6 ms·

Tailscale bug allowed a person to share nodes from other tailnets without auth

378 points by Operyl 4y ago

Operyl 4y ago
This one was kind of difficult to title without getting too long, if anyone has a suggestion for the title that seems better let me know.
jdoss 4y ago
This seems pretty bad. I was pretty leery of Tailscale having too much control over my network when I tested it out and now seeing this security notification reinforces my decision to use vanilla WireGuard and Nebula for my home and datacenter use cases.
- Arnavion 4y ago
  Every time it gets mentioned here I wonder the same thing. Eg in the discussion of their last vulnerability they said they knew the vulnerability had not been exploited maliciously because they did not detect it on their end when their software phones home to them. https://github.com/tailscale/tailscale/security/advisories/GHSA-vqp6-rc3h-83cp https://github.com/tailscale/tailscale/security/advisories/G... >A vulnerability in the Tailscale Windows client [...] Reviewing all logs confirms this vulnerability was not triggered or exploited. Here too we have: >This vulnerability was not triggered or exploited. Analysis of tailnet logs shows that [...] Why on Earth would I want to use a security product that phones home... Regular WireGuard works perfectly fine for me.
  - serf 4y ago
    >Why on Earth would I want to use a security product that phones home.. I share your opinion, I don't want my security products to phone home, but the question was answered earlier : 'you' want a product that phones home so that the central data collection group can make statements like "vulnerability was not triggered or exploited." -- otherwise the onus is on the data holder to make similar assessments. in other words , the proprietors of wireguard cannot make statements regarding their entire userbase. (This may or may not be a good thing.)
    - deleted 4y ago
      [deleted]
    - djbusby 4y ago
      With Vanilla WG you'd have to guess my SecretKey. With TailScale you guess some ID in their system.
  - lostmsu 4y ago
    WireGuard is a pain in the ass to setup though. Also, their Windows client is no longer supported and has showstopper bugs (tunnels disappear until UI is launched and they are manually reactivated there).
    - ehPReth 4y ago
      do you have source for windows not being supported? I can’t find one after a quick search
      - lostmsu 4y ago
        They may never said so, but in practice the bug I mentioned above is over 6 months old, and is critical to the core functionality.
    - alibert 4y ago
      Wireguard is a small team (I think) and they are actually focusing on other platform right now but they will get back to Windows. https://lists.zx2c4.com/pipermail/wireguard/2022-September/007815.html https://lists.zx2c4.com/pipermail/wireguard/2022-September/0...
      - lostmsu 4y ago
        That talks about future state. The current state is that Windows is not supported.
        djbusby 4y ago
        Nope, Jason says > But right now? Is there something pending?
        lostmsu 4y ago
        I mean, if they had proper bug tracker instead of a mailing list, we could see the answer to that right away. But I am referring to https://lore.kernel.org/wireguard/CAHmME9pbY0Cgbj5JbTVvsxpkdpvJnZ1ZBLQruuUrumgnJ3U73A@mail.gmail.com/T/#ma78c548cb15c192291bfa7ffacd56c539d75bde2 https://lore.kernel.org/wireguard/CAHmME9pbY0Cgbj5JbTVvsxpkd... which I believe just made me travel to a remote location to restore connectivity.
  - lilyball 4y ago
    It's not phoning home. These vulnerabilities involve the coordination server, which is run by Tailscale, and therefore they have logs.
    - Operyl 4y ago
      It does phone home actually. The clients are constantly sending their logs for ingestion. I think this is a good thing but ymmv.
    - Arnavion 4y ago
      This one involves a Tailscale-run coordination server. The one I linked involves their clients uploading logs to home.
      - lilyball 4y ago
        Ah, I skimmed it too fast I saw the description reference the coordination server, but didn't look closely.
  - phpisthebest 4y ago
    >>Why on Earth would I want to use a security product that phones home.. that ship sailed a long time ago in enterprise networking. Almost all major vendors now have Cloud Control, and all of them phone home for various things Cisco, Aruba, Juniper, etc. All of them
  - Thaxll 4y ago
    How do you connect back to your home from the outside? - your ISP IP change all the time - You need to open port - You need to forward port to something else where the IP does not change ( wireguard server) - You need to setup wireguard - You need to manage auth / authz Lot of things can go wrong and it's a lot of things to setup / maintain properly.
    - wmf 4y ago
      Stop introducing facts; you're killing the outrage.
    - Arnavion 4y ago
      >How do you connect back to your home from the outside? >- your ISP IP change all the time I have a static v6 IP on the WG server (home router, running OPNsense). Even if I did have a changing IP, I have a programmable DNS server that points to the WG server's IP. >- You need to open port One time setup on the server. >- You need to setup wireguard Installed just like any other distro package, plus one-time setup to generate the key and import it and the server's public key into systemd-networkd / NetworkManager. >- You need to manage auth / authz You generate a key on each device and register the public key with the server. There's literally nothing else to it. >Lot of things can go wrong and it's a lot of things to setup / maintain properly. I set it up about two years ago and it's been working unchanged since.
      - yardstick 4y ago
        > Even if I did have a changing IP, I have a programmable DNS server that points to the WG server's IP. I believe that WG resolves the domain only once, upon config load. Not much help if the server IP changes after starting the WG client. Up to the user to realise and stop/start- not so convenient for eg embedded WG clients in travel routers
        greyface- 4y ago
        If the client is online when the server changes IPs, WireGuard's built-in roaming will handle it transparently: https://www.wireguard.com/#built-in-roaming https://www.wireguard.com/#built-in-roaming
