Was just a matter of time...and much more will come.
what do you mean?
CVE-2022-41924 – tailscaled can be used to remotely execute code on Windows
71–80 of 147 posts
Re: CVE-2022-41924 – tailscaled can be used to remotely execute code on Windows
#72> In theory, there is no path for a malicious Tailscale control plane to remotely execute code on your machine, unless you happen to run network services that are designed to allow it, like an SSH server with Tailscale-backed authentication.
Now I feel less crazy for not using Tailscale SSH for similar reasons.
I'd like to see a security evaluation of Tailscale, on a per feature basis.
I'd like to see tailscaled run with far fewer privileges.
Is there a Tailscale alternative that just does Wireguard + NAT traversal and doesn't try to do key management?
Re: CVE-2022-41924 – tailscaled can be used to remotely execute code on Windows
#73I'm not sure I've ever seen a detailed technical writeup of a vulnerability before that started with such clear and concise instructions on the exact steps needed to defend against it at the start of the article before. In particular, making clear the priority of what to patch is excellent. If I'm a user of a product where a bug was found, I'm definitely interested in learning about what the bug was, how it was disco…
I call this the "Vulnerability view" instead of a "Remediation view" and its something I feel a lot of Security people and tooling gets wrong when sharing information with those outside our bubble.
It is dead easy to export a vulnerability scan or penetration test report and throw it at the developers, but you will get much better outcomes and better rapport if you tell them what they need to do (i.e. patch to version x.x.x) versus telling them what is wrong ("the sky is falling!").
Re: CVE-2022-41924 – tailscaled can be used to remotely execute code on Windows
#74Technical write up by the security researcher at https://emily.id.au/tailscale ps. she's looking an employer rn // hire her!
where does she say she is looking for an employer? Would be worthwhile to start a conversation with her.
Em interned with me earlier this year. Have passed the threads over to her.
Re: CVE-2022-41924 – tailscaled can be used to remotely execute code on Windows
#75Super interesting article, and TIL Firefox does not implement PNA (Private Network Access).
Does anyone know why? It seems like an obviously good thing to have.
Re: CVE-2022-41924 – tailscaled can be used to remotely execute code on Windows
#76Technical write up by the security researcher at https://emily.id.au/tailscale ps. she's looking an employer rn // hire her!
can you DM me her email? I can't find it anywhere and I'd love to start a chat with on a security position at my work.
Have passed your comment over to her. The website has been updated with an email address.
Re: CVE-2022-41924 – tailscaled can be used to remotely execute code on Windows
#77I'm not sure I've ever seen a detailed technical writeup of a vulnerability before that started with such clear and concise instructions on the exact steps needed to defend against it at the start of the article before. In particular, making clear the priority of what to patch is excellent. If I'm a user of a product where a bug was found, I'm definitely interested in learning about what the bug was, how it was disco…
Also interesting was this recommendation: "Keep using Tailscale!
The speed and quality of Tailscale's response to our report is unlike any vendor interaction I have experienced, and suggests a deep commitment to keeping their customers safe."
Every product has security issues now and then. The real challeng is building robust processes remediate them (and to ensure that class of issue doesn't reoccur). The teams that deliver, by being transparent and fixing their stuff in a timely way, get my business.
Re: CVE-2022-41924 – tailscaled can be used to remotely execute code on Windows
#78Re: CVE-2022-41924 – tailscaled can be used to remotely execute code on Windows
#79Earlier quoted context omitted.
[co-author of the research here] They actually approximate this functionality in the Windows implementation: It checks netstat to enforce that incoming TCP connections are from the expected Windows user! https://github.com/tailscale/tailscale/blob/2a991a3541ae5d56... That's why we were happy with the solution they implemented as a stopgap, until they could switch to named pipes (which there is now an open PR for).
Huh, ok, that's not so bad then. It feels like there could still be a TOCTOU issue there, but it'd be difficult to use.
Generally speaking, allowing privileged operations because a specific user asked over a TCP socket is asking for trouble: there are quite a few ways that unwitting processes could open a socket on behalf of an attacker without realizing that it is asserting its identity and thus granting privilege.
All the major cloud get this IMO entirely wrong with their services that issue secrets to instances (e.g. AWS IDMS).
Re: CVE-2022-41924 – tailscaled can be used to remotely execute code on Windows
#80Heads up that I had to update through the UI twice - first brought me from 1.30.x 1.32.2, then second to 1.32.3.