Syncthing Downloads from GitHub

[canton7 (Antony Male)]

@cydron

I used to write C# apps for Windows running as LocalService / LocalSystem all the time … I don’t think there’s anything inherently wrong with that process. That’s usually better for something that’s a pure server - - like Windows NT or Windows Server etc.

See posts such as

Windows Autostart: Service or Start-On-Login. Comments please!

The point is that if a user executes a malicious file, that file runs with the user’s permissions. It can only change things the user has permission to change. But… If Syncthing is running as a local admin, and doesn’t have a GUI password set up, any process can talk to Syncthing. Even the most unprivileged process can open a connection on port 8080 and talk to its REST API. It can ask Syncthing to set up a folder anywhere (since Syncthing, running as local admin, has permission to do anything…

The problem arises when running Syncthing as something privileged and not enabling authentication. The difference between Syncthing and any other services you may have been running as LocalSystem / LocalService is that Syncthing can be instructed to read/write any file it has permission to access by anyone who can open a connection on localhost:8080.