Slashdot Mirror
Exodus Intelligence Details Zero-Day Vulnerabilities In Tails OS
New submitter I Ate A Candle (3762149) writes Tails OS, the Tor-reliant privacy-focused operating system made famous by Edward Snowden, contains a number of zero-day vulnerabilities that could be used to take control of the OS and execute code remotely. At least that's according to zero-day exploit seller Exodus Intelligence, which counts DARPA amongst its customer base. The company plans to tell the Tails team about the issues "in due time", said Aaron Portnoy, co-founder and vice president of Exodus, but it isn't giving any information on a disclosure timeline. This means users of Tails are in danger of being de-anonymised. Even version 1.1, which hit public release today (22 July 2014), is affected. Snowden famously used Tails to manage the NSA files. The OS can be held on a USB stick and leaves no trace once removed from the drive. It uses the Tor network to avoid identification of the user, but such protections may be undone by the zero-day exploits Exodus holds.
The company plans to tell the Tails team about the issues "in due time"
I'm 100% certain "in due time" would come a lot sooner if the Tails OS maintainers coughed up the right fee, which means that this is most definitely NOT responsible disclosure.
I get that security researchers have to eat too, but damn - this sort of reeks of extortion. Maybe I'm wrong, but I know if I had a code project and some company said they knew I had holes but refused to tell me upon asking, extortion would be the first effing thought that would come to mind.
Quo usque tandem abutere, Nimbus, patientia nostra?
What could allow remote code execution in Tails but not affect Firefox or any of the other software us non-terrorists use. A bug in tor itself?
Given that they likely had to add a few custom bits to insure anonymity, and likely modified or ripped out a few other bits, odds are good that the customizations are where the issue lies.
(...then again, perhaps the bug(s) can be found in the std. packages, but the researchers wanted to scare a smaller organization into becoming a customer first?)
Quo usque tandem abutere, Nimbus, patientia nostra?
So they are selling vulnerabilities to hackers rather than telling the source maintainers? That's irresponsible at best.
Every OS has 0-day issues - no such thing an OS without them. However, dare I say that there is a little scaremongering on here in relation to Tails? If you can't stop them throw some mud or sow the seeds of doubt?
This sounds like FUD against Tails. A security research firm finds some undisclosed zero-days in Tails, but doesn't describe what they could do - arbitrary code execution? De-anonymization? They then go on to say that they haven't told the Tails maintainers what the vulnerabilities are, but will "in due time", implying they're going to sell them off to the government first. Exodus Intelligence also does a lot of business with the US government, possibly including the NSA.
To me, this sounds like they probably found some minor zero-days and are trying to spread FUD (likely spurred on by their clients in the government) to get people to stop using Tails. After all, we know that the NSA is trying to put people who attempt to download Tails on a watchlist for further scrutiny.
What kind of real environment allows boot from a USB drive?
I want to delete my account but Slashdot doesn't allow it.
My theory is that Steve Balmer is bored in his retirement and feels the need to troll open source sites.
"Never let your sense of morals prevent you from doing what is right" - Salvor Hardin
Sounds fishy to me...
Perhaps the NSA (or another agency) has another Snowden on their hands and paid Exodus for this "release" to scare the leaker into not sending their data out...
I think you forgot "FCUK NSA" somewhere in that NSA food... Or is it "FSCK GCHQ''?
The right to offend is far more important than the right not to be offended. (Rowan Atkinson)
F**k 'em both, and the equivalents in Canada, Oz, and NZ, and the lazy, corrupt and incompetent oversight committees. Oh and by the way, did you notice the Germans have been at it too, though not on the same scale.
I am now Officially In a Bad Mood, at which point I am quite likely to send a sizable donation to the people who make Tails, and I encourage y'all to do the same.
"Cock Up Your Beaver" does not mean what you think. This sig is intended to clog filters and annoy do-gooders
Amen, brother.
(And don't forget the French!)
The right to offend is far more important than the right not to be offended. (Rowan Atkinson)
You you realize that you forgot to fnord that and they can totally see what you wrote, right?
All this gave me will to take a loot at Tails.
Disclosing the existence of a vulnerability destroys a lot of its value, too. People who can stop using Tails until the issue is sorted out will do so, shutting off whatever intelligence could be gathered from them. If these guys had a real-world exploitable vulnerability and a willingness to sell it to the NSA, they would have sold it and said nothing.
0 1 - just my two bits
Oh sorry, should I be encrypting my NSA Food, to make sure they read it?
"Cock Up Your Beaver" does not mean what you think. This sig is intended to clog filters and annoy do-gooders
Have no fear. /. is collection friendly, with the data being sent in plaintext. They have all of our posts, and sort them for content and categorize them by context.
Not a troll, but how do you get updates on a LiveCD? a good safe distro would not only update bad code easily, but also prevent whatever malware gets in from writing to local disc. What to do?
Im stealing your signature...
It's an NSA backdoor!
Replying to pedantic ACs is a waste of time, I know, but I see this mistake made often enough. "Insure" and "ensure" are largely interchangeable: http://dictionary.reference.com/browse/insure.
my, your, his/her/its, our, your, their
I'm, you're, he's/she's/it's, we're, you're, they're
Hmmmm.... Let's see... Snowden embarrasses NSA using Tails; suddenly tails has scary "vulnerabilities"; a new company / entity on the scene says it will make everything nice.
What's the likely truth here? Snowden embarrassed NSA using Tails; NSA plants disinformation campaign to the exent of "vulnerabilities"; the new company / entity is an NSA puppet that will give you a new Tails every bit as reliable as the new TrueCrypt.
First grade simple so it's not suspected until..... (complete the sentence).
What do YOU think?
Those are my principles, and if you don't like them... well, I have others.
Snowden gave nothing to Russia or China. Even the head of the NSA has stated that. He gave nothing to any national party. It makes me wonder what you are. But I doubt you will ever be a little star.
Why did you call hims a piece of firewood or baked potato?
Snowden is not an agent. Even NSA says that.
What is certainly there is at least several JavaScript zero-days. JavaScript is complex to implement and easy to get wrong. As this is a commercial effort (as can be seen by its immorality and focus on profit), they will go after low-hanging fruit. The JavaScript engine is the most promising one.
And who said it would not affect other users too?
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
There are some things you can do even when second-rate, just by throwing resources at the problem. They may also have _bought_ these exploits form people that are not second-rate.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
They just send data to some server they own in clear and they know your last public IP. For spywork, that is enough. If laws are draconian enough, they are also sure to find _something_ when they kick down your door. Also, when you are not on US ground (warning: current state, this may change), they may also just drone-murder you and bypass any legality whatsoever.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
Nope, we don't use unmaintained, unaudited, open sores garbage.
So I guess that means you use unauditable, backdoored, closed source garbage then, huh?
"City hall" in German is "Rathaus" Kinda explains a few things......