But it's their device, you're installing it in your network - if they wanted to do something malicious, they would. If you shut down the tunneling method detai

But it's their device, you're installing it in your network - if they wanted to do something malicious, they would. If you shut down the tunneling method detailed in the article, they could just add an endpoint like: GET /latest-command that resolved to a shell script to be run periodically. > start exfiltrating customer data If it's data that they're supposed to have access to, they're already doing that. If it's data they're not supposed to have access to, the correct fix here is to DMZ the box they're installed on, not to try to (hopelessly) limit their outbound connectivity.