  - voidwtf 4y ago
    > Why on Earth would I want to use a security product that phones home... Regular WireGuard works perfectly fine for me. Then you should continue using regular WireGuard. However, modern industry is plagued by an endless war with vulnerabilities, exploits, and malicious insiders. Even with adequate staffing, it's like a dam you're constantly patching to prevent leakage. We have to log everything, often offsite, and often into immutable storage. When the dam does eventually leak, we have to know how much and how it started. The logging is a feature to me. Tailscale is building a service that doesn't require me to run and maintain a centrally connectable server, one that ties into a single-sign-on solution, one that logs activity, one that's introduced a system in which I don't even have to trust their control plane exclusively (Tailnet Lock). Just the seemless integration with Azure AD has saved maintenance time over NPS+Radius+ADConnect+OpenVPN. Wireguard is great, I'm using it for all my site-to-site still (and it blows OpenVPN out of the water). But Tailscale has replaced all my client vpns for good reason.
    - ilyt 4y ago
      > When the dam does eventually leak, we have to know how much and how it started. The logging is a feature to me. Logging is a feature. Logging to some random 3rd party is not. Sure, if the 3rd party provides the service itself they need the logs to make it better but if stuff stays within your own infrastructure it should not phone home. And VPN service for enterprise certainly shouldn't have controller hosted on outside of company's own infrastructure
      - unethical_ban 4y ago
        Hoo boy, don't look up "Prisma Access" or "the cloud".
      - ithkuil 4y ago
        Well it's not a "random" 3rd party, it's a company you decide to rely on for your security. You pay, they offer you a service. If you don't trust them, that's fine, the product+service isn't for you. But it's not a "random" 3rd party.
    - etc-hosts 4y ago
  - j16sdiz 4y ago
    > Why on Earth would I want to use a security product that phones home... Same as outsourcing security: When you want a team of professional security engineers take care of it. (In that case, you may want to wish they are ethical, not overworked and actually care about your servers…)
    - fps_doug 4y ago
      Did you mean: Same as outsourcing security: When shit hits the fan, you have somebody else to point your finger at. No inconvenient questions to ask withing your org, potentially having to blame someone you like on a personal level etc. Worst case, you have to ask the guy who green-lit the outsourcing some inconvenient questions, but if the company you outsourced to is big enough, you can easily take the "nobody ever got fired for buying IBM" escape route.
  - unethical_ban 4y ago
    So they can do analysis on the logs and proactively fix vulnerabilities before they are exploited? I'm sitting here in shock wondering if you don't realize what you typed, or your implicitly saying you don't want a software company to have useful analytics to fix their product. The second option is understandable, but at least acknowledge the utility of logging. Also, I'm pretty sure you'll find detailed discussion of why people use Tailscale when there are options like vanilla Wireguard and OpenVPN if you google it or check their homepage. It fits many peoples' usecases.
    - Arnavion 4y ago
      >I'm sitting here in shock wondering if you don't realize what you typed After you're done being shocked, maybe you should read my comment more carefully. I didn't say "Tailscale shouldn't have logging". I didn't even ask "Why does Tailscale have logging?" I asked "Why would I want to use a security product that phones home?" I don't make decisions for Tailscale. If they want to have logging, analytics or free puppies, they're welcome to. I make decisions for myself, and I've decided that I wouldn't use any security product that phones home.
      - unethical_ban 4y ago
        "Why would I want to use a security product that phones home?" For all the reasons I listed, then. If you can operate more manual, less user-friendly, and difficult-to-troubleshoot software, then by all means.
- sneak 4y ago
  Nebula is amazing and I'm so happy it exists. I use it everywhere now.
- nixpulvis 4y ago
  People mostly seem to pay for these products so that they can blame a third party if things go wrong.
  - jay-barronville 4y ago
    Ding, ding, ding! A lot of security/compliance folks like to pay money for scapegoats. It certainly helps with job security. Worst case scenario? Find another vendor.
  - api 4y ago
    You just described the reason a huge chunk of the enterprise security industry exists.
  - wmf 4y ago
    Or because SaaS is easier to use and requires little or no maintenance.
    - trog 4y ago
      > Or because SaaS is easier to use and requires little or no maintenance. YUP We recently deployed Tailscale in our organisation; I had looked at Wireguard very closely but decided that the ease of use of Tailscale meant we could get up and running much more quickly and easily and at relatively low cost (small team). We'll re-evaluate as we move forward & probably need to deploy it to more users, but it was the difference between a few minutes setup to get all users into it versus several hours of figuring out the ins and outs of Wireguard & then getting the team onboarded. While any security incident is frustrating, they are inevitable, and the only way to really judge an organisation is by its response. Tailscale's response here gives me more confidence, not less.
      - rstupek 4y ago
        Which auth mechanism did you end up using?
        4y ago
- femiagbabiaka 4y ago
  How does using Nebula instead of Tailscale protect against bugs of this variety?
  - wmf 4y ago
    IMO it's more about agency. With SaaS people think "they had a bug and there's nothing I could have done to prevent it or expedite the fix" but with on-prem software they think "once I discover a bug I can whip my people to have it fixed within an hour". This is not true of course.
    - femiagbabiaka 4y ago
      Agreed! Was wondering if I'd missed something. On-prem is useful, but building competency with a technology can be painful and takes time.
    - jounker 4y ago
