4 ms·

Do they have enough logs to reach out to people that were affected? As far as vulnerabilities go, this set is one is one of the worst ones I've seen this decade

by meibo 4y ago

Do they have enough logs to reach out to people that were affected? As far as vulnerabilities go, this set is one is one of the worst ones I've seen this decade, and they seem rather straightforward. Would be nice to get a blog post from them that goes a bit into impact, not just a report that tells you to update. It's nice that they responded quickly, but I feel like this shouldn't have happened in the first place for a network security company and it makes the Windows client feel like a bit of an afterthought. Looks like they have a PR open to switch it to named pipes, I hope that is properly reviewed by someone that knows Windows APIs before it's merged.

arkadiyt 4y ago
edit: I stand corrected as pointed out by the replies below. Curious what logs they had to prove this! Original comment: > Do they have enough logs to reach out to people that were affected? It happens on the client, there are no server logs that Tailscale could check
- mlyle 4y ago
  "Reviewing all logs confirms this vulnerability was not triggered or exploited."
  - deleted 4y ago
    [deleted]
- bradfitz 4y ago
  Reconfiguring the local client daemon (tailscaled) is reported to Tailscale log servers so there's server-side evidence if it's exploited.
- cmeacham98 4y ago
  > Curious what logs they had to prove this! My guess is the client sends some kind of "goodbye" message when it gets reconfigured to another coordination server, and that message has enough information to determine if it originated from this attack.
mcoliver 4y ago
"Reviewing all logs confirms this vulnerability was not triggered or exploited."
ripley12 4y ago
Yes. I got a (concise, well-written) email this morning with the following: > Am I affected? > Yes. Your tailnet has at least one Windows node running a version of Tailscale prior to v1.32.3.
- meibo 4y ago
  I received this email as well, I probably should have clarified to say that it would be interesting to know if any of this was ever actively exploited. I assume this hasn't happened, considering the sentence in their report, but this is a client vulnerability, so logs may not have reached their servers(I know nothing about their telemetry setup or what is actually logged, which is why I mentioned that a blog post about their part of the procedure might have been nice).
  - imachine1980_ 4y ago
    1) they probably don't get notify 2) they also have interest to say no if isn't being exploited publicly even if they are searching cases internally. In any case the response feels solid most companies will try force update whit vulnerability a and not disclose what the problem was and then blame the public for not have the software update, this giveme security about the compaby, it's also problematic because it drains the the time of the host to update their systems.
deleted 4y ago
[deleted]
Thaxll 4y ago
"worst ones I've seen this decade" It's not that bad actually.

by meibo 4y ago

arkadiyt 4y ago

edit: I stand corrected as pointed out by the replies below. Curious what logs they had to prove this! Original comment: > Do they have enough logs to reach out to people that were affected? It happens on the client, there are no server logs that Tailscale could check

mlyle 4y ago
"Reviewing all logs confirms this vulnerability was not triggered or exploited."
- deleted 4y ago
  [deleted]
bradfitz 4y ago
Reconfiguring the local client daemon (tailscaled) is reported to Tailscale log servers so there's server-side evidence if it's exploited.
cmeacham98 4y ago
> Curious what logs they had to prove this! My guess is the client sends some kind of "goodbye" message when it gets reconfigured to another coordination server, and that message has enough information to determine if it originated from this attack.

mcoliver 4y ago

"Reviewing all logs confirms this vulnerability was not triggered or exploited."

ripley12 4y ago

Yes. I got a (concise, well-written) email this morning with the following: > Am I affected? > Yes. Your tailnet has at least one Windows node running a version of Tailscale prior to v1.32.3.

meibo 4y ago
I received this email as well, I probably should have clarified to say that it would be interesting to know if any of this was ever actively exploited. I assume this hasn't happened, considering the sentence in their report, but this is a client vulnerability, so logs may not have reached their servers(I know nothing about their telemetry setup or what is actually logged, which is why I mentioned that a blog post about their part of the procedure might have been nice).
- imachine1980_ 4y ago
  1) they probably don't get notify 2) they also have interest to say no if isn't being exploited publicly even if they are searching cases internally. In any case the response feels solid most companies will try force update whit vulnerability a and not disclose what the problem was and then blame the public for not have the software update, this giveme security about the compaby, it's also problematic because it drains the the time of the host to update their systems.

deleted 4y ago

[deleted]

Thaxll 4y ago

"worst ones I've seen this decade" It's not that bad actually.