Zum Inhalt

Security news on suno: How suno ignores your privacy

I've just noticed with Vivaldi browser and a VM sandbox that suno is requesting global access to everything on your device without even asking for permission.

So whenever you access suno, your device is just for free for suno. They steal everything, even attack your device, especially on Windows. Still collecting data, but there is evidence that they use wrong signed LSA, WMI and register as IntelME Provider. I have frozen my Windows Version and had no updates from MS recently. After blocking WMI suno attacks the COM interface currently. This is not fun, this is a criminal conduct. Even if they only want to know what I write next.

On Linux VM they have attacked cups. As the only website I use in the VM is suno, there is no doubt about the origin. The logs showed unspectacular behavior first, some printer found and subscribed, some cancelled. Apart from numbers not fitting and root in there, it didn't call too much my attention. Btw. no active printer on my host but may be some default windows printer have been found.

    /var/log/cups/access.log
    localhost - - [09/Jun/2026:09:43:37 +0200] "POST / HTTP/1.1" 200 349 Create-Printer-Subscriptions successful-ok
    localhost - - [09/Jun/2026:09:43:37 +0200] "POST / HTTP/1.1" 200 176 Create-Printer-Subscriptions successful-ok
    localhost - - [09/Jun/2026:09:54:46 +0200] "POST / HTTP/1.1" 200 349 Create-Printer-Subscriptions successful-ok
    localhost - - [09/Jun/2026:09:54:46 +0200] "POST / HTTP/1.1" 200 176 Create-Printer-Subscriptions successful-ok
    localhost - - [09/Jun/2026:09:56:17 +0200] "POST / HTTP/1.1" 401 123 Cancel-Subscription successful-ok
    localhost - root [09/Jun/2026:09:56:17 +0200] "POST / HTTP/1.1" 200 123 Cancel-Subscription successful-ok
    localhost - - [09/Jun/2026:09:56:17 +0200] "POST / HTTP/1.1" 200 152 Cancel-Subscription successful-ok

Unnormal behavior

    /var/log/cups/access.log
    localhost - - [09/Jun/2026:19:27:01 +0200] "POST / HTTP/1.1" 200 349 Create-Printer-Subscriptions successful-ok
    localhost - - [09/Jun/2026:19:27:01 +0200] "POST / HTTP/1.1" 200 176 Create-Printer-Subscriptions successful-ok
    /var/log/cups/error_log
    E [09/Jun/2026:19:27:01 +0200] Filter \"rastertopwg\" not found.
    E [09/Jun/2026:19:27:01 +0200] Filter \"rastertopwg\" not found.

Easy solution (no printer, no cups)

    sudo apt purge cups

Analysing the logs I found that suno tried to log in as tty. So I've adjusted security settings. Excluded root from remote login and using tty* channels.

    /etc/security/access.conf
    -:root:tty1 tty2 tty3 tty4 tty5 tty6 #... and all tty I found in the logs
    /etc/pam.d/login
    auth       requisite  pam_nologin.so
    auth       requisite  pam_securetty.so

If you care about copyright of your lyrics, DON'T USE suno. No other way. You lose everything to suno. Even if you withdraw their "privacy rules". They just don't care at all.

Recommendation

Never use suno. Any chinese music AI is better and more reliable than suno.

If you use suno:

  • use suno in a Linux VM that has no shared drive and only connections going inside not outside the VM apart from internet access
    • Debian with XFCE is suitable also from performance aspects, remove everything you don't need, just a downsized client
  • use a browser that is half-save, like Brave or Vivaldi and supports uBlock Origin
    • Firefox web developer tools don't show ressources in Source in an acceptable way
  • install uBlock Origin - see documentation for getting the addon which will be soon disabled in Chrome Web Store
  • you may block scripts on client side, but on server side they are still executed with your rights and account session id
  • cleanup your browser after visiting suno.com
    • means everything, cache, cookies, application data, passwords ...
  • refresh often, it limits the ressources that suno uses on your device while you're logged in (just watch your browser memory and you'll see)
  • never use Windows, too less control, too easy to attack
    • as far as I noticed they attack Windows in various flavors from the browser, watch Wireshark and uBlock Origin protocol which may only help to identify the threat, Windows is just to unsafe
  • never use a Windows account with administrative rights (unluckily I did this because of gaming, that needs this sometimes and I regret)
    • don't believe a normal account is safe, it is only a bit more difficult to attack

My uBlock Origin rules

Some things I had to allow so suno works still for me. Global blocking for everything I've found on suno and don't need at all. Adjust the global section starting with * to your needs.

no-csp-reports: * true
no-large-media: behind-the-scene false
* ads-twitter.com * block
* bing.com * block
* bing.net * block
* browser-intake-datadoghq.com * block
* clarity.ms * block
* edge.prelude.dev * block
* d2hrivdxn8ekm8.cloudfront.net * block
* facebook.net * block
* google-analytics.com * block
* google.com * block
* googletagmanager.com * block
* m-chromadrone.prod.suno.com * block
* m-stratovibe.prod.suno.com * block
* openai.com * block
* prelude.dev * block
* singular.net * block
* tiktok.com * block
behind-the-scene * * noop
behind-the-scene * 1p-script noop
behind-the-scene * 3p noop
behind-the-scene * 3p-frame noop
behind-the-scene * 3p-script noop
behind-the-scene * image noop
behind-the-scene * inline-script noop
suno.com * 3p-frame block
suno.com * 3p-script block
suno.com accounts.google.com * block
suno.com ads-twitter.com * block
suno.com bing.com * block
suno.com bing.net * block
suno.com browser-intake-datadoghq.com * block
suno.com clarity.ms * block
suno.com d2hrivdxn8ekm8.cloudfront.net * block
suno.com facebook.net * block
suno.com google-analytics.com * block
suno.com google.com * block
suno.com googletagmanager.com * block
suno.com openai.com * block
suno.com prelude.dev * block
suno.com singular.net * block
suno.com tiktok.com * block
suno.com https://js.stripe.com script allow
suno.com https://js.stripe.com/dahlia/stripe.js script allow
suno.com https://suno.com/9i3s/ script allow

Does suno attack you? Find it out

First point is to look at cdn1.suno.ai and cdn2.suno.ai. If aura files change during the song creation on cdn1 you are most probably attacked by suno. If you find pictures in cdn2 that are not in your song library, you get attacked from suno, no doubt.

If you find any of the m- domains active, you get attacked, no doubt. Like:

  • m-chromadrone.prod.suno.com
  • m-stratovibe.prod.suno.com

There are other m- flavours like m-stripe.com which are covered by my third party blocking rules.