Earlier quoted context omitted.
can you DM me her email? I can't find it anywhere and I'd love to start a chat with on a security position at my work.
Have passed your comment over to her. The website has been updated with an email address.
Thanks!
CVE-2022-41924 – tailscaled can be used to remotely execute code on Windows
141–147 of 147 posts
Re: CVE-2022-41924 – tailscaled can be used to remotely execute code on Windows
#142Re: CVE-2022-41924 – tailscaled can be used to remotely execute code on Windows
#143Technical write up by the security researcher at https://emily.id.au/tailscale ps. she's looking an employer rn // hire her!
Best exploit write up I’ve read. All the details, interspersed with nonchalant humor.
“None of these words are in the Bible.
This is certainly true of the King James Version, but many of these words can be found in what might as well be the Old Testament of Same-Origin Policy: the WhatWG Fetch Standard, which defines the CORS rules we are being accused of violating.”
Re: CVE-2022-41924 – tailscaled can be used to remotely execute code on Windows
#144> We can ask Tailscale to open a path on an SMB share. Windows being Windows, it will send your username (and a hash of your login password) to this server, unprompted, despite having no reason to consider the server trustworthy. Wow, I used to think Linux security was miles ahead of Windows security more than 20 years ago because of insanity like this. Fast forward 20 years. NTLMv2 is common, so cracking a password…
SSH has solution for that forever too, server certs. Server cert change or (if you're fancy) is not signed by right CA and you get an alert.
Server certs are a different issue. If OpenSSH, by default, sent SHA256(logged in user’s password) to the server, even after verifying the cert, it would get laughed out of the toolbox of security-conscious users.
Re: CVE-2022-41924 – tailscaled can be used to remotely execute code on Windows
#145Earlier quoted context omitted.
That article has so much more information in it that I've changed the URL to that from https://tailscale.com/security-bulletins/#ts-2022-004 . Thanks!
I submitted it 7 hours ago, but it didn't get any traction with the original title https://news.ycombinator.com/item?id=33695800 .
Ah sorry - we're eventually going to implement karma sharing to take care of cases like this. Often I search to see if someone else has already submitted the 'better' URL but I forgot to do that here.
There's a lot of randomness in which submissions get noticed and achieve liftoff from /newest. At least it evens out over time if you continue to post good submissions!
Re: CVE-2022-41924 – tailscaled can be used to remotely execute code on Windows
#146There does not appear to be a setting available to prevent known vulnerable clients from connecting to your tailnet.
Re: CVE-2022-41924 – tailscaled can be used to remotely execute code on Windows
#147> In theory, there is no path for a malicious Tailscale control plane to remotely execute code on your machine, unless you happen to run network services that are designed to allow it, like an SSH server with Tailscale-backed authentication. Now I feel less crazy for not using Tailscale SSH for similar reasons. I'd like to see a security evaluation of Tailscale, on a per feature basis. I'd like to see tailscaled run…
I have a task to investigate https://www.firezone.dev