Jellyfin setup, but I'll check on Stremio again in case I want to recommend it to anyone. Never heard of Nuvio, but at a glance it seems like you have to connect it to a media library.

Nuvio is the same as Stremio except better, because it has more quality of life features (like a "Who's watching" feature). I only mentioned Stremio because it's more well-known than Nuvio, but both work the same way. If anyone remembers Popcorn Time, it's kinda like that.

3
curbstickle_lw Moderator curbstickle_lw@lemmy.world
Joined: 2026-06-06
#55 · Quote Reply

IDK why everyone here is in love with Jellyfin when we have Stremio/Nuvio. Jellyfin is a lot of work; with Nuvio all you do is browse like Netflix, and stream. No existing media library required.

Because a lot of us watch things that cant be found easily, or home movies, or prefer to have it readily available at any time.

There are many reasons. Dont assume your use case is the only one.

12
electric_nan lemmy.ml electric_nan@lemmy.ml
Joined: 2022-01-15
#56 · Quote Reply

Nuvio is the same as Stremio except better, because it has more quality of life features (like a "Who's watching" feature). I only mentioned Stremio because it's more well-known than Nuvio, but both work the same way. If anyone remembers Popcorn Time, it's kinda like that.

Yeah I loved popcorn time. I'm looking into Stremio, and I'm already down a rabbit-hole of add-ons, debrid providers, and reading between the lines. Doesn't seem like anything I can recommend to nontechnical folks.

4
DaveyRocket lemmy.world DaveyRocket@lemmy.world
Joined: 2025-03-08
#57 · Quote Reply

I think it's not a widely used phrase yet

Idk, I think I heard peppe rice cream say it…

1
Bakkoda lemmy.world Bakkoda@lemmy.world
Joined: 2024-02-28
#58 · Quote Reply

And MPC is Windows?

I can only vouch for old mpc and i think i remember it being clunky but decent. It's been a very long time though

1
Psythik lemmy.world Psythik@lemmy.world
Joined: 2023-12-21
#59 · Quote Reply

Yeah I loved popcorn time. I'm looking into Stremio, and I'm already down a rabbit-hole of add-ons, debrid providers, and reading between the lines. Doesn't seem like anything I can recommend to nontechnical folks.

Well like I said, please look into Nuvio instead. I'm about to ditch Stremio and switch

3
Richard lemmy.world richardisaguy@lemmy.world
Joined: 2023-08-13
#60 · Quote Reply

Hackers still doing cryptominers nowadays? C'mon, get with the times, install a LLM model on people's computers instead.

11
techwithjake sh.itjust.works techwithjake@sh.itjust.works
Joined: 2023-06-08
#61 · Quote Reply

But I haven't paid anything to Emby (I don't need the code behind that key) and without cloud, I could continue using this version forever and they can't enshitify it

Until they make a code change that forces a key to stream to an app or run at all. Jellyfin is actually a fork of the original Emby code before they closed sourced it and started down the bad path.

12
Gwaer lemmy.world Gwaer@lemmy.world
Joined: 2023-07-07
#62 · Quote Reply

How did you detect and remove it

I run plex on proxmox. When I woke up I noticed my proxmox server was using a lot more cpu than usual.

Then, plex was using all the resources it was provisioned for. So I checked out what was running and it was a weird process. I tracked down some logs and found the intrusion. IPs related to it etc. but I just blew up the lxc. Saved a copy of the malicious programs and the logs to dig into. Spun up a new plex from the previous days backup.

2
ripcord lemmy.world ripcord@lemmy.world
Joined: 2023-06-10
#63 · Quote Reply

I run plex on proxmox. When I woke up I noticed my proxmox server was using a lot more cpu than usual. Then, plex was using all the resources it was provisioned for. So I checked out what was running and it was a weird process. I tracked down some logs and found the intrusion. IPs related to it etc. but I just blew up the lxc. Saved a copy of the malicious programs and the logs to dig into. Spu...

Did you reset your Plex admin keys?

2
Gwaer lemmy.world Gwaer@lemmy.world
Joined: 2023-07-07
#64 · (edited) Quote Reply

Did you reset your Plex admin keys?

Yeah, in the logs I saw they seemed to get my keys so I reset everything

2
magic_smoke lemmy.blahaj.zone magic_smoke@lemmy.blahaj.zone
Joined: 2025-01-27
#65 · Quote Reply

That's fine for your personal remote access but that doesn't help your 80 year old mother in law watch videos of the grandchildren on a Roku.

