Having done my own review of the vulns and the fixes as they are landing in github, its pretty clear to me that this only affects situations where you use ACLs to permit ssh into a node (via tailscale ssh, not via opensshd), but dont give a path to sudoers/root.
If a user had no SSH access and/or connectivity to a vulnerable node, none of these vulns give them access.
However, if you have a vulnerable tailscaled and you give ssh access as some non-root account/privs, then yes, these vulns are relevant as theres now known privilege escalations that give access beyond some specific user account.
Not trying to play down the vuln (its important), but its not a free-for-all RCE that some ppl are acting like it is.
Would only show worm behavior if machines within the tailnet had the right settings and also were members of other tailnets with those settings but then it would require someone in that tailnet to have another tailnet with the right settings…
It’s far fetched.
If all your tailscale-ssh ACLs allow you into an account with sudo, or allow you into root, theres no impact (you cant do anything with these vulns you couldnt do a month ago). Thats the nuance I'm trying to get across (admittedly my english is bad).
There are a handful which restrict users to their own user accounts. But it's on dev server with friendly devs, so even for that use case it's not really the end of the world.
I'm sure our infosec folks are going to demand that we upgrade everywhere, however.
Of course it should be taken seriously, but this topic is also piggy backing off of 7 days straight of non stop viral engagement farming on X after php2shell, where people we're farming likes by just posting stuff like
"YoU ThInK PhP2ShELl iS BaD JuST WaIt unTiL TaIlScAlE get HaCkED, ThIS JuSt ThE BeGiNNiNG oF a CybeR ReCKoNiNG"
To farm FUD from normies. Which of course led researchers who were working on tailscale vulns to take advantage of that algorithmic attention as well and talk about their research.
Like Im pretty sure we knew about this vuln for 3 days now, or atleast that it was responsibly disclosed (and not being used in the wild).
The attention this is getting is definately the product of some cringe viral snowball effect of the also rather benign p2pshell vuln.
It feels like there's a ton of AI influencer astroturfing going on, because its wildly easy to get engagement when you add the words "agent/ai" with "vulnerbility" and [insert popular service].
I personally use openssh, but someone else may use tailscale SSH.
Over the decades, I have maintained remote access through port forwarding on my router - at one point in 2008 I put SSH on port 80 so I could access it from the restricted wifi network at the hospital my grandmother was at. I have also used openvpn. I have also used cloudflare tunnels. But in the end, I always connect to hardened openssh with key only authentication.
I understand port 443 is always opened but nowadays you can’t just run ssh traffic on 443 without it being detected as not being https
If their firewalls can detect it not being typical http/s traffic, they can block it.
I’ve been hoping that HTTP3 adoption would make 443 UDP accessible from even more places. But maybe they already do the kind of thing you said for that too, looking at the traffic flow to determine that it is not HTTPS.
Weirdly sometimes there are WiFi networks where I am not able to connect to my WireGuard VPN on 443 UDP, but I can connect to servers over ssh on standard port 22 TCP. Perhaps they sometimes block all UDP traffic because they don’t want people to use BitTorrent etc, but one would think that with all the online meeting platforms that do video streaming there would be a lot of problems for people if all UDP traffic was blanket blocked.
I might eventually try out AmneziaWG instead of vanilla WireGuard, but at the moment I am fine not being able to Connect to my VPN sometimes. I only use it to connect to my other machines anyway, not as a VPN tunnel for my web browsing etc.
some VPN apps bypass wireguard blocks automatically by using https tunnels and whatnot.
Letting Tailscale handle VPN and SSH at the same time is basically once again a single point of failure. Similar to exposing SSH directly to the internet.
And before people start coming up with alternatives, I know, but they either have the same (theoretical level of) attack surface (ie [managed] Nebula), or they require much more manual work (ie Wireguard) and are therefore more sensitive to misconfiguration.
I use it extensively, and I would rather pay them a fee if they could review thr code.
A possibility is a lock down mode, disabling risky features.
I just want a VPN for connrctiviy, no taildrop, taildrive, SSH, funnel, services, DNS, node sharing, ...They are disabled in my admin console, but the code runs on my devices and they can be enabled by mistake.
A question. Taildrop enables unauthenticated input and doesn't even obey ACLs. I'm not quite sure about this, but couldn't malware in a low trust device send a file to my Synology NAS, which will then automatically process it for indexing things like thumbnail, leading to potential code execution? Why doesn't it obey ACLs, and why isn't the recipient approval needed before the file exits the sender's device? I use tags, but I'm the owner not the tag.
