Vulnerability analysis outfit Exodus Intelligence has warned that the Tails operating system has a number of critical vulnerabilities that can expose the identity of its users if properly finessed by an attacker.
Tails, which received a recommendation from fugitive whistleblower Edward Snowden, is a Debian Linux–based OS partially sponsored by Tor and designed to be used by journalists and others who want to keep their communications private. But the software's design is seriously flawed, Loc Nguyen, a researcher at Exodus, told El Reg.
"Tails is comprised of numerous components working in interchange," he said. "Notably the Exodus team were very impressed with the implementation and use of security technologies on the platform. However because there are numerous inter-locking mechanisms in play on the system, it's difficult to readily pinpoint a particular weak area."
Tails has a significant following among the privacy-conscious, and the open-source project is just about to release the first revision to the code. But Exodus said in a tweet that the new code still left the zero-day flaws it had identified open.
Exodus said it would release details about the zero-days in a series of blog posts next week.
The company makes its coin by identifying zero-day flaws in computer systems and selling the knowledge to its client base. Customers include the US Department of Defense and DARPA, but the company said it would not be selling the Tails information, as yet.
"These vulnerabilities are not being pushed to our clients, rather they are issues we intend to work with the vendor to fix," Nguyen said. "We announced the fact that we have these capabilities to spread the word to the community that no solution should be fully trusted to guarantee online anonymity." ®
