| ▲ | 6thbit 2 hours ago |
| > Most of the Tailscale SSH issues we've identified concern privilege escalation. In some circumstances, someone already authorized to connect over Tailscale SSH may be able to perform actions beyond the permissions of their configured local user, including potentially gaining elevated privileges.
"Most"? "In some circumstances"?
Makes me think that they could also be investigating a full on unauthorized connection issue, or am I reading too much into it? |
|
| ▲ | remus 2 hours ago | parent | next [-] |
| I think they're just writing cautiously because they're midway through the investigation and don't want to give false confidence. Doesn't seem worth reading too much into it until they provide a more thorough write up. |
|
| ▲ | awildfivreld 2 hours ago | parent | prev | next [-] |
| The underlying writeup can be found at https://tailworm.com/ |
| |
|
| ▲ | pizzafeelsright 2 hours ago | parent | prev | next [-] |
| Obviously tailscale has some great devs, security is complex. There is some weaselly language. In some circumstances default config? with password? this is a condition leading to the next someone already authorized to connect over Tailscale SSH they have access, but it may be limited or restricted, although scope could be beyond the intended may be able to perform actions beyond the permissions If there is a full moon and your brother in law's second cousin is wearing a hat, he may be able to use your upstair's thermostat provided you have a second story. |
| |
| ▲ | fooqux an hour ago | parent | next [-] | | Given what just happened with PHP a few days so, it's not surprising to me that they're holding their cards close to their chest. People will already be doing their damnedest to reverse engineer the exploit with this meager info. | |
| ▲ | p_l 34 minutes ago | parent | prev | next [-] | | Have you seen the slopreport for the vulnerability? I fully understand being carefully worded when you need serious brain power just to figure out every claim in the logorrhea | |
| ▲ | traceroute66 an hour ago | parent | prev [-] | | > Obviously tailscale has some great devs, security is complex. Quick reminder that in recent months Tailscale has had issues with age-old classic vulnerabilities such as input validation. The problem with Tailscale is twofold. First their attack surface is too big. They continuously shoehorn new features into the product. Second they don't appear to do regular deep-dive code audits and instead they appear to rely mostly on the goodwill of third-parties to poke at select areas of their code as and when those third-parties feel like it. Hence simple vulnerabilities such as input validation keep on popping up. Fancy SOC2 certificates are not the same thing. That's just dogfood for the corporate auditors. At $work we are busy working on removing Tailscale. The bells and whistles of Tailscale sure are attractive candy, but we simply can't overlook the security risk of what has become a bloated product. |
|
|
| ▲ | devmor 2 hours ago | parent | prev [-] |
| A security researcher colleague of mine was/is exploring an unauthenticated avenue along this line. I don’t have any update, she told me she didn’t feel comfortable exposing information to anyone other than Tailscale staff until she’s confident in what she found or didn’t. |
| |
| ▲ | raggi an hour ago | parent [-] | | we'd love to hear about it at security@tailscale.com, we're happy to work from & with and credit early ideas as well. |
|