[1]: https://web.archive.org/web/20221222120703/https://emily.id....
Does anyone know of a Tailscale alternative that sticks to the basics?
Something that’s just WireGuard but without the manual key exchange, and with Tailscale-like NAT hole-punching that falls back to using an oblivious relay?
I was trying to do some kind of insane workflow where you as the operator have a privileged hardware yubikey that admins the nodes when you plug it in, and the point is the nodes would self-propogate the changes outwards. I immidiately ran into classic issues with distributed security in distributed systems (even with only one central operator trying to admin everything). Tailscale is also a bit more secure in its oauth layer - with this architecture, you need to set proper time limits for expiring so one node compromise doesn't get access to the whole fleet. Couldn't really come up with better ideas than forcing the operator to reuse some kind of hardware key (the idea trying to be avoiding maintaining a cloud control plane as much as possible)
Fun foray but creating such a system requires a lot of expertise that I unfortunately lack
I really liked it. I like the idea of embedding firewall rules in a certificate.
But , like you observed, it does not scale as well as tailscale.
Bit more than the basics, but not as much as tailscale.
{tail,head}scale is the best there is for wireguard at more than 3 nodes.
There are too much features added now, perhaps some related to enterprise features because that must drive the revenue
Sometimes I am thiking perhaps they provide a light tailscale version but that seems not viable given the complexity now, headscale is great, but the OSS client still have plenty features, though they are gradually added feature based switch in the client source which I think is great, perhaps we can build a light version over it
This is also I do not think the tailscale-rs(which aim to rewrite tailscale with rust) will not be ready in a short time because too much (feature + cross platform) need to be tested
I install tailscale on my cloud vps which I use for downloading torrents. I want my laptop to talk to this node, but I don't want this vm talk to my laptop, which is the whole purpose of ACLs. My ACL is deny by default, so that is great and easy to set. But now this node can still send arbitrary files to my laptop. If I don't remember to tag it, I'm vulnerable. If I do, there is still a window that this node can send me files until I tag it (I can't install tailscale to a tag).
Sending a file otherwise normally requires an app listening to a port, so taildrop permissions should be same as network permissions set by ACL.
BTW, last year or so tailscale advertised a position for someone to manage complexity of tailscale. Founder was talking about this issue. They seem to be aware of the problem.
FWIW you can rebuild tailscaled to omit all the optional stuff:
https://github.com/tailscale/tailscale/tree/main/feature#mod...
e.g.
% go run ./cmd/featuretags --min
ts_omit_ace,ts_omit_acme,ts_omit_advertiseexitnode,ts_omit_advertiseroutes,ts_omit_androidbin,ts_omit_androiddns,ts_omit_appconnectors,ts_omit_aws,ts_omit_bakedroots,ts_omit_bird,ts_omit_c2n,ts_omit_cachenetmap,ts_omit_captiveportal,ts_omit_capture,ts_omit_cliconndiag,ts_omit_clientmetrics,ts_omit_clientupdate,ts_omit_cloud,ts_omit_colorable,ts_omit_completion,ts_omit_completion_scripts,ts_omit_conn25,ts_omit_connreject,ts_omit_dbus,ts_omit_debug,ts_omit_debugeventbus,ts_omit_debugportmapper,ts_omit_desktop_sessions,ts_omit_dns,ts_omit_dnsresolvecache,ts_omit_doctor,ts_omit_drive,ts_omit_exitnodehealth,ts_omit_favorites,ts_omit_flashappliance,ts_omit_gro,ts_omit_health,ts_omit_hujsonconf,ts_omit_identityfederation,ts_omit_ipnbus,ts_omit_iptables,ts_omit_kube,ts_omit_linkspeed,ts_omit_linuxdnsfight,ts_omit_listenrawdisco,ts_omit_logtail,ts_omit_nattraversal,ts_omit_netlog,ts_omit_netstack,ts_omit_networkmanager,ts_omit_oauthkey,ts_omit_osrouter,ts_omit_outboundproxy,ts_omit_peerapiclient,ts_omit_peerapiserver,ts_omit_portlist,ts_omit_portmapper,ts_omit_posture,ts_omit_qrcodes,ts_omit_relayserver,ts_omit_remoteconfig,ts_omit_resolved,ts_omit_routecheck,ts_omit_runtimemetrics,ts_omit_sdnotify,ts_omit_serve,ts_omit_serviceclientprefs,ts_omit_ssh,ts_omit_synology,ts_omit_syslog,ts_omit_syspolicy,ts_omit_systray,ts_omit_taildrop,ts_omit_tailnetlock,ts_omit_tap,ts_omit_tpm,ts_omit_tundevstats,ts_omit_udptransport,ts_omit_unixsocketidentity,ts_omit_useexitnode,ts_omit_useproxy,ts_omit_usermetrics,ts_omit_useroutes,ts_omit_wakeonlan,ts_omit_webbrowser,ts_omit_webclientIf I literally ask an LLM your question it makes beautiful table of pros cons, underlying tech etc. So, LM G<>LLM TFY ;)
I wasn't using any of the additional features, I can get away with exposing a port on my router and I am changing devices rarely.