Been thinking of throwing together a set top box with everything made up for my grandfather so he can stream stuff from my jellyfin setup.

I just need to find an ezpz enough to use frontend.

2
flandish lemmy.world flandish@lemmy.world
Joined: 2025-04-08
#66 · (edited) Quote Reply

i run mine through wireguard, but also think i do have its port open to the wider web using the plex signon they push. i’m prob fucked huh?

pfft. turned off remote access and the port forward. checked svr for exploit. updated plex. updated wireguard while at it. dont need remote access anyway.

5
GreenKnight23 lemmy.world GreenKnight23@lemmy.world
Joined: 2024-09-21
#67 · Quote Reply

[removed by moderator]
[removed by moderator]
1
heartSagan5 lemmy.zip heartSagan5@lemmy.zip
Joined: 2026-05-27
#68 · Quote Reply

Stop with the passive aggressive “btw,” please. It was used by gloating Arch users, and it’s not a great look.

-13
heartSagan5 lemmy.zip heartSagan5@lemmy.zip
Joined: 2026-05-27
#69 · Quote Reply

Hackers still doing cryptominers nowadays? C'mon, get with the times, install a LLM model on people's computers instead.

The cryptomining still potentially pays, the LLMs just cook the user’s hardware.

11
heartSagan5 lemmy.zip heartSagan5@lemmy.zip
Joined: 2026-05-27
#70 · Quote Reply

i run mine through wireguard, but also think i do have its port open to the wider web using the plex signon they push. i’m prob fucked huh? pfft. turned off remote access and the port forward. checked svr for exploit. updated plex. updated wireguard while at it. dont need remote access anyway.

It’s always amazing at how many crawlers/pentest kits are hitting my well-known ports.

3
heartSagan5 lemmy.zip heartSagan5@lemmy.zip
Joined: 2026-05-27
#71 · Quote Reply

Until they make a code change that forces a key to stream to an app or run at all. Jellyfin is actually a fork of the original Emby code before they closed sourced it and started down the bad path.

I just stream over SMB, much less fuckery tbh.

-2
non_burglar lemmy.world non_burglar@lemmy.world
Joined: 2023-06-16
#72 · Quote Reply

[removed by moderator]
[removed by moderator]
1
ButteryMonkey piefed.social ButteryMonkey@piefed.social
Joined: 2025-06-25
#73 · (edited) Quote Reply

I got all worried and updated (I basically never do) and then went to put in my password to log back in and then go searching for payload files and whatever, and wouldn’t you know it I was smart as shit and made the password tell me in no uncertain terms that I changed it for exactly that problem! Could stop worrying!

I did it because I was annoyed at having to do it I'm sure, but man it turns out that was a great idea!

2
halcyoncmdr piefed.social halcyoncmdr@piefed.social
Joined: 2026-01-15
#74 · Quote Reply

IDK why everyone here is in love with Jellyfin when we have Stremio/Nuvio. Jellyfin is a lot of work; with Nuvio all you do is browse like Netflix, and stream. No existing media library required.

Ah yes, the better option is to... use a streaming service that works by downloading random bittorrents in a completely opaque manner you have little to no control over.

17
Default Username lemmy.dbzer0.com defaultusername@lemmy.dbzer0.com
Joined: 2025-06-12
#75 · Quote Reply

I think it's not a widely used phrase yet

So what you're saying is that you're using it before it's cool...

4
Nibodhika lemmy.world Nibodhika@lemmy.world
Joined: 2023-06-10
#76 · Quote Reply

No nix is the new arch. Lol

I used to use Arch, now I use Nix, so that checks out

8
Nibodhika lemmy.world Nibodhika@lemmy.world
Joined: 2023-06-10
#77 · Quote Reply

Everyone talks about Jellyfin, but I just switched to Emby and I couldn't be happier (no connect cloud stuff). Can someone please let me know why and how I just made the worst decision of my life please.

Jellyfin is a fork of Emby before they closed the code, so most likely everything you have on Emby you would have on Jellyfin but without the worry that tomorrow Emby will pull a Plex onto you. Up until a while ago they were so alike that you could use Emby client on a Jellyfin server, not sure if that's still possible though.

7
VibeSurgeon piefed.social VibeSurgeon@piefed.social
Joined: 2026-01-15
#78 · Quote Reply

Everyone talks about Jellyfin, but I just switched to Emby and I couldn't be happier (no connect cloud stuff). Can someone please let me know why and how I just made the worst decision of my life please.