      And then there is the realists take with running your own: OH F*K. Another bug I have to deal with.
  - linsomniac 4y ago
    Nebula doesn't really have a control server of this sort, it largely uses a CA to do the node authentication and a coordination server that helps nodes get introduced and NAT bust, more like the DERP server for tailscale. The Nebula equivalent of this would be the Defined Networking folks, who do run a control server more akin to Tailscale. They say they are moving slow to focus on security, and I haven't heard of vulnerabilities like Tailscale, but also I think Defined Networks is much, much smaller in terms of users, so it may be a time will tell situation. They both seem to have pretty smart folks.
    - femiagbabiaka 4y ago
      Nice thanks! Time to check out Nebula/DN.
  - ikiris 4y ago
- kissgyorgy 4y ago
  I'm so glad you 1. read the article 2. precisely understood the vulnerability 3. carefully analyzed the situation 4. came up with a high quality analytical comment
gaudat 4y ago
You can selfhost a server for tailscale clients if you feel extra tinfoil-hatty. I am doing it. https://github.com/juanfont/headscale https://github.com/juanfont/headscale
- jay-barronville 4y ago
  This is the way. Edit: For the record, I think Tailscale (as a company) builds excellent software and I like the idea of them making money and staying alive to keep doing the great work they do. I personally feel uneasy about using their proprietary control server in my own (home, etc.) networks, but I honestly wouldn’t even think twice about it if I was making that decision on behalf of a company.
  - neodymiumphish 4y ago
    Fwiw (in my opinion, it's a great show of support by Tailscale), Tailscale actually hired and fully supports the person who maintains Headscale.
    - jsmith45 4y ago
      I had not heard that, and Juan's twitter says he works at the European Space Agency. On the other hand, they certainly have on a few ocassions gone out of their way to help Headscale, like documentation the changes to the V2 control server protocol, and even putting some relevant code in the open source repo to make it easier for Headscale. Plus they try to keep backwards compatible with older control servers in the client, and trying not to break headscale is something that has been mentioned a few times in pull requests reviews.
- GSGBen 4y ago
  Isn't it more likely that this would have unfound vulnerabilities in it, and you'd still need to have this open to the internet to get similar benefits to Tailscale proper?
mtlynch 4y ago
It's good that they fixed it, but this sounds like it would have been difficult to exploit: >A malicious individual who knew a target node’s database ID could generate and accept a sharing invite for that node without being an admin of the target node’s tailnet...as long as the individual knew the target’s node ID. ... >The node ID is an integer used in the admin panel’s database, and is not related to the node "StableID" that is visible to Tailscale clients... IDs are not sequential or otherwise easily guessable. I guess it depends on the search space of the IDs. If they're 64-bit integers, very hard to guess a valid ID. If they're only 32-bit integers, then you could have guessed, but it would be pretty obvious in Tailscale's logs.
- dave_universetf 4y ago
  (bulletin co-author) Yeah that bit could have been spelled out more. It's a random 64-bit int.
  - bhawks 4y ago
    What about the insider risk prospective? A random int64 isn't that hard to guess if you can easily look at a database.
    - tptacek 4y ago
      If you're looking at a database, you're not guessing. Otherwise: a random int64 is in fact difficult to guess.
      - bhawks 4y ago
        Exactly - which is why I was asking what is the nature of the insider threat risk if someone did not have to guess. In a prod deployment who has the rights to see this info without raising too many flags?
        tptacek 4y ago
        The database that gives you all the random 64 bit IDs for devices: that's another vulnerability.
tempnow987 4y ago
The product is great. Their security thinking though is pretty bad - they've had a sequence of pretty serious security flaws in what is supposed to be a security related product. The google login stuff is great though so not sure if there are good alternatives.
- danielheath 4y ago
  > Their security thinking though is pretty bad - they've had a sequence of pretty serious security flaws They are targeting 6 OSes plus web, each of which has unique ways to get security wrong. On its own, that's one hell of an attack surface and I'd say the rate of vulnerabilities reflects that. However, I'd say their security _posture_ is pretty good - from what I've seen, reported issues are typically patched within 48h of initial report (most companies ask for a 90 day window before bug reporters go public with issues, and often let it pass without fixing the issue). They've had many flaws become widely publicized because they have great writeups of the issue, but I think I've only seen one critical-severity issue - most are low-impact. EG in this case you need to make requests until you guess an int64 correctly - which on average would 'only' take a year if you could somehow make ten trillion requests per second without being detected.
  - EMIRELADERO 4y ago
    > However, I'd say their security _posture_ is pretty good The clients for Windows, iOS and macOS are closed-source. As a general rule, a closed-source server is bad, but ultimately it's somewhat tolerable. A closed-source client for a product or service that appears to have an acknowledged security posture is full-on unacceptable. I can't fanthom why they would shoot themselves in the foot like this.
    - danielheath 4y ago
      Not clear on why they made that call, but those are incidentally the exact set of platforms where they can't rapidly ship security updates (it's dependent on the vagaries of the platforms store).
ryanisnan 4y ago
I appreciate how Tailscale reacted here. This isn't a great bug, but things happen. I specifically appreciate: - There's a specific date when the regression was introduced - There's an end-date when the regression was fixed - There was a thorough and conclusive analysis that was done that proves no exploitation occurred
