Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

CVE-2022-41924 – tailscaled can be used to remotely execute code on Windows

emily.id.au

Post reply on HN
Print view View original

91–100 of 147 posts

Re: CVE-2022-41924 – tailscaled can be used to remotely execute code on Windows

#91

Post by infotogivenm »

freedinosaur wrote: post #72

> In theory, there is no path for a malicious Tailscale control plane to remotely execute code on your machine, unless you happen to run network services that are designed to allow it, like an SSH server with Tailscale-backed authentication. Now I feel less crazy for not using Tailscale SSH for similar reasons. I'd like to see a security evaluation of Tailscale, on a per feature basis. I'd like to see tailscaled run…

Yep. Same boat. Absolutely zero interest in granting them ssh authZ; transport wrapping is all I want to outsource. Just deliver my bits and I pay you, tyvm. My suspicions have been proven correct here.

Unfortunately reading about this remote RCE vector has me wondering whether I can use the product at all without all this bloat (taildrop, ssh, etc) affecting me. Going to have my team look at zerotier this week, I’ve heard a few ok things.

Re: CVE-2022-41924 – tailscaled can be used to remotely execute code on Windows

#92

Post by anderspitman »

klabb3 wrote: post #86
freedinosaur wrote: post #72

> In theory, there is no path for a malicious Tailscale control plane to remotely execute code on your machine, unless you happen to run network services that are designed to allow it, like an SSH server with Tailscale-backed authentication. Now I feel less crazy for not using Tailscale SSH for similar reasons. I'd like to see a security evaluation of Tailscale, on a per feature basis. I'd like to see tailscaled run…

> Is there a Tailscale alternative that just does Wireguard + NAT traversal and doesn't try to do key management? I really wish there was a NAT traversal protocol or library that wasn't overly complex and focused on the 90% cases. It would help not just tailscale's but anyone building p2p tech.

I believe libp2p has some NAT traversal stuff: https://docs.libp2p.io/concepts/nat/

Re: CVE-2022-41924 – tailscaled can be used to remotely execute code on Windows

#93

Post by freedinosaur »

anderspitman wrote: post #92
klabb3 wrote: post #86

Earlier quoted context omitted.

> Is there a Tailscale alternative that just does Wireguard + NAT traversal and doesn't try to do key management? I really wish there was a NAT traversal protocol or library that wasn't overly complex and focused on the 90% cases. It would help not just tailscale's but anyone building p2p tech.

I believe libp2p has some NAT traversal stuff: https://docs.libp2p.io/concepts/nat/

https://github.com/hyprspace/hyprspace is built on top of that. It's remarkably simple: libp2p's DHT + libp2p's NAT punching + TUN device.

I don't think it offers authn/authz, but that's fine: neither does my ISP. I just want SSH reachability.

Re: CVE-2022-41924 – tailscaled can be used to remotely execute code on Windows

#94

Post by beanjuiceII »

afhammad wrote: post #64
adam_arthur wrote: post #62

Does this mean we won’t get spammed with tailscale articles every day now?

This means you will see more of Tailscale. Vulnerabilities are inevitable, the actions taken in the hours (ideally) and days following the discovery is what matters most.

i would still rather see less considering where tailscale software sits in my privacy/security. at some point i'd ask why do i pay to use this swiss cheese ? (not saying thats the case, but if I were to continue to see more issues)

Re: CVE-2022-41924 – tailscaled can be used to remotely execute code on Windows

#95

Post by Thaxll »

meibo wrote: post #5

Do they have enough logs to reach out to people that were affected? As far as vulnerabilities go, this set is one is one of the worst ones I've seen this decade, and they seem rather straightforward. Would be nice to get a blog post from them that goes a bit into impact, not just a report that tells you to update. It's nice that they responded quickly, but I feel like this shouldn't have happened in the first place f…

"worst ones I've seen this decade"

It's not that bad actually.

Re: CVE-2022-41924 – tailscaled can be used to remotely execute code on Windows

#97

Post by modeless »

semi-extrinsic wrote: post #75

Super interesting article, and TIL Firefox does not implement PNA (Private Network Access). Does anyone know why? It seems like an obviously good thing to have. https://wicg.github.io/private-network-access/

Geez, yeah, I was going to say that it's clearly bonkers that DNS rebinding can trick the browser into communicating with loopback addresses, until I got to the part of the article that explained how there actually is a mitigation for that. Hopefully Firefox fixes that soon, because I shudder to think how many applications are vulnerable.

Re: CVE-2022-41924 – tailscaled can be used to remotely execute code on Windows

#98

Post by doublepg23 »

klabb3 wrote: post #86
freedinosaur wrote: post #72

> In theory, there is no path for a malicious Tailscale control plane to remotely execute code on your machine, unless you happen to run network services that are designed to allow it, like an SSH server with Tailscale-backed authentication. Now I feel less crazy for not using Tailscale SSH for similar reasons. I'd like to see a security evaluation of Tailscale, on a per feature basis. I'd like to see tailscaled run…

> Is there a Tailscale alternative that just does Wireguard + NAT traversal and doesn't try to do key management? I really wish there was a NAT traversal protocol or library that wasn't overly complex and focused on the 90% cases. It would help not just tailscale's but anyone building p2p tech.

I wonder if IPv6 will ever be the “path of least resistance” vs. NAT punching.

Re: CVE-2022-41924 – tailscaled can be used to remotely execute code on Windows

#99

Post by btdmaster »

semi-extrinsic wrote: post #75

Super interesting article, and TIL Firefox does not implement PNA (Private Network Access). Does anyone know why? It seems like an obviously good thing to have. https://wicg.github.io/private-network-access/

https://bugzilla.mozilla.org/show_bug.cgi?id=1481298

Re: CVE-2022-41924 – tailscaled can be used to remotely execute code on Windows

#100

Post by bobbylarrybobby »

hellcow wrote: post #15
tailspin2019 wrote: post #7

> The speed and quality of Tailscale's response to our report is unlike any vendor interaction I have experienced, and suggests a deep commitment to keeping their customers safe. I have mixed feelings here as a Tailscale customer. Yes a quick response is great, but this actual security issue is pretty terrible IMHO. Anything other than an immediate response would have been akin to lighting their company on fire and w…

> Anything other than an immediate response would have been akin to lighting their company on fire and walking away. Have we forgotten Zoom, who reinstalled itself secretly on user machines with an RCE-vulnerable server, which they described as “working as intended?” They’re still wildly popular today with organizations despite the insane lack of regard for security and their users’ safety. Mistakes happen. I applaud…

The users of tailscale and of zoom expect very different things from their respective software vendors
Post reply on HN