Security researcher Erica Windisch published the Tailworm report examining Tailscale and headscale.
Lab testing claims a compromised device can gain root access across reachable servers under specific conditions involving SSH port forwarding and access rules.
The report was published on October 25 by security researcher Erica Windisch of Cyberdione Labs and is based on three days of testing conducted in a lab environment. The research examined Tailscale in version 1.104.2 and headscale in version 0.29.5.
How the problem works in practice
Tailscale's login function directly identifies the device instead of checking the user's password or digital key, based on predefined access rules.
According to lab tests, if an attacker controls an authorized device, they could exploit the connection to connect to internal system communications points. In this way, they could gain full administrator privileges, read code files, or even trick the system into connecting new machines to their control.
READ ALSO
Speed restrictions remain on Ukrainian military satellite internet despite Trump's urging of Musk
The researcher described the process as being able to spread automatically from device to device in the lab, at a speed of less than a second per step. However, other researchers have publicly questioned how easily such automatic spread can occur, while some have called the finding concerning administrator privileges serious.
What the company answers
Until the publication of the report, the company had not issued any official warning or released a fix update.
Mike Shaver, Tailscale's vice president of engineering, said the company received the report and was already looking into these areas with the help of outside experts.
What administrators can do
To protect networks until official information is available, the following measures are recommended:
- Reconsider connection rules to limit them to individual pairings between specific devices.
- Disable connection forwarding where it is not necessary.
- Remove any unused connection permissions.
- Enable automatic expiration of device connection keys.
- Devices that have been compromised should be immediately deleted from the central control system.
- Enable connection checking and automatic updates.
G
Hacks.gr on Google
Set it as a preferred source for cybersecurity updates.
Preferred source
Top comments (0)