Constant spam of Device syncthing-xxxx wants to connect

[himenez]

Using syncthing-fork android.

Whenever I go onto any wifi or mobile data, I’m getting a device connect attempt.

I’m sure I mistakenly added that device at some point, as my device was accepting connections over mobile internet - an option I had to enable for syncthing to run over wireguard.

The device name was “Desktop”, which is a valid (and apparently, obviously generic) name of one of my syncthing machines. Ip of 188.119.191.45, apparently a VPN service in Romania.

The device upon being added asked to share all shares within syncthing. I tested one out and sure enough it was happy to download my audiobooks.I removed the device, but it seems to be repeatedly trying to re-add me.

Can someone explain what happened?

[marbens (Marcus B Spencer)]

Choose “ignore” to make the notification go away for good. There’s not a “dismiss” button like the Syncthing web GUI has.

If you swipe the notification away, it will just give you a prompt every time it starts.

[himenez]

Is there any way I can audit what was shared, or understand the scope of the breach?

[marbens (Marcus B Spencer)]

Syncthing only shares the folders you choose to share with the device.

[marbens (Marcus B Spencer)]

@himenez

188.119.191.45

That’s one of the Syncthing relays. Are you sure this is not your legit “Desktop” device connecting via a relay?

[himenez]

No, but upon checking closer, it is a third device I own, a NAS.

This is puzzling, as I haven’t made any configuration changes to my network for months, and prior to a couple of days ago, I needed to be on VPN to synchronize data.

Thanks for your help!