I’m not demonstrating anything. I’m showing what I see the NAS is querying outbound. I have the full URL file paths but didn’t post them, just the domains.

The data files that are pulled down from Synology servers are in itself encrypted and I don’t have a way to view them. I can assure you this data has been viewed by researchers and if it was malicious, you would have heard something.

I’m not a security researcher or expert by any means but as you know, the NAS is running Linux and has a SSH service which makes it super easy to connect and add a https content inspection certificate (which is exactly what I did). So I’m MITM’ing the device and inspecting the secure and non secure traffic. There is nothing suspicious happening.

The outgoing traffic is exactly what anyone would expect. Update queries, account queries, etc.

There’s no user data being uploaded to Synology. Meta data ? Sure. The device queries based on model type which lets Synology know what one you have for updating DSM and such.

When you make a Synology account you’re also giving Synology some basic info like IP, what apps you’re activating / installing, what type of things you’re backing up, the frequency etc. All this data is valuable telemetry.