News like this make me happy I removed a lot of complexity and attack surface
using wireguard is awesome, but I wouldn't say deploying and maintaining it lacks complexity exactly. and you didn't get rid of attack surface, you just made it your responsibility ;)
I’m not even sure you need more than two. One seems bad because that’s just a lucky port scanner one time.
It would be idiotic to use the knock as the only authentication, which is why I don't.
To be quite honest, I just like the aesthetics of it.
I do disagree with GP's assertion that Claude can never make something comparable to Tailscale, but that's just because I believe I (and probably many others here) could probably prompt that, not because I think just anyone could. LLMs can one-shot a fair few things based on unskilled prompts, but I don't believe this is one of them yet.
Wireguard is the building block for higher level tools like Tailscale to build on.
Tailscale doesn't have this issue.
Connect from your home to a public VPS and connect your public devices to that VPS.
> Organizations using headscale v0.29.5 have no mechanism to disable the forwarding behavior at the center of the finding.
https://techjacksolutions.com/scc-vendor-rollup/tailscale-he...
So a failure in tailscale is not an issue on it's own because you'd then also have to find an exploit in what I'm actually hosting as well. Both of those things happening at the same time is much less likely.
I don't see the reason for Tailscale instead of plain old simple Wireguard, it's WG under the hood anyway.
I am a relatively old school engineer. When building a bricks and mortar business recently I kept hearing about tailscale for remote access. Looked and saw it was just a wrapper over wireguard. I immediately went aha, there's a solid underlying project without the risk of something over the top trying to make life easier for people unwilling or unable to manage their own systems. Went with a direct wireguard on opnsense approach.
Bamn, proved right today.
Wireguard is perfectly elegant and maintainable as it is for me, and a wonderful improvement on traditional site to site VPNs.
> Most of the Tailscale SSH issues we've identified concern privilege escalation. In some circumstances, someone already authorized to connect over Tailscale SSH may be able to perform actions beyond the permissions of their configured local user, including potentially gaining elevated privileges.
There is some weaselly language.
In some circumstances default config? with password? this is a condition leading to the next
someone already authorized to connect over Tailscale SSH they have access, but it may be limited or restricted, although scope could be beyond the intended
may be able to perform actions beyond the permissions If there is a full moon and your brother in law's second cousin is wearing a hat, he may be able to use your upstair's thermostat provided you have a second story.
I fully understand being carefully worded when you need serious brain power just to figure out every claim in the logorrhea
Quick reminder that in recent months Tailscale has had issues with age-old classic vulnerabilities such as input validation.
The problem with Tailscale is twofold.
First their attack surface is too big. They continuously shoehorn new features into the product.
Second they don't appear to do regular deep-dive code audits and instead they appear to rely mostly on the goodwill of third-parties to poke at select areas of their code as and when those third-parties feel like it. Hence simple vulnerabilities such as input validation keep on popping up.
Fancy SOC2 certificates are not the same thing. That's just dogfood for the corporate auditors.
At $work we are busy working on removing Tailscale. The bells and whistles of Tailscale sure are attractive candy, but we simply can't overlook the security risk of what has become a bloated product.
Good idea to set up automatic updates for the tailscale client though.
My question to those who kept praising Tailscale and making fun of good old plain SSH: how do you like your state backdoor --excuse me, I mean bug-- in Tailscale now?
What is the advantage? Why would I want to swap the well tested auth in ssh for auth managed by tailscale?