CVE-2022-41924 – tailscaled can be used to remotely execute code on Windows

Post by adql » Tue, Nov 22, 2022, 11:34 AM UTC

freedinosaur wrote: post #72

> In theory, there is no path for a malicious Tailscale control plane to remotely execute code on your machine, unless you happen to run network services that are designed to allow it, like an SSH server with Tailscale-backed authentication. Now I feel less crazy for not using Tailscale SSH for similar reasons. I'd like to see a security evaluation of Tailscale, on a per feature basis. I'd like to see tailscaled run…

Post by adql » Tue, Nov 22, 2022, 11:42 AM UTC

monocasa wrote: post #30

Arnavion wrote: post #20

Earlier quoted context omitted.

Windows from W10 onwards has Unix sockets too.

The windows implementation lacks facilities like SCM_RIGHTS though to ask the kernel who's on the other side.

Post by adql » Tue, Nov 22, 2022, 11:47 AM UTC

bheadmaster wrote: post #41

ruuda wrote: post #38

> If you visit my website, I am granted the honour and the privilege of executing arbitrary Javascript on your computer. > > This is a pretty bad idea This is why I disable javascript by default, but I suspect that on this page it's needed to fix the theme or something, because the text is light grey on a white background, and all monospace sections are completely illegible. Edit: I don't mean to hate on the author,…

> I suspect that on this page it's needed to fix the theme or something, because the text is light grey on a white background, and all monospace sections are completely illegible. You seem to be correct. I found a single tag in the source, with the following code: (() => { let v = localStorage.getItem("color-scheme"), a = window.matchMedia("(prefers-color-scheme: dark)").matches, cl = document.documentElement.classLi…

Post by robertlagrant » Tue, Nov 22, 2022, 12:15 PM UTC

klabb3 wrote: post #122

api wrote: post #103

Earlier quoted context omitted.

You usually still have to punch with IPv6 as there is usually a stateful firewall in the way. You just get 100% success vs the 80-90% you get with V4 (and getting worse as CGN gets more common).

This is correct. It's very annoying for any p2p like application, because the punching is a coordinated and time sensitive dance that just circumvents particular firewall bs. The firewall approach comes from this heavily flawed idea of the client initiated model of communication, extrapolated to client=consumers and server=service providers. It's just awful that the majority of the nodes on the internet aren't even r…

Post by api » Tue, Nov 22, 2022, 1:21 PM UTC

aborsy wrote: post #123

api wrote: post #108

Earlier quoted context omitted.

All software can have serious bugs, which is why you do defense in depth. Never depend on just one thing for your entire security perimeter. Outside narrow very well defined cases where proofs of security are possible, it might be impossible create perfectly secure computing systems due to the insolubility of the halting problem and the sheer size of the combinatorial space. If you watch the CVE announcements it's a…

Wireguard never had, and probably will not have, a serious vulnerability (one allowing bypassing a tunnel). The attack surface is small, and you can carefully review the code, even formally verify it. The devices could all tunnel out to a nearby VM in the cloud. This vulnerability is very critical, and discovered by an undergrad (not a security team): Code execution in local machine, taking over tailscaled, hijacking…