Is Your Plex Server Mining Crypto for Hackers? How to Check and Fix It

Attackers are breaking into Plex servers that were never updated and using them to mine cryptocurrency.

The fix is simple: update Plex Media Server to version 1.43.3 or newer.

If your server has been running slow, hot and loud lately, read on - it may already be working for someone else.

Here is what is going on, how to check your own server, and what to do if it looks infected.

What Happened

A security researcher found four bugs in Plex Media Server that can be chained together, nicknamed "Plex2Shell". Used together, they let an attacker on the internet run their own code on your server without a password.

Plex fixed them in version 1.43.3 and asked everyone to update in early September. The full technical details went public on 16 October, and attacks started the next day, The Hacker News reports.

Attackers are installing two things on servers they break into:

• A cryptominer. It uses your processor to earn cryptocurrency for someone else, which is why the machine runs hot.
• Proxy software. It quietly rents out your internet connection to strangers.

Signs Your Plex Server Is Infected

A miner wants as much processing power as it can get, so it is rarely subtle. Watch for:

• High CPU use when nobody is watching. Your fans spin up and the machine stays warm with nothing playing.
• A slow server. Streams buffer or transcoding struggles on hardware that used to cope fine.
• Strange processes. Users have reported names like mylovelyminer and myawesomeproxy.

On Windows, press Ctrl + Shift + Esc to open Task Manager and sort by CPU. Anything you do not recognise near the top, while Plex is idle, is worth a closer look.

How to Check Your Plex Version and Update

• Check your version. Open Plex in your browser, go to Settings and look under General for your server - the version number is shown there.
• Update if it is older than 1.43.3. On Windows, right-click the Plex icon in the taskbar tray and check for updates, or grab the installer from the official Plex downloads page.
• On a NAS or in Docker, update by hand. NAS app stores can lag behind, and a Docker container keeps its old version until you pull the new image and recreate it.
• Turn off Remote Access if you do not need it. It is under Settings, Remote Access - a server that is not open to the internet cannot be reached by these attacks.

If Your Server Looks Infected

Updating closes the door, but it does not remove anything already inside. The attack plants its file in Plex's Codecs folder, so stopping the miner process alone may not be enough.

• Update first, then delete the Codecs folder. On Windows it is at %LOCALAPPDATA%\Plex Media Server\Codecs by default - Plex downloads fresh codecs on its own.
• Change your Plex password. Then use "sign out of all devices" in your Plex account settings.
• Scan the whole machine. Run a full Microsoft Defender scan on Windows.
• When in doubt, rebuild. A clean reinstall, or a fresh Docker container, is the only way to be completely sure.

Thinking About Leaving Plex?

If this is the push you needed, Jellyfin Server is free and open source, and Emby works much like Plex. Just remember that any media server you open to the internet needs the same care - keep it updated.

And if you only watch on one PC or TV box, you may not need a server at all. VLC media player and Kodi play your files directly, with nothing exposed to the internet.

Quick questions