Jellyfin is based on the Emby-codebase before they relicensed it as closed source.

7
peppericecream lemmy.dbzer0.com peppericecream@lemmy.dbzer0.com
Joined: 2024-07-27
#79 · Quote Reply

How do I get my grandparents tv on a vpn

You could put a Site2Site VPN on their router and your router. Bonus points if you use firewall rules to allow only your media server instead of your whole network.

1
Blue_Morpho lemmy.world Blue_Morpho@lemmy.world
Joined: 2023-11-14
#80 · Quote Reply

Not if your Jellyfin is set up correctly. Read-only, rootless container with only the cache/transcode/config folders mounted RW+noexec - ideally both with a volume size limit. Reverse proxy only the absolutely minimal ports needed, with some security measures (e.g. crowdsec transparent proxy, hooked up to both your firewall and reverse proxy to block malicious actors.

The start of this thread is "number one reason people don't move to Jellyfin is ease of remote access."

30 years ago I was compiling slackware and configuring dns servers, and setting up BGP on Ciscos. But a few hours of attempting to setup Jellyfin was a failure. It was far more complex than setting up dns/bind.

2
whoisearth lemmy.ca whoisearth@lemmy.ca
Joined: 2023-07-03
#81 · Quote Reply

Also I use Jellyfin btw. Oh god, its the new Arch isn't it...

I'm waiting to see the elusive Arch, Jellyfin Vegan stack in the wild. We know they exist and they are fucking telling everyone

11
ExcessShiv lemmy.dbzer0.com ExcessShiv@lemmy.dbzer0.com
Joined: 2024-04-23
#82 · Quote Reply

I'm waiting to see the elusive Arch, Jellyfin Vegan stack in the wild. We know they exist and they are fucking telling everyone

You will find them in their natural habitat, the crossfit/hyrox gym.

7
DonutsRMeh lemmy.world DonutsRMeh@lemmy.world
Joined: 2025-03-13
#83 · Quote Reply

Someone please educate me, in case I’m missing something. Is there an excuse left why people use plex, not jellyfin? It’s now basically on every platform and even supports music and audiobooks.

-1
Bronzie sh.itjust.works Bronzie@sh.itjust.works
Joined: 2023-06-09
#84 · (edited) Quote Reply

Someone please educate me, in case I’m missing something. Is there an excuse left why people use plex, not jellyfin? It’s now basically on every platform and even supports music and audiobooks.

Some paid for lifetime and enjoy it. Or prefer the layout. Or prefer the easier sharing if data with family and friends.

There are still reasons to run Plex over Jellyfin for some, but not many of they keep going the way they are.

14
fonix232 fedia.io fonix232@fedia.io
Joined: 2023-06-13
#85 · Quote Reply

The start of this thread is "number one reason people don't move to Jellyfin is ease of remote access." 30 years ago I was compiling slackware and configuring dns servers, and setting up BGP on Ciscos. But a few hours of attempting to setup Jellyfin was a failure. It was far more complex than setting up dns/bind.

It's literally just:

  • create docker container
  • forward FOUR ports: 8096, 8920, 7359(udp) for discovery, and 1900(UDP) for DLNA to local network
  • forward a SINGLE port via reverse proxy: 8096 if your proxy handles HTTPS, 8920 if you want Jellyfin to handle HTTPS

I highly doubt that if somehow you were setting up BGPs at Cisco, this incredibly straightforward port setup somehow got the best of you.

2
fonix232 fedia.io fonix232@fedia.io
Joined: 2023-06-13
#86 · Quote Reply

The start of this thread is "number one reason people don't move to Jellyfin is ease of remote access." 30 years ago I was compiling slackware and configuring dns servers, and setting up BGP on Ciscos. But a few hours of attempting to setup Jellyfin was a failure. It was far more complex than setting up dns/bind.

Beside, that wasn't even the topic. We were discussing - or rather, I was proving to the above commenter - that setting up Jellyfin in a way that does not allow an intruder to crypto mine or host CSAM or use your device as a proxy, is incredibly easy.

Port setup and it's perceived impossibility by you has naught to do with that topic.

0
tko tkohhh.social tko@tkohhh.social
Joined: 2023-06-27
#87 · Quote Reply

Someone please educate me, in case I’m missing something. Is there an excuse left why people use plex, not jellyfin? It’s now basically on every platform and even supports music and audiobooks.

