121–130 of 147 posts
> We can ask Tailscale to open a path on an SMB share. Windows being Windows, it will send your username (and a hash of your login password) to this server, unprompted, despite having no reason to consider the server trustworthy. Wow, I used to think Linux security was miles ahead of Windows security more than 20 years ago because of insanity like this. Fast forward 20 years. NTLMv2 is common, so cracking a password…
Earlier quoted context omitted.
I wonder if IPv6 will ever be the “path of least resistance” vs. NAT punching.
You usually still have to punch with IPv6 as there is usually a stateful firewall in the way. You just get 100% success vs the 80-90% you get with V4 (and getting worse as CGN gets more common).
Anyway, it would be much better to leave the socket APIs to handle this, possibly with OS safeguards and privileges. Writing p2p applications is analogous to being constantly protected "for your own good" by a guardian. /rant
Earlier quoted context omitted.
Saw that when it came out, yikes, but here it makes my point for me. The zerotier software failed - as such you could (in the simplest terms) bypass the transport “firewall”. At no point could you execute code on my machines. At no point could you spoof any authorization layers outside of what’s required to reach my ports. So when the model catastrophically failed here, attackers still cannot login to my machine. Oth…
All software can have serious bugs, which is why you do defense in depth. Never depend on just one thing for your entire security perimeter. Outside narrow very well defined cases where proofs of security are possible, it might be impossible create perfectly secure computing systems due to the insolubility of the halting problem and the sheer size of the combinatorial space. If you watch the CVE announcements it's a…
This vulnerability is very critical, and discovered by an undergrad (not a security team): Code execution in local machine, taking over tailscaled, hijacking the coordination server, adding nodes, SSHing into machines, SMB shares, etc. The users are owned if attacked, and this was supposed to be a security-focused product.
Part of the problem is the feature bloat, that Wireguard deliberately avoided. Like, I want a mesh VPN, not an alternative to OpenSSH or Dropbox as well. The integrations add code, and it’s hard to secure a larger code base.
The response from Tailscale has been excellent though. Hopefully they will take measures to prevent such issues. This is a VPN after all!
Technical write up by the security researcher at https://emily.id.au/tailscale ps. she's looking an employer rn // hire her!
Earlier quoted context omitted.
Tailscale admin here, politely requesting client update push capability. Being able to see endpoint version is helpful, I will be suspending unpatched endpoints in the near future.
Seconded
Or Get Tailscale in the Windows Store so it could auto update for all the endpoints out in the wild I don't control (company laptops, users home PCs, etc). Trying to get TEN people to manually update today was a pain, I can't imagine even triple that.
Earlier quoted context omitted.
where does she say she is looking for an employer? Would be worthwhile to start a conversation with her.
Em interned with me earlier this year. Have passed the threads over to her.
Earlier quoted context omitted.
Very well written. Also quite worrying given they're supposed to be a security company and these kinds of issues are well known. Then again it does seem like the entire universe applies "eh probably nobody will try and hack it" to services listening on local TCP interfaces. They certainly don't care about multi-user machines, though I suppose there are so many local root exploits these days you're basically trusting…
> Also quite worrying Linux is used by by docent "security companies" and still has vulnerabilities from time to time. So does Apple in the products where their care about security, etc. More important are three things to realize: 1. their handling of the incident, which wasn't just fast but you could say absurdly fast to a point that I'm pretty sure multiple employees dropped everything the moment they read the mail…
It's not missing. Windows has named pipes. They just don't use the same API as Unix sockets so you would have to do some work to do it properly (or use an existing library that abstracts both interfaces).
In any case Windows has had support for Unix sockets since 2017 so there's really no excuse.
> Linux is used by by docent "security companies" and still has vulnerabilities from time to time. So does Apple in the products where their care about security, etc.
Right but neither of them are companies whose sole product is a security product.
I agree their response time is good - they probably realised how bad it looks!
Earlier quoted context omitted.
Very well written. Also quite worrying given they're supposed to be a security company and these kinds of issues are well known. Then again it does seem like the entire universe applies "eh probably nobody will try and hack it" to services listening on local TCP interfaces. They certainly don't care about multi-user machines, though I suppose there are so many local root exploits these days you're basically trusting…
> Also quite worrying Linux is used by by docent "security companies" and still has vulnerabilities from time to time. So does Apple in the products where their care about security, etc. More important are three things to realize: 1. their handling of the incident, which wasn't just fast but you could say absurdly fast to a point that I'm pretty sure multiple employees dropped everything the moment they read the mail…
Earlier quoted context omitted.
This means you will see more of Tailscale. Vulnerabilities are inevitable, the actions taken in the hours (ideally) and days following the discovery is what matters most.
i would still rather see less considering where tailscale software sits in my privacy/security. at some point i'd ask why do i pay to use this swiss cheese ? (not saying thats the case, but if I were to continue to see more issues)