I love Bitfocus Companion, but it seems like a big security hole. Anyone who can connect to the device can run an arbitrary shell command on the machine hosting the software. I’ve searched for ways to control this, but either my searching isn’t very good, or there isn’t an option for securing Companion.
Anyone tackle this issue.
I classify companion as a software that is to be run in fully trusted environments, ie, if someone has access to companion, I’d be more worried about their ability to ruin my production than to execute commands on the machine.
My assumption is that my firewall could be breached and a security hole on the other side could lead to ransomware. I’m not in a position to disconnect from the external network completely.