101–110 of 147 posts
Technical write up by the security researcher at https://emily.id.au/tailscale ps. she's looking an employer rn // hire her!
where does she say she is looking for an employer? Would be worthwhile to start a conversation with her.
Technical write up by the security researcher at https://emily.id.au/tailscale ps. she's looking an employer rn // hire her!
Very well written. Also quite worrying given they're supposed to be a security company and these kinds of issues are well known. Then again it does seem like the entire universe applies "eh probably nobody will try and hack it" to services listening on local TCP interfaces. They certainly don't care about multi-user machines, though I suppose there are so many local root exploits these days you're basically trusting…
Linux is used by by docent "security companies" and still has vulnerabilities from time to time. So does Apple in the products where their care about security, etc.
More important are three things to realize:
1. their handling of the incident, which wasn't just fast but you could say absurdly fast to a point that I'm pretty sure multiple employees dropped everything the moment they read the mail to solely focused on fixing and analyzing it
2. it's Windows only (at least it's main problem is), coming from a workaround for a feature "missing" in windows from a company which is relative young and started out in the Linux/UNIX space.
3. it is exploitable due to a fundamental design flaw of browsers
Or what I'm trying to say: It isn't that surprising (or worrying) that such a thing happened, what matters is how they handle it and make sure that it will not happen again.
Earlier quoted context omitted.
> Is there a Tailscale alternative that just does Wireguard + NAT traversal and doesn't try to do key management? I really wish there was a NAT traversal protocol or library that wasn't overly complex and focused on the 90% cases. It would help not just tailscale's but anyone building p2p tech.
I wonder if IPv6 will ever be the “path of least resistance” vs. NAT punching.
> In theory, there is no path for a malicious Tailscale control plane to remotely execute code on your machine, unless you happen to run network services that are designed to allow it, like an SSH server with Tailscale-backed authentication. Now I feel less crazy for not using Tailscale SSH for similar reasons. I'd like to see a security evaluation of Tailscale, on a per feature basis. I'd like to see tailscaled run…
Yep. Same boat. Absolutely zero interest in granting them ssh authZ; transport wrapping is all I want to outsource. Just deliver my bits and I pay you, tyvm. My suspicions have been proven correct here. Unfortunately reading about this remote RCE vector has me wondering whether I can use the product at all without all this bloat (taildrop, ssh, etc) affecting me. Going to have my team look at zerotier this week, I’ve…
"Zerotier: multiple vulnerabilities lead to private network access."
Earlier quoted context omitted.
Yep. Same boat. Absolutely zero interest in granting them ssh authZ; transport wrapping is all I want to outsource. Just deliver my bits and I pay you, tyvm. My suspicions have been proven correct here. Unfortunately reading about this remote RCE vector has me wondering whether I can use the product at all without all this bloat (taildrop, ssh, etc) affecting me. Going to have my team look at zerotier this week, I’ve…
Top result on HN: https://news.ycombinator.com/item?id=28590625 "Zerotier: multiple vulnerabilities lead to private network access."
The zerotier software failed - as such you could (in the simplest terms) bypass the transport “firewall”. At no point could you execute code on my machines. At no point could you spoof any authorization layers outside of what’s required to reach my ports. So when the model catastrophically failed here, attackers still cannot login to my machine. Other attacks might make this possible (e.g. code exec in the agent), but were not found - I suspect due to the lack of attack surface.
The client app is not indicating that 1.32.3 for Windows is available yet but the download link on the site has been updated. Tailscale client downloads are extremely slow at the moment, so I suggest you distribute one copy manually around your tailnet rather than bogging down their servers even more.
Tailscalar here. The Windows client caches the current version for a while, so may not yet have v1.32.3 available on your device. In that case, you can still pull the latest release from http://pkgs.tailscale.com/stable .
Technical write up by the security researcher at https://emily.id.au/tailscale ps. she's looking an employer rn // hire her!
Earlier quoted context omitted.
Top result on HN: https://news.ycombinator.com/item?id=28590625 "Zerotier: multiple vulnerabilities lead to private network access."
Saw that when it came out, yikes, but here it makes my point for me. The zerotier software failed - as such you could (in the simplest terms) bypass the transport “firewall”. At no point could you execute code on my machines. At no point could you spoof any authorization layers outside of what’s required to reach my ports. So when the model catastrophically failed here, attackers still cannot login to my machine. Oth…
Outside narrow very well defined cases where proofs of security are possible, it might be impossible create perfectly secure computing systems due to the insolubility of the halting problem and the sheer size of the combinatorial space.
If you watch the CVE announcements it's a continuous stream of serious bugs in all kinds of major software applications including OSes, web browsers, networking hardware, VPNs, cryptographic libraries, and so on. Microsoft, Apple, Cisco, etc. have serious vulnerabilities fairly often.
> In theory, there is no path for a malicious Tailscale control plane to remotely execute code on your machine, unless you happen to run network services that are designed to allow it, like an SSH server with Tailscale-backed authentication. Now I feel less crazy for not using Tailscale SSH for similar reasons. I'd like to see a security evaluation of Tailscale, on a per feature basis. I'd like to see tailscaled run…
If so, the config is straightforward for techies, just Wireguard config, it routes into my home server and I use Apache Reverse Proxy to route to the backend services.
Earlier quoted context omitted.
Saw that when it came out, yikes, but here it makes my point for me. The zerotier software failed - as such you could (in the simplest terms) bypass the transport “firewall”. At no point could you execute code on my machines. At no point could you spoof any authorization layers outside of what’s required to reach my ports. So when the model catastrophically failed here, attackers still cannot login to my machine. Oth…
All software can have serious bugs, which is why you do defense in depth. Never depend on just one thing for your entire security perimeter. Outside narrow very well defined cases where proofs of security are possible, it might be impossible create perfectly secure computing systems due to the insolubility of the halting problem and the sheer size of the combinatorial space. If you watch the CVE announcements it's a…
Now imagine you are an enterprise user of tailscale, you diligently elected not to trust it with login to your boxes, but you still got pwned because of “taildrop”, a feature no one on your team uses, wants, or knew was enabled.
Software vulnerabilities happen at a rate that highly correlates with size of attack surface. The attack surface here is pretty clearly too high (bad “defense in depth” as you say), and I hope they provide mechanisms in the future for disabling all this bloat, otherwise offerings like zerotier will eat their lunch.