tsujamin 4y ago
Bug reporter here: fwiw I just want to credit Tailscale for how they handled the disclosure and remediation. Deploying a prod fix within 24 hours is pretty great, they’ve been super cooperative and pleasant to deal with and (as far as I could ascertain) there was no apparent way to get the database IDs for nodes you didn’t have pre-knowledge of
- fierro 4y ago
  could you not brute force them?
  - tsujamin 4y ago
    Seems like they were randomly distributed over 2^64 ish so not feasible
- vdfs 4y ago
  Was there any bug bounty?
- bibabaloo 4y ago
  Super cool find! Interested to hear how/why you came across this in the first place.
- louislang 4y ago
  Great find! Were you actively looking, or did you just stumble on something that set off your spidey-sense?
  - tsujamin 4y ago
    Just the latter while I was managing something in my tailnet
    - louislang 4y ago
      I'm always amazed how often that happens. Again, excellent finding.
latchkey 4y ago
Interestingly, they just updated their ToS [1] to force arbitration [2], and moved from Canada to NY (which my lawyers were happy about that second part). [1] https://news.ycombinator.com/item?id=34357616 https://news.ycombinator.com/item?id=34357616 [2] https://news.ycombinator.com/item?id=34358004 https://news.ycombinator.com/item?id=34358004
- x-complexity 4y ago
  > Interestingly, they just updated their ToS [1] to force arbitration [2], and moved from Canada to NY (which my lawyers were happy about that second part). ....I don't see the connection between their change in ToS to mandate arbitration & the bug itself. There's no direct equivalency between the two. On a personal note, I'm more neutral on arbitrations as a concept: They help facilitate faster legal resolutions in an environment where the time & cost overhead is purely human-derived. It often takes months, if not years, to form an impartial jury, a judge that's available to review the case, and for all relevant evidence to enter under the case's purview. Also, the website that was cited in your previous comment doesn't provide any justifications for the claims made in their list. It simply states 10 reasons with no expansion into details/reasoning on the last 9 reasons. The first reason alone gives a tautologically-derived justification to its statement. https://news.ycombinator.com/item?id=34358004 https://news.ycombinator.com/item?id=34358004 https://fairarbitrationnow.org/ten-reasons-why-arbitration-sucks/ https://fairarbitrationnow.org/ten-reasons-why-arbitration-s... Archive link: https://web.archive.org/web/20230117064553/https://fairarbitrationnow.org/ten-reasons-why-arbitration-sucks/ https://web.archive.org/web/20230117064553/https://fairarbit...
  - latchkey 4y ago
    > I don't see the connection As noted in other comments [0], part of the reason why people use Tailscale instead of just wireguard or headscale is that they think they they have a throat to choke. The arbitration clause has the potential to make things more difficult in that regard. > They help facilitate faster legal resolutions Faster is not always better. [0] https://news.ycombinator.com/item?id=34421555 https://news.ycombinator.com/item?id=34421555
deleted 4y ago
[deleted]
issafram 4y ago
[flagged]
aborsy 4y ago
The bigger problem is, people casually look at the code and find such major vulnerabilities in Tailscale. It doesn’t instill confidence in the rest of the code. This is a security product, and zero days in the code should be taken more seriously. Perhaps make the product all paid, and use the money to hire people to audit the code?
- thwarted 4y ago
  The bug was introduced on 2022-09-14, reported to us on 2023-01-11, and remediated on 2023-01-12. I don't know how much more seriously it could have been taken considering it was resolved within 24 hours of being reported.
- wmf 4y ago
  Tailscale would have no money without the free tier. You can't just squeeze money out of users like that.
mcqueenjordan 4y ago
Happy to hear there was no evidence of this being exploited. This is one of those things you really want to fix. Relying on an ID value being hard to guess as a security measure can be easily become one of those completely-invisible-but-critically-load-bearing (in)security properties that is too easy to invalidate with new pushes/features/etc. If these IDs were able to be exfiltrated or leaked or probed, it could have been disastrous. Really fortunate that this was caught now and wasn't in the wild for another year or two.
dvzk 4y ago
Perhaps the biggest revelation from this is that Firefox doesn't implement rebinding protection, and that CGNAT DNS responses aren't dropped by most resolvers. Host validation is preferable anyway [1] but the second problem still has bad implications. 1. https://github.com/nccgroup/singularity/wiki/Preventing-DNS-Rebinding-Attacks https://github.com/nccgroup/singularity/wiki/Preventing-DNS-...
nikisweeting 4y ago
It's ok we still love you! The disclosure was handled very well, best wishes to the whole team fixing it / dealing with the postmortem.
jawadch93 4y ago
[dead]
supermatt 4y ago
Im a bit frustrated with this. I say this as a big fan of tailscale, having promoted them in various places. Granted, you cant enumerate the ids, but neglecting permissions when adding a node seems like a really stupid oversight. May I suggest that Tailscale spend some time to double-check that they are applying access control where applicable throughout all aspects of the application. I appreciate the feedback on this vulnerability, and will continue to be a happy user - but please check that these oversights dont exist elsewhere.
- rollcat 4y ago
  Nobody in this industry consciously neglects authorisation, especially not startups building security solutions. This sort of stuff sometimes just happens, and the root cause always eventually boils down "we are humans and it is a human thnig to make mistakes". They have displayed fantastic response time and transparency on the issue, had the infrastructure in place to assess the impact, credited the reporter, hang out on HN to answer questions... If anything, this kind of response builds my confidence and trust in them.
nix23 4y ago
I say it once again, don't use it!!! That was not the first problem......and will not be the last.

