Sonos patches password exposure flaw

Stephen Withers
Wednesday, 25 January 2012 15:01

Your IT - Entertainment

While we're used to installing security updates for our computers, tablets and smartphones, a security patch for audio gear is something new. Sonos has released an update for its wireless audio products to fix a problem that has the potential to expose login details for paid services.

Microsoft Office 365

Related Articles

• iOS 5.0.1 update fixes battery blues - or does it?
• iOS 5 arrives
• Sonos pushes play on its Play:3 system
• Whole of house coverage from Buffalo wireless router
• HP Photosmart eStation all-in-one includes Android tablet

One of the nifty features of the range is the ability to stream music and other audio content from services such as anubis.fm and Stitcher.

Sonos has advised registered users of its products that the latest version of the Sonos software - 3.6.1 - "fixes a bug that, in rare cases, could allow someone to access the usernames and passwords of services used on your Sonos. Currently, we are not aware of any customer data being compromised."

The problem is that if an attacker exploited the issue to obtain those usernames and passwords, they could be used to 'pirate' the subscriber's content. There's also the possibility of changing the password and contact details to lock out the real subscriber while continuing to enjoy the content for free.

Potentially more serious is the situation where a service uses email addresses as usernames, and the same username/password combination is used with other services (not good practice, but it does happen). An attacker could then access those services.

Sonos asks its customers to update their devices as soon as possible: "To update, simply go to System Settings on any Sonos Controller and select Online Updates."