News for hackers. Stuff that matters.

A comment on Microsoft is phoning home the content of your PowerPoint slides. Parent comment

Re:Microsoft is phoning home the content of your PowerPoint ... by prmoustache on Monday November 07, 2022 @02:06PM (#33510649)
From what I understand opensnitch use ebpf to match where the exiting packets are going. TCP being TCP, it is easy to know where the incoming answer will be delivered to as well.
[ Parent | on HN ]
Re:Microsoft is phoning home the content of your PowerPoint ... by squarefoot on Monday November 07, 2022 @03:01PM (#33511534)
Not sure if this would work also for connectionless protocols such as UDP. That is, if I open a socket and send some datagrams to an external address:port to exfiltrate users data, then close the socket and exit, I don't think it would be able to tell which program did that, unless it detects it live.
[ Parent | on HN ]
Re:Microsoft is phoning home the content of your PowerPoint ... by prmoustache on Monday November 07, 2022 @03:42PM (#33512121)
I believe opensnitch catches them.
[ Parent | on HN ]