DJ Got Us Fallin' in Creds - How Rekordbox Hands Your Entire Hard Drive to the Dance Floor

The speaker, a DJ, producer and builder of a Twitch now-playing tool, set out to understand Pro DJ Link, the protocol that lets Pioneer and Alpha Theta players talk to each other. While working with it, they found that Rekordbox, the popular DJ software, starts an NFS-based export service when a laptop is linked over the network. That service exposes the whole drive rather than only the music library, and the sole gate is a constant value built into the protocol that the open-source community has known about for years.

Rekordbox also does not restrict which file paths a client may request, so any device on the same subnet that presents that value can read files such as SSH keys, cookies and browser history. The speaker frames this as a confused deputy problem: the authentication behaves as designed, but the software acts with the full rights of the logged-in user. A live demo showed a remote machine listing exported volumes and pulling a file from a user folder with a short script. The affected platforms include the desktop app on Windows and macOS, the mobile apps on Android and iOS, and hardware with a file system. Fixes were staggered, with desktop patches due soon, mobile in August, and hardware firmware expected to take longer.

The obvious fix, hardening the shared credential, is difficult because the value has shipped in firmware since 2009 and changing it would stop existing gear from connecting in clubs. Narrowing the NFS scope to music folders is also nontrivial given libraries of tens of thousands of tracks. Disclosure followed a 90-day timeline coordinated through a community contact. Practical advice is to update Rekordbox, disable Pro DJ Link when it is not needed, and keep sensitive files off USB media used at venues.