378 points by Operyl 4y ago

This one was kind of difficult to title without getting too long, if anyone has a suggestion for the title that seems better let me know.

jdoss 4y ago

This seems pretty bad. I was pretty leery of Tailscale having too much control over my network when I tested it out and now seeing this security notification reinforces my decision to use vanilla WireGuard and Nebula for my home and datacenter use cases.

Arnavion 4y ago
Every time it gets mentioned here I wonder the same thing. Eg in the discussion of their last vulnerability they said they knew the vulnerability had not been exploited maliciously because they did not detect it on their end when their software phones home to them. https://github.com/tailscale/tailscale/security/advisories/GHSA-vqp6-rc3h-83cp https://github.com/tailscale/tailscale/security/advisories/G... >A vulnerability in the Tailscale Windows client [...] Reviewing all logs confirms this vulnerability was not triggered or exploited. Here too we have: >This vulnerability was not triggered or exploited. Analysis of tailnet logs shows that [...] Why on Earth would I want to use a security product that phones home... Regular WireGuard works perfectly fine for me.
- serf 4y ago
  >Why on Earth would I want to use a security product that phones home.. I share your opinion, I don't want my security products to phone home, but the question was answered earlier : 'you' want a product that phones home so that the central data collection group can make statements like "vulnerability was not triggered or exploited." -- otherwise the onus is on the data holder to make similar assessments. in other words , the proprietors of wireguard cannot make statements regarding their entire userbase. (This may or may not be a good thing.)
  - deleted 4y ago
    [deleted]
  - djbusby 4y ago
    With Vanilla WG you'd have to guess my SecretKey. With TailScale you guess some ID in their system.
- lostmsu 4y ago
  WireGuard is a pain in the ass to setup though. Also, their Windows client is no longer supported and has showstopper bugs (tunnels disappear until UI is launched and they are manually reactivated there).
  - ehPReth 4y ago
    do you have source for windows not being supported? I can’t find one after a quick search
    - lostmsu 4y ago
      They may never said so, but in practice the bug I mentioned above is over 6 months old, and is critical to the core functionality.
  - alibert 4y ago
    Wireguard is a small team (I think) and they are actually focusing on other platform right now but they will get back to Windows. https://lists.zx2c4.com/pipermail/wireguard/2022-September/007815.html https://lists.zx2c4.com/pipermail/wireguard/2022-September/0...
    - lostmsu 4y ago
      That talks about future state. The current state is that Windows is not supported.
      - djbusby 4y ago
        Nope, Jason says > But right now? Is there something pending?
        lostmsu 4y ago
        I mean, if they had proper bug tracker instead of a mailing list, we could see the answer to that right away. But I am referring to https://lore.kernel.org/wireguard/CAHmME9pbY0Cgbj5JbTVvsxpkdpvJnZ1ZBLQruuUrumgnJ3U73A@mail.gmail.com/T/#ma78c548cb15c192291bfa7ffacd56c539d75bde2 https://lore.kernel.org/wireguard/CAHmME9pbY0Cgbj5JbTVvsxpkd... which I believe just made me travel to a remote location to restore connectivity.
- lilyball 4y ago
  It's not phoning home. These vulnerabilities involve the coordination server, which is run by Tailscale, and therefore they have logs.
  - Operyl 4y ago
    It does phone home actually. The clients are constantly sending their logs for ingestion. I think this is a good thing but ymmv.
  - Arnavion 4y ago
    This one involves a Tailscale-run coordination server. The one I linked involves their clients uploading logs to home.
    - lilyball 4y ago
      Ah, I skimmed it too fast I saw the description reference the coordination server, but didn't look closely.
- phpisthebest 4y ago
  >>Why on Earth would I want to use a security product that phones home.. that ship sailed a long time ago in enterprise networking. Almost all major vendors now have Cloud Control, and all of them phone home for various things Cisco, Aruba, Juniper, etc. All of them
- Thaxll 4y ago
  How do you connect back to your home from the outside? - your ISP IP change all the time - You need to open port - You need to forward port to something else where the IP does not change ( wireguard server) - You need to setup wireguard - You need to manage auth / authz Lot of things can go wrong and it's a lot of things to setup / maintain properly.
  - wmf 4y ago
    Stop introducing facts; you're killing the outrage.
  - Arnavion 4y ago
    >How do you connect back to your home from the outside? >- your ISP IP change all the time I have a static v6 IP on the WG server (home router, running OPNsense). Even if I did have a changing IP, I have a programmable DNS server that points to the WG server's IP. >- You need to open port One time setup on the server. >- You need to setup wireguard Installed just like any other distro package, plus one-time setup to generate the key and import it and the server's public key into systemd-networkd / NetworkManager. >- You need to manage auth / authz You generate a key on each device and register the public key with the server. There's literally nothing else to it. >Lot of things can go wrong and it's a lot of things to setup / maintain properly. I set it up about two years ago and it's been working unchanged since.
    - yardstick 4y ago
      > Even if I did have a changing IP, I have a programmable DNS server that points to the WG server's IP. I believe that WG resolves the domain only once, upon config load. Not much help if the server IP changes after starting the WG client. Up to the user to realise and stop/start- not so convenient for eg embedded WG clients in travel routers
      - greyface- 4y ago
        If the client is online when the server changes IPs, WireGuard's built-in roaming will handle it transparently: https://www.wireguard.com/#built-in-roaming https://www.wireguard.com/#built-in-roaming
- voidwtf 4y ago
