Mastodawn

Bruce Simpson, Ph.D.

@nerowild But it totally "Optimizes" your "Delivery" du00d!!!!!! That's why it's called "Delivery Optimization", isn't it?? /s

@bms48 In my opinion:

Security risks, Breach of confidentiality
Potential exposure of:
- Internal IP address
- Download metadata
- If the Internet option is enabled, interaction with unknown peers
The risks are low to moderate (non-sensitive data, but network traceability is exposed)

Unauthorized access to IT services, opening of additional incoming/outgoing network flows
Expanded attack surface (ports used for P2P)
Risks are moderate if not controlled by a firewall

To be continued

Bruce Simpson, Ph.D.Apr 7

@nerowild Yeah, MSFT DO really doesn't like being behind WireGuard at all, and even if you already have a Windows HTTP system-wide SOCKS5 proxy configured by the OS's own bloody documented mechanisms, somehow DO just wants to be different for the sake of being different. It's emblematic of the company's continued decline in quality and credibility.

Data exfiltration, not designed for exfiltration, BUT:
- Additional network channel exploitable in the event of a compromise
- Can be hijacked to mask traffic
Risks are low to moderate (pivoting possible)

Logical attacks, theoretical risk:
- Injection of malicious packets
- Man-in-the-Middle attack (mitigated by Microsoft signature)
Risks are low (strong Microsoft integrity checks), but not zero

To be continued

Impersonation, unlikely directly BUT a compromised device can act as a “legitimate” peer
Risks are indirect

Increased exposure to threats:
- P2P enabled, increased network surface area
- Especially if the “Internet” option is enabled
Risks are moderate to high (depending on configuration)

Availability, consumption of:
- Bandwidth
- CPU / disk
- May impact critical workstations or sensitive networks
Risks are moderate (especially in restricted networks)

To be continued

Data integrity:
- Updates are signed (Microsoft)
- Robust cryptographic validation
Risks are low (strong control)

Organizational disruptions:
- Difficulty with control / visibility
- Increased network complexity without governance
Risks are moderate

Therefore, the real challenges are:
- Increased network surface area
- Lack of traffic control
- Uncontrolled Internet usage
- Impact on network performance

To be continued

My recommendations:
- Enable ONLY on the LAN
- Disable sharing via the Internet
- Restrict via GPO, Local Network Only mode
- Control via firewall (DO ports)
- Limit bandwidth (QoS / policy)

Control measures
- Logging, monitor Delivery Optimization traffic
- Segmentation, block between sensitive zones
- Endpoint security, validate integrity via EDR (Trellix in your case)
Therefore, allowed only on a controlled internal network
- Prohibited via the Internet
- Must be governed (GPO, firewall, monitoring)
😉

Bruce Simpson, Ph.D.Apr 7

@nerowild That is pretty much what you end up doing to stop MSFT DO misbehaving behind 4G LTE or in other constrained environments. The slop factor of the MSFT platform continues to proliferate, even without the GenAI risks.