How to know that Syncthing isn't full of malware? (New install: immediate connect to hundreds of IPs and bogus telecom services)

Feature
1

Brand new install of Syncthing. As soon as I start it up, my firewall alerts me to Syncthing trying to connec to:

  1. aebc .com
  2. voipstunt .com
  3. voipbuster .com
  4. 1und1 .de
  5. sipgate .net
  6. miwifi .com
  7. internetcalls .com
  8. hitv .com
  9. counterpath .com
  10. … 67 bare IP addresses

All blocked, thankfully… At which point I instantly kill Syncthing and decided it likely had some malware in the build.

Some research later, yes, I see that all those connection attempts might have been because of relaying. It’s hard to say. I mean, all those VOIP sites, etc., do not look legit to me.

Still deciding if I want to re-install Syncthing.

Here’s a suggestion, though: If these are legitimate relays, perhaps make it more clear what the heck is going on inside Syncthing:

  1. Maybe Relaying should be off be default?
  2. Once turned on, some kind of clear message displayed or query about which relays to connect to?
  3. Possibly a switch: distinguish between my (private) relay and just “open up to anything on the internet?” (I’ll never do the latter).
1 Like
2

Please see https://docs.syncthing.net/users/faq.html#why-does-syncthing-connect-to-this-unknown-suspicious-address. You can always disable relays completely, or run your own, or be selective and specify only those you want to connect to.

2 Likes
3

Relaying is an essential part of making the installation and connection establishment actually work out of the box for normal users. Not having it enabled by default would be a net loss in functionality, for no increase in security.

3 Likes
4

As you figured out there was never any malware. (Assuming you used the official release. Maintainers can’t be sure what’s in other releases.)

The reaching out to those servers is safe and harmless. The vast majority of people don’t know it’s happening and shouldn’t necessarily care. They install syncthing and they want it to “just work.” Relaying is a feature that helps it just work for people behind NAT, which is probably most of them.

I don’t see any issue with relays being enabled by default.

What’s the issue?

5

The 9 domains look like STUN servers. The 67 bare IP addresses are probably relays.

6

You could take the approach of Synctrain iOS, and ask during initial config. Synctrain gives the user two choices, explaining exactly what each one is (relaying on vs. relaying off). One click on the iOS devices and you are nicely configured and well-informed.

1 Like
7

The issue is that it has exactly the signature of malware, and there is no explanation up-front about what it’s going to do (and no confirmation beforehand).

1 Like
8

Well and good for someone that reads that FAQ ahead of time. For everyone else, it looks like malware. My point is that it’s not a good configuration “out of the box” combined with no up-front confirmation about what it’s about to do.

1 Like
9

Non of my malware detection flagged it as malware. Not sure what tools you are using.

1 Like
10

Little Snitch firewall. Immediately popped up with a long list of suspicious looking outgoing connection attempts (domains like voipstunt .com and voipbuster .com) as well as 67 random IP address (reverse DNS on a few, and didn’t like the look of them… so blocked everything and killed it).

1 Like
11

Okay so the little snitch just alerted you to traffic. It don’t make any judgment about whether the traffic was a sign of malware

you were the malware detector and detected a false positive.

that’s fine. It’s not necessarily a bad idea to monitor traffic and stop what you don’t like.

12

This has been discussed many times before, but the conclusion has always been that it’s better to make Syncthing work for the average user by default without having to fiddle with the configuration. For example, relays will be required when using Syncthing on a mobile network, which is one of the most common use cases.

If you’re on a more technical side, you can simply switch what you don’t like in the configuration off. The same cannot be said about someone who’s less tech-savvy and has no idea about what the technical terminology even means.

5 Likes