  > Why on Earth would I want to use a security product that phones home... Regular WireGuard works perfectly fine for me. Then you should continue using regular WireGuard. However, modern industry is plagued by an endless war with vulnerabilities, exploits, and malicious insiders. Even with adequate staffing, it's like a dam you're constantly patching to prevent leakage. We have to log everything, often offsite, and often into immutable storage. When the dam does eventually leak, we have to know how much and how it started. The logging is a feature to me. Tailscale is building a service that doesn't require me to run and maintain a centrally connectable server, one that ties into a single-sign-on solution, one that logs activity, one that's introduced a system in which I don't even have to trust their control plane exclusively (Tailnet Lock). Just the seemless integration with Azure AD has saved maintenance time over NPS+Radius+ADConnect+OpenVPN. Wireguard is great, I'm using it for all my site-to-site still (and it blows OpenVPN out of the water). But Tailscale has replaced all my client vpns for good reason.
  - ilyt 4y ago
    > When the dam does eventually leak, we have to know how much and how it started. The logging is a feature to me. Logging is a feature. Logging to some random 3rd party is not. Sure, if the 3rd party provides the service itself they need the logs to make it better but if stuff stays within your own infrastructure it should not phone home. And VPN service for enterprise certainly shouldn't have controller hosted on outside of company's own infrastructure
    - unethical_ban 4y ago
      Hoo boy, don't look up "Prisma Access" or "the cloud".
    - ithkuil 4y ago
      Well it's not a "random" 3rd party, it's a company you decide to rely on for your security. You pay, they offer you a service. If you don't trust them, that's fine, the product+service isn't for you. But it's not a "random" 3rd party.
  - etc-hosts 4y ago
- j16sdiz 4y ago
  > Why on Earth would I want to use a security product that phones home... Same as outsourcing security: When you want a team of professional security engineers take care of it. (In that case, you may want to wish they are ethical, not overworked and actually care about your servers…)
  - fps_doug 4y ago
    Did you mean: Same as outsourcing security: When shit hits the fan, you have somebody else to point your finger at. No inconvenient questions to ask withing your org, potentially having to blame someone you like on a personal level etc. Worst case, you have to ask the guy who green-lit the outsourcing some inconvenient questions, but if the company you outsourced to is big enough, you can easily take the "nobody ever got fired for buying IBM" escape route.
- unethical_ban 4y ago
  So they can do analysis on the logs and proactively fix vulnerabilities before they are exploited? I'm sitting here in shock wondering if you don't realize what you typed, or your implicitly saying you don't want a software company to have useful analytics to fix their product. The second option is understandable, but at least acknowledge the utility of logging. Also, I'm pretty sure you'll find detailed discussion of why people use Tailscale when there are options like vanilla Wireguard and OpenVPN if you google it or check their homepage. It fits many peoples' usecases.
  - Arnavion 4y ago
    >I'm sitting here in shock wondering if you don't realize what you typed After you're done being shocked, maybe you should read my comment more carefully. I didn't say "Tailscale shouldn't have logging". I didn't even ask "Why does Tailscale have logging?" I asked "Why would I want to use a security product that phones home?" I don't make decisions for Tailscale. If they want to have logging, analytics or free puppies, they're welcome to. I make decisions for myself, and I've decided that I wouldn't use any security product that phones home.
    - unethical_ban 4y ago
      "Why would I want to use a security product that phones home?" For all the reasons I listed, then. If you can operate more manual, less user-friendly, and difficult-to-troubleshoot software, then by all means.
sneak 4y ago
Nebula is amazing and I'm so happy it exists. I use it everywhere now.
nixpulvis 4y ago
People mostly seem to pay for these products so that they can blame a third party if things go wrong.
- jay-barronville 4y ago
  Ding, ding, ding! A lot of security/compliance folks like to pay money for scapegoats. It certainly helps with job security. Worst case scenario? Find another vendor.
- api 4y ago
  You just described the reason a huge chunk of the enterprise security industry exists.
- wmf 4y ago
  Or because SaaS is easier to use and requires little or no maintenance.
  - trog 4y ago
    > Or because SaaS is easier to use and requires little or no maintenance. YUP We recently deployed Tailscale in our organisation; I had looked at Wireguard very closely but decided that the ease of use of Tailscale meant we could get up and running much more quickly and easily and at relatively low cost (small team). We'll re-evaluate as we move forward & probably need to deploy it to more users, but it was the difference between a few minutes setup to get all users into it versus several hours of figuring out the ins and outs of Wireguard & then getting the team onboarded. While any security incident is frustrating, they are inevitable, and the only way to really judge an organisation is by its response. Tailscale's response here gives me more confidence, not less.
    - rstupek 4y ago
      Which auth mechanism did you end up using?
      - 4y ago
femiagbabiaka 4y ago
How does using Nebula instead of Tailscale protect against bugs of this variety?
- wmf 4y ago
  IMO it's more about agency. With SaaS people think "they had a bug and there's nothing I could have done to prevent it or expedite the fix" but with on-prem software they think "once I discover a bug I can whip my people to have it fixed within an hour". This is not true of course.
  - femiagbabiaka 4y ago
    Agreed! Was wondering if I'd missed something. On-prem is useful, but building competency with a technology can be painful and takes time.
  - jounker 4y ago
    And then there is the realists take with running your own: OH F*K. Another bug I have to deal with.
- linsomniac 4y ago
  Nebula doesn't really have a control server of this sort, it largely uses a CA to do the node authentication and a coordination server that helps nodes get introduced and NAT bust, more like the DERP server for tailscale. The Nebula equivalent of this would be the Defined Networking folks, who do run a control server more akin to Tailscale. They say they are moving slow to focus on security, and I haven't heard of vulnerabilities like Tailscale, but also I think Defined Networks is much, much smaller in terms of users, so it may be a time will tell situation. They both seem to have pretty smart folks.
  - femiagbabiaka 4y ago
    Nice thanks! Time to check out Nebula/DN.
- ikiris 4y ago
kissgyorgy 4y ago
I'm so glad you 1. read the article 2. precisely understood the vulnerability 3. carefully analyzed the situation 4. came up with a high quality analytical comment

