4 ms·

The vulnerability should have been disclosed to Tails developers as soon as Hernandez was arrested.

andrewflnr 6y ago
Well yes, but the fact that it was already patched in the next Tails release, and that was the reason they pulled the trigger when they did, makes even that concern less of a practical problem. It was basically going to get fixed in short order no matter what they did.
- rsanek 6y ago
  Since they never released the exploit, in reality we have no way of verifying this is actually true. It very well could be the case Tails still has this vulnerability.
  - jaifraic 6y ago
    Let's hope somebody works backwards and looks at patches made to the Tails video player and looks for something that could have been an exploit
  - mirimir 6y ago
    In my opinion, Hernandez screwed up by not appreciating the risk profiles for Tails and Whonix. Tails is a LiveOS, which doesn't leave traces in RAM or on disk. Whonix is a pair of VMs, one with the Tor process, and the other with user apps. Using Whonix, exploits like this are impossible, because the apps VM has no public IP address, and can hit the Internet only via Tor.
    - coolspot 6y ago
      I can imagine for high-value target there are stacking exploits: 1) escape from browser into VM 2) escape from VM into host 3) run exploit on host
      - mirimir 6y ago
        True. However, such high-value targets would be isolating the Tor process and apps at the hardware level. It's over my head, but I can imagine elements from Tinfoil Chat and Qubes Air. And yes, vulnerabilities in Tor have been exploited. So it's prudent to hit Tor via nested VPN chains, just in case.
      - aspenmayer 6y ago
        Could you use a ring of VPSs spawning independent VM sessions, which are randomly connected to as needed, and puppeted by scripts or ML, used by others in the meantime, and torn down randomly and on a schedule. Cloud hop in the noise.
      - throwawey 6y ago
        They don't need to stack anything. Everything that solely uses tor for protectioncan be pwned by pwning Tor. Happens once in while.
- kodablah 6y ago
  Did they disclose it anyways? If not, why not even if it was already ineffective?
matheusmoreira 6y ago
The FBI would rather let a suspect go than reveal the vulnerabilities it is exploiting. https://www.schneier.com/blog/archives/2017/03/fbis_exploit_ag.html https://www.schneier.com/blog/archives/2017/03/fbis_exploit_...

Well yes, but the fact that it was already patched in the next Tails release, and that was the reason they pulled the trigger when they did, makes even that concern less of a practical problem. It was basically going to get fixed in short order no matter what they did.

rsanek 6y ago
Since they never released the exploit, in reality we have no way of verifying this is actually true. It very well could be the case Tails still has this vulnerability.
- jaifraic 6y ago
  Let's hope somebody works backwards and looks at patches made to the Tails video player and looks for something that could have been an exploit
- mirimir 6y ago
  In my opinion, Hernandez screwed up by not appreciating the risk profiles for Tails and Whonix. Tails is a LiveOS, which doesn't leave traces in RAM or on disk. Whonix is a pair of VMs, one with the Tor process, and the other with user apps. Using Whonix, exploits like this are impossible, because the apps VM has no public IP address, and can hit the Internet only via Tor.
  - coolspot 6y ago
    I can imagine for high-value target there are stacking exploits: 1) escape from browser into VM 2) escape from VM into host 3) run exploit on host
    - mirimir 6y ago
      True. However, such high-value targets would be isolating the Tor process and apps at the hardware level. It's over my head, but I can imagine elements from Tinfoil Chat and Qubes Air. And yes, vulnerabilities in Tor have been exploited. So it's prudent to hit Tor via nested VPN chains, just in case.
    - aspenmayer 6y ago
      Could you use a ring of VPSs spawning independent VM sessions, which are randomly connected to as needed, and puppeted by scripts or ML, used by others in the meantime, and torn down randomly and on a schedule. Cloud hop in the noise.
    - throwawey 6y ago
      They don't need to stack anything. Everything that solely uses tor for protectioncan be pwned by pwning Tor. Happens once in while.
kodablah 6y ago
Did they disclose it anyways? If not, why not even if it was already ineffective?

matheusmoreira 6y ago

The FBI would rather let a suspect go than reveal the vulnerabilities it is exploiting. https://www.schneier.com/blog/archives/2017/03/fbis_exploit_ag.html https://www.schneier.com/blog/archives/2017/03/fbis_exploit_...