Don't look, Snowden: Security biz chases Tails with zero-day flaws alert

Exodus vows not to sell secrets of whistleblower's favorite OS


Vulnerability analysis outfit Exodus Intelligence has warned that the Tails operating system has a number of critical vulnerabilities that can expose the identity of its users if properly finessed by an attacker.

Tails, which received a recommendation from fugitive whistleblower Edward Snowden, is a Debian Linux–based OS partially sponsored by Tor and designed to be used by journalists and others who want to keep their communications private. But the software's design is seriously flawed, Loc Nguyen, a researcher at Exodus, told El Reg.

"Tails is comprised of numerous components working in interchange," he said. "Notably the Exodus team were very impressed with the implementation and use of security technologies on the platform. However because there are numerous inter-locking mechanisms in play on the system, it's difficult to readily pinpoint a particular weak area."

Tails has a significant following among the privacy-conscious, and the open-source project is just about to release the first revision to the code. But Exodus said in a tweet that the new code still left the zero-day flaws it had identified open.

Exodus said it would release details about the zero-days in a series of blog posts next week.

The company makes its coin by identifying zero-day flaws in computer systems and selling the knowledge to its client base. Customers include the US Department of Defense and DARPA, but the company said it would not be selling the Tails information, as yet.

"These vulnerabilities are not being pushed to our clients, rather they are issues we intend to work with the vendor to fix," Nguyen said. "We announced the fact that we have these capabilities to spread the word to the community that no solution should be fully trusted to guarantee online anonymity." ®


Keep Reading

Internet Explorer fails to make the cut, banished from Microsoft Teams for good

Someone needs to make a 'Best viewed with anything but IE' badge for websites

Linksys forces password reset for Smart Wi-Fi accounts after router DNS hack pointed users at COVID-19 malware

Firm blames successful cred-stuffing attack for customer pwnage

Microsoft drives users to the Edge: Internet Explorer to redirect to Chromium-based browser in November

'Hey, you folks heard that there's this virus starting to spread?' – IE, probably

We've come to wish you an unhappy birthday: Microsoft to yank services from Internet Explorer, kill off Legacy Edge by 2021

You need to give that plate back to us after you've finished your cake. Yes the fork too. We'll get your coat

Azure DevOps Services reminds users that, yes, it really is time to pull the plug on Internet Explorer 11

Ignite Sure, it's still wedged in the OS, but maybe you'd prefer something shiny and Chromier?

Infosec bod: I've found zero-day flaws in Tor's bridge relay defenses. Tor Project: Only the zero part is right

Warnings either not new or need more study, reckons open-source dev team

In a world where up is down, it's heartwarming to know Internet Explorer still tops list of web dev pain points

Incompatibilities and inconsistent standards support among browsers ensure an ongoing source of headaches

Bristol's bus stops can run Chrome and Internet Explorer, but no, Windows and public transport do not mix well

Bork!Bork!Bork! Bus stop / Bus goes / What's crashed? / Windows

Biting the hand that feeds IT © 1998–2021