gaudat 4y ago

You can selfhost a server for tailscale clients if you feel extra tinfoil-hatty. I am doing it. https://github.com/juanfont/headscale https://github.com/juanfont/headscale

jay-barronville 4y ago
This is the way. Edit: For the record, I think Tailscale (as a company) builds excellent software and I like the idea of them making money and staying alive to keep doing the great work they do. I personally feel uneasy about using their proprietary control server in my own (home, etc.) networks, but I honestly wouldn’t even think twice about it if I was making that decision on behalf of a company.
- neodymiumphish 4y ago
  Fwiw (in my opinion, it's a great show of support by Tailscale), Tailscale actually hired and fully supports the person who maintains Headscale.
  - jsmith45 4y ago
    I had not heard that, and Juan's twitter says he works at the European Space Agency. On the other hand, they certainly have on a few ocassions gone out of their way to help Headscale, like documentation the changes to the V2 control server protocol, and even putting some relevant code in the open source repo to make it easier for Headscale. Plus they try to keep backwards compatible with older control servers in the client, and trying not to break headscale is something that has been mentioned a few times in pull requests reviews.
GSGBen 4y ago
Isn't it more likely that this would have unfound vulnerabilities in it, and you'd still need to have this open to the internet to get similar benefits to Tailscale proper?

mtlynch 4y ago

It's good that they fixed it, but this sounds like it would have been difficult to exploit: >A malicious individual who knew a target node’s database ID could generate and accept a sharing invite for that node without being an admin of the target node’s tailnet...as long as the individual knew the target’s node ID. ... >The node ID is an integer used in the admin panel’s database, and is not related to the node "StableID" that is visible to Tailscale clients... IDs are not sequential or otherwise easily guessable. I guess it depends on the search space of the IDs. If they're 64-bit integers, very hard to guess a valid ID. If they're only 32-bit integers, then you could have guessed, but it would be pretty obvious in Tailscale's logs.

dave_universetf 4y ago
(bulletin co-author) Yeah that bit could have been spelled out more. It's a random 64-bit int.
- bhawks 4y ago
  What about the insider risk prospective? A random int64 isn't that hard to guess if you can easily look at a database.
  - tptacek 4y ago
    If you're looking at a database, you're not guessing. Otherwise: a random int64 is in fact difficult to guess.
    - bhawks 4y ago
      Exactly - which is why I was asking what is the nature of the insider threat risk if someone did not have to guess. In a prod deployment who has the rights to see this info without raising too many flags?
      - tptacek 4y ago
        The database that gives you all the random 64 bit IDs for devices: that's another vulnerability.

tempnow987 4y ago

The product is great. Their security thinking though is pretty bad - they've had a sequence of pretty serious security flaws in what is supposed to be a security related product. The google login stuff is great though so not sure if there are good alternatives.

danielheath 4y ago
> Their security thinking though is pretty bad - they've had a sequence of pretty serious security flaws They are targeting 6 OSes plus web, each of which has unique ways to get security wrong. On its own, that's one hell of an attack surface and I'd say the rate of vulnerabilities reflects that. However, I'd say their security _posture_ is pretty good - from what I've seen, reported issues are typically patched within 48h of initial report (most companies ask for a 90 day window before bug reporters go public with issues, and often let it pass without fixing the issue). They've had many flaws become widely publicized because they have great writeups of the issue, but I think I've only seen one critical-severity issue - most are low-impact. EG in this case you need to make requests until you guess an int64 correctly - which on average would 'only' take a year if you could somehow make ten trillion requests per second without being detected.
- EMIRELADERO 4y ago
  > However, I'd say their security _posture_ is pretty good The clients for Windows, iOS and macOS are closed-source. As a general rule, a closed-source server is bad, but ultimately it's somewhat tolerable. A closed-source client for a product or service that appears to have an acknowledged security posture is full-on unacceptable. I can't fanthom why they would shoot themselves in the foot like this.
  - danielheath 4y ago
    Not clear on why they made that call, but those are incidentally the exact set of platforms where they can't rapidly ship security updates (it's dependent on the vagaries of the platforms store).