Because Plexamp is by far the best music player I've ever used.

8
baddu lemmy.world baddu@lemmy.world
Joined: 2025-03-09
#88 · Quote Reply

*defeats your purpose of Plex and Jellyfin I just want a media server. I have no use case to make it available to the public internet.

And who the fuck are you to speak for me? Some of us actually leave the basement.

4
hereiamagain sh.itjust.works hereiamagain@sh.itjust.works
Joined: 2025-08-15
#89 · Quote Reply

I was also impacted, you need to remove the payload that got dumped: Payload: /tmp/.pxb/{curl,wget}, /tmp/.spid Two processes named khungtaskd / cron They also stole your admin token so go to the Plex UI and log out of all devices for whichever account has ownership of the instance. Then you can reclaim ownership and it resets the admin token. You should likely be fine, I didn't have any crypto...

I checked tmp, and looked for suspicious processes or cron jobs, checked logs, I don't see any reason to think I was impacted.

So that's good.

1
NewNewAugustEast lemmy.zip NewNewAugustEast@lemmy.zip
Joined: 2025-06-19
#90 · (edited) Quote Reply

Stop with the passive aggressive “btw,” please. It was used by gloating Arch users, and it’s not a great look.

btw is passive agressive now?

How about quit reading tone into words and grow up a little.

2
numanair lemmy.ml numanair@lemmy.ml
Joined: 2023-06-09
#91 · Quote Reply

In reply to an earlier post

Except it makes sense to use

2
Trail lemmy.world Trail@lemmy.world
Joined: 2023-07-11
#92 · Quote Reply

btw is passive agressive now? How about quit reading tone into words and grow up a little.

Grow up a little, btw.

2
anewfox lemmy.zip anewfox@lemmy.zip
Joined: 2026-08-07
#93 · (edited) Quote Reply

Someone please educate me, in case I’m missing something. Is there an excuse left why people use plex, not jellyfin? It’s now basically on every platform and even supports music and audiobooks.

it becomes easier to understand when you look outside of your bubble for, like, a second.

if you want to try explaining to my eldery mother that lives 3000 miles away how to setup wireguard so she can access my jellyfin server on her smart tv, be my guest. oh you'll just do it remotely? ok, explain to her how to install and setup vnc and forward the right ports so you can remote in, oh but she doesn't want to watch on her laptop, she wants it on her tv. can't vnc into that.

or you can say "install the plex app and i emailed you your login details."

i'm a jellyfin user, but that's why people continue to use plex.

25
anewfox lemmy.zip anewfox@lemmy.zip
Joined: 2026-08-07
#94 · Quote Reply

Ah yes, the better option is to... use a streaming service that works by downloading random bittorrents in a completely opaque manner you have little to no control over.

my jellyfin server continues to work if my internet is down. the choice is simple.

3
Blue_Morpho lemmy.world Blue_Morpho@lemmy.world
Joined: 2023-11-14
#95 · Quote Reply

It's literally just: create docker container forward FOUR ports: 8096, 8920, 7359(udp) for discovery, and 1900(UDP) for DLNA to local network forward a SINGLE port via reverse proxy: 8096 if your proxy handles HTTPS, 8920 if you want Jellyfin to handle HTTPS I highly doubt that if somehow you were setting up BGPs at Cisco, this incredibly straightforward port setup somehow got the best of you.

Not at Cisco. With a Cisco. I ran a mid sized ISP in the 90's until I was bought out by a cable company and retired. Although several of my employees went on to work at Cisco. I also had a few friends who were executives at Cisco because we all started at a company working for Vint Cerf and Bob Khan (they were the angel investors) back before most knew of the Internet.

First it's a VM because I'm not going mess around with stuff on bare metal. Create docker is a can of worms because you have to pick a reverse proxy software like nginx, traefik, caddy. Which means you need to understand all three to know which to pick. Then there's setting up the certificate with the dns provider. So I got nginx working with a certificate but gave up after the VM running Jellyfin couldn't see it. Googling showed someone on Reddit with the same problem but no answer other than others saying "works for me"

1
fonix232 fedia.io fonix232@fedia.io
Joined: 2023-06-13
#96 · Quote Reply

Not at Cisco. With a Cisco. I ran a mid sized ISP in the 90's until I was bought out by a cable company and retired. Although several of my employees went on to work at Cisco. I also had a few friends who were executives at Cisco because we all started at a company working for Vint Cerf and Bob Khan (they were the angel investors) back before most knew of the Internet. First it's a VM because I...

