i might be mistaken but i think there was something else weird about the windows loopback interface. i can't remember what it was, but something like binding the loopback interface would bind on all interfaces by default maybe?
CVE-2022-41924 – tailscaled can be used to remotely execute code on Windows
111–120 of 147 posts
Re: CVE-2022-41924 – tailscaled can be used to remotely execute code on Windows
#112[deleted]
Re: CVE-2022-41924 – tailscaled can be used to remotely execute code on Windows
#113Technical write up by the security researcher at https://emily.id.au/tailscale ps. she's looking an employer rn // hire her!
That article has so much more information in it that I've changed the URL to that from https://tailscale.com/security-bulletins/#ts-2022-004 . Thanks!
I submitted it 7 hours ago, but it didn't get any traction with the original title https://news.ycombinator.com/item?id=33695800.
Re: CVE-2022-41924 – tailscaled can be used to remotely execute code on Windows
#114> In theory, there is no path for a malicious Tailscale control plane to remotely execute code on your machine, unless you happen to run network services that are designed to allow it, like an SSH server with Tailscale-backed authentication. Now I feel less crazy for not using Tailscale SSH for similar reasons. I'd like to see a security evaluation of Tailscale, on a per feature basis. I'd like to see tailscaled run…
https://github.com/jwhited/wgsd does NAT traversal with Wireguard, but you need to operate a CoreDNS server to do it.
More info on how it works: https://www.jordanwhited.com/posts/wireguard-endpoint-discov...
Re: CVE-2022-41924 – tailscaled can be used to remotely execute code on Windows
#115> In theory, there is no path for a malicious Tailscale control plane to remotely execute code on your machine, unless you happen to run network services that are designed to allow it, like an SSH server with Tailscale-backed authentication. Now I feel less crazy for not using Tailscale SSH for similar reasons. I'd like to see a security evaluation of Tailscale, on a per feature basis. I'd like to see tailscaled run…
> I'd like to see tailscaled run with far fewer privileges.
Yeah - I have a dislike for services running as root when it's not necessary, and then getting users to escalate to root to interact with them routinely.
One thing I was thinking about was trying to identify the Linux capabilities which let tailscaled run, and then look at if it's feasible to adjust the default systemd unit to run it as a non root user. Closely followed by then trying to harden up the service with as many of the recommendations as possible in "systemd-analyze security".
Despite there being a pretty good range of restrictions available, it seems to be pretty rare that service definitions actually come locked down... Might be something for the tailscale team to look at in future?
Re: CVE-2022-41924 – tailscaled can be used to remotely execute code on Windows
#116> We can ask Tailscale to open a path on an SMB share. Windows being Windows, it will send your username (and a hash of your login password) to this server, unprompted, despite having no reason to consider the server trustworthy.
Wow, I used to think Linux security was miles ahead of Windows security more than 20 years ago because of insanity like this. Fast forward 20 years. NTLMv2 is common, so cracking a password actually requires guessing the entire password instead of just 8 characters. But password guesses are much cheaper, so we haven’t gained much.
Microsoft, how long will it take you to fix this for real? Opening a URL or UNC path should not, without an opt-in, authenticate at all. If configured to authenticate, it should prove, zero-knowledge, to the server that the supplied password (e.g. the logged-in user password) matches the server’s expected password. No further information should be leaked.
Re: CVE-2022-41924 – tailscaled can be used to remotely execute code on Windows
#117> In theory, there is no path for a malicious Tailscale control plane to remotely execute code on your machine, unless you happen to run network services that are designed to allow it, like an SSH server with Tailscale-backed authentication. Now I feel less crazy for not using Tailscale SSH for similar reasons. I'd like to see a security evaluation of Tailscale, on a per feature basis. I'd like to see tailscaled run…
> I'd like to see tailscaled run with far fewer privileges. Yeah - I have a dislike for services running as root when it's not necessary, and then getting users to escalate to root to interact with them routinely. One thing I was thinking about was trying to identify the Linux capabilities which let tailscaled run, and then look at if it's feasible to adjust the default systemd unit to run it as a non root user. Clos…
Software shipped by the distro maintainers I find is often properly locked down with systemd features, but third party stuff is always hit and miss. Definitely agree Tailscale should be shipping with the bare minimum privileges required.
Re: CVE-2022-41924 – tailscaled can be used to remotely execute code on Windows
#118Earlier quoted context omitted.
[co-author of the research here] They actually approximate this functionality in the Windows implementation: It checks netstat to enforce that incoming TCP connections are from the expected Windows user! https://github.com/tailscale/tailscale/blob/2a991a3541ae5d56... That's why we were happy with the solution they implemented as a stopgap, until they could switch to named pipes (which there is now an open PR for).
Huh, ok, that's not so bad then. It feels like there could still be a TOCTOU issue there, but it'd be difficult to use.
With tcp being connection-oriented I think it's not too hard to get right, especially if the OS won't reuse a closed socket right away. Definitely worth considering though. Of course it's doable without netstat if you can track down the right apis https://stackoverflow.com/questions/47659365/find-process-ow...
Re: CVE-2022-41924 – tailscaled can be used to remotely execute code on Windows
#119I enjoyed the explanation very much. Even though I don't use mesh VPNs (yet), the architectural discussion of the vulnerability entailed numerous useful bits of background on browser and network infrastructure. Commendable work!
Re: CVE-2022-41924 – tailscaled can be used to remotely execute code on Windows
#120Earlier quoted context omitted.
Related: note also that tailscale's tailnet 100.* subnet is som form of CGNAT public ip block. I think Tailscale thought long and hard about this, and landed on it because it was a path of lesser resistance to break fewer things. And if you squint they fit the stated purpose. But even if browsers now implement PNA the tailnet itself is public address space, so that vector still exists. I wonder if browsers (and event…
The real takeaway here is that you should never treat any network boundary as critical for security. This is true whether it's a physical boundary or a virtual one (with TS being one example of the latter). If your private net is full of trivial to access things with no access control or horribly insecure services, that's a huge problem. There are many many many ways to hop over firewalls. Hostile JS on web sites is…
We're crazy to allow any program to talk on the network by default. Then when we run js we allow the browser, a user executed program, to decide what level of network control it will exercise. This laissez-faire attitude to controlling communication paths, or even awareness, makes lateral movement so much easier.
The lack of integrated authentication services is one reason why so many things are completely open. It's too hard to set up and manage user credentials, and in any case, programs shouldn't have access to user credentials, they should get delegated permission. AD has made everything too hard, we need a TOFU like dynamic machine identity exchange, which then allows individuals users to execute programs with particular network capabilities.