ryanisnan 4y ago

I appreciate how Tailscale reacted here. This isn't a great bug, but things happen. I specifically appreciate: - There's a specific date when the regression was introduced - There's an end-date when the regression was fixed - There was a thorough and conclusive analysis that was done that proves no exploitation occurred

tsujamin 4y ago

Bug reporter here: fwiw I just want to credit Tailscale for how they handled the disclosure and remediation. Deploying a prod fix within 24 hours is pretty great, they’ve been super cooperative and pleasant to deal with and (as far as I could ascertain) there was no apparent way to get the database IDs for nodes you didn’t have pre-knowledge of

fierro 4y ago
could you not brute force them?
- tsujamin 4y ago
  Seems like they were randomly distributed over 2^64 ish so not feasible
vdfs 4y ago
Was there any bug bounty?
bibabaloo 4y ago
Super cool find! Interested to hear how/why you came across this in the first place.
louislang 4y ago
Great find! Were you actively looking, or did you just stumble on something that set off your spidey-sense?
- tsujamin 4y ago
  Just the latter while I was managing something in my tailnet
  - louislang 4y ago
    I'm always amazed how often that happens. Again, excellent finding.

latchkey 4y ago

Interestingly, they just updated their ToS [1] to force arbitration [2], and moved from Canada to NY (which my lawyers were happy about that second part). [1] https://news.ycombinator.com/item?id=34357616 https://news.ycombinator.com/item?id=34357616 [2] https://news.ycombinator.com/item?id=34358004 https://news.ycombinator.com/item?id=34358004

x-complexity 4y ago
> Interestingly, they just updated their ToS [1] to force arbitration [2], and moved from Canada to NY (which my lawyers were happy about that second part). ....I don't see the connection between their change in ToS to mandate arbitration & the bug itself. There's no direct equivalency between the two. On a personal note, I'm more neutral on arbitrations as a concept: They help facilitate faster legal resolutions in an environment where the time & cost overhead is purely human-derived. It often takes months, if not years, to form an impartial jury, a judge that's available to review the case, and for all relevant evidence to enter under the case's purview. Also, the website that was cited in your previous comment doesn't provide any justifications for the claims made in their list. It simply states 10 reasons with no expansion into details/reasoning on the last 9 reasons. The first reason alone gives a tautologically-derived justification to its statement. https://news.ycombinator.com/item?id=34358004 https://news.ycombinator.com/item?id=34358004 https://fairarbitrationnow.org/ten-reasons-why-arbitration-sucks/ https://fairarbitrationnow.org/ten-reasons-why-arbitration-s... Archive link: https://web.archive.org/web/20230117064553/https://fairarbitrationnow.org/ten-reasons-why-arbitration-sucks/ https://web.archive.org/web/20230117064553/https://fairarbit...
- latchkey 4y ago
  > I don't see the connection As noted in other comments [0], part of the reason why people use Tailscale instead of just wireguard or headscale is that they think they they have a throat to choke. The arbitration clause has the potential to make things more difficult in that regard. > They help facilitate faster legal resolutions Faster is not always better. [0] https://news.ycombinator.com/item?id=34421555 https://news.ycombinator.com/item?id=34421555

deleted 4y ago

[deleted]

issafram 4y ago

[flagged]

aborsy 4y ago

The bigger problem is, people casually look at the code and find such major vulnerabilities in Tailscale. It doesn’t instill confidence in the rest of the code. This is a security product, and zero days in the code should be taken more seriously. Perhaps make the product all paid, and use the money to hire people to audit the code?

thwarted 4y ago
The bug was introduced on 2022-09-14, reported to us on 2023-01-11, and remediated on 2023-01-12. I don't know how much more seriously it could have been taken considering it was resolved within 24 hours of being reported.
wmf 4y ago
Tailscale would have no money without the free tier. You can't just squeeze money out of users like that.

mcqueenjordan 4y ago

Happy to hear there was no evidence of this being exploited. This is one of those things you really want to fix. Relying on an ID value being hard to guess as a security measure can be easily become one of those completely-invisible-but-critically-load-bearing (in)security properties that is too easy to invalidate with new pushes/features/etc. If these IDs were able to be exfiltrated or leaked or probed, it could have been disastrous. Really fortunate that this was caught now and wasn't in the wild for another year or two.

dvzk 4y ago

Perhaps the biggest revelation from this is that Firefox doesn't implement rebinding protection, and that CGNAT DNS responses aren't dropped by most resolvers. Host validation is preferable anyway [1] but the second problem still has bad implications. 1. https://github.com/nccgroup/singularity/wiki/Preventing-DNS-Rebinding-Attacks https://github.com/nccgroup/singularity/wiki/Preventing-DNS-...

nikisweeting 4y ago

It's ok we still love you! The disclosure was handled very well, best wishes to the whole team fixing it / dealing with the postmortem.

jawadch93 4y ago

[dead]

supermatt 4y ago

Im a bit frustrated with this. I say this as a big fan of tailscale, having promoted them in various places. Granted, you cant enumerate the ids, but neglecting permissions when adding a node seems like a really stupid oversight. May I suggest that Tailscale spend some time to double-check that they are applying access control where applicable throughout all aspects of the application. I appreciate the feedback on this vulnerability, and will continue to be a happy user - but please check that these oversights dont exist elsewhere.

rollcat 4y ago
Nobody in this industry consciously neglects authorisation, especially not startups building security solutions. This sort of stuff sometimes just happens, and the root cause always eventually boils down "we are humans and it is a human thnig to make mistakes". They have displayed fantastic response time and transparency on the issue, had the infrastructure in place to assess the impact, credited the reporter, hang out on HN to answer questions... If anything, this kind of response builds my confidence and trust in them.

nix23 4y ago

I say it once again, don't use it!!! That was not the first problem......and will not be the last.