First it's a VM because I'm not going mess around with stuff on bare metal.

Containerisation method doesn't matter, the point is to have an untrusted container (VM, thin container, LXC, whatever) that a process cannot exit, has no root user rights, and can be limited externally for what resources it sees.

The entire point is to be able to say "here's your config folder where you can write shit, but not execute; here's the data folder where you can neither write or execute shit; and here's the read-only executable layer of the image/VM/container".

Create docker is a can of worms because you have to pick a reverse proxy software like nginx, traefik, caddy. Which means you need to understand all three to know which to pick.

Regardless how you're hosting it, a reverse proxy is necessary. Even with a VM.

Here's a fun fact: Caddy and Traefik both come with ways to easily configure all the necessary things via Docker container labels. I need about 3-4 labels per container to set up the subdomain I need, the port I want to forward to it, and the security level (auth, crowdsec, etc.)

Then there's setting up the certificate with the dns provider.

Uh what? ACME makes it a literal one line configuration. Two if you include the DNS host scoped token.

So I got nginx working with a certificate but gave up after the VM running Jellyfin couldn't see it. Googling showed someone on Reddit with the same problem but no answer other than others saying "works for me".

So the problem wasn't Jellyfin but you not being able to follow a dead simple guide. And to think you were running a whole ass ISP...

1
RxBrad infosec.pub RxBrad@infosec.pub
Joined: 2024-08-04
#97 · Quote Reply

My Plex is updated, and hiding behind a random-long-text-string wildcarded subdomain that (so far) has not been discovered.

My Crowdsec intercepted 5X the normal number of hacking attempts & port scans on October 17th... no doubt from dirtbags trying to exploit this.

6
Encrypt-Keeper lemmy.world EncryptKeeper@lemmy.world
Joined: 2023-07-03
#98 · (edited) Quote Reply

Someone please educate me, in case I’m missing something. Is there an excuse left why people use plex, not jellyfin? It’s now basically on every platform and even supports music and audiobooks.

Because Jellyfin is an ugly, duct-taped-together mess. It’s very utilitarian at best, when everything is working. Ease of use is just not there for your non-technical friends and family.

Invariably whenever you bring any of these issues up, people will come out of the woodwork and tell you “Oh you just have to bolt this thing on or use it in this one specific unintended way in order to get it working halfway towards what you want”.

0
DonutsRMeh lemmy.world DonutsRMeh@lemmy.world
Joined: 2025-03-13
#99 · (edited) Quote Reply

it becomes easier to understand when you look outside of your bubble for, like, a second. if you want to try explaining to my eldery mother that lives 3000 miles away how to setup wireguard so she can access my jellyfin server on her smart tv, be my guest. oh you'll just do it remotely? ok, explain to her how to install and setup vnc and forward the right ports so you can remote in, oh but she ...

I’m having a hard time understanding why you need all of that to just log into your jellyfin when you’re not home! You don’t need wireguard, or VNC or any of that jargon. That is something you chose to do for some reason. I can do it with literally the same way you said it

"install the plex app and i emailed you your login details."

Replace plex with jellyfin. Your mother won’t need to do anything but downloading the app and put in the credentials and the server address which is in your face once you launched the app. Get a domain from cloudflare for $10 a year and set it up on the server. That’s it. No need for wireguard. I did the same thing for my friend who uses my jellyfin. I only sent him username and password and server address. That’s it.

0
DonutsRMeh lemmy.world DonutsRMeh@lemmy.world
Joined: 2025-03-13
#100 · Quote Reply

Because Plexamp is by far the best music player I've ever used.

That’s fair. I don’t use it, so I don’t know what I’m missing. Navidrome has been fantastic. And it has great frontends on both IOS and Android. I’ve personally built my own frontend that I’ve been using for the better part of a year.

3
Encrypt-Keeper lemmy.world EncryptKeeper@lemmy.world
Joined: 2023-07-03
#101 · Quote Reply

Hackers still doing cryptominers nowadays? C'mon, get with the times, install a LLM model on people's computers instead.

Running your own crypto miners doesn’t make sense anymore because the cost of electricity. Running a crypto miner using someone else’s electricity on the other hand…

5
Post Reply Page 2 of 3   Goto page « First 1, 2, 3 Last »
Back to top