Feeds

Don't look, Snowden: Security biz chases Tails with zero-day flaws alert

Exodus vows not to sell secrets of whistleblower's favorite OS

Choosing a cloud hosting partner with confidence

Vulnerability analysis outfit Exodus Intelligence has warned that the Tails operating system has a number of critical vulnerabilities that can expose the identity of its users if properly finessed by an attacker.

Tails, which received a recommendation from fugitive whistleblower Edward Snowden, is a Debian Linux–based OS partially sponsored by Tor and designed to be used by journalists and others who want to keep their communications private. But the software's design is seriously flawed, Loc Nguyen, a researcher at Exodus, told El Reg.

"Tails is comprised of numerous components working in interchange," he said. "Notably the Exodus team were very impressed with the implementation and use of security technologies on the platform. However because there are numerous inter-locking mechanisms in play on the system, it's difficult to readily pinpoint a particular weak area."

Tails has a significant following among the privacy-conscious, and the open-source project is just about to release the first revision to the code. But Exodus said in a tweet that the new code still left the zero-day flaws it had identified open.

Exodus said it would release details about the zero-days in a series of blog posts next week.

The company makes its coin by identifying zero-day flaws in computer systems and selling the knowledge to its client base. Customers include the US Department of Defense and DARPA, but the company said it would not be selling the Tails information, as yet.

"These vulnerabilities are not being pushed to our clients, rather they are issues we intend to work with the vendor to fix," Nguyen said. "We announced the fact that we have these capabilities to spread the word to the community that no solution should be fully trusted to guarantee online anonymity." ®

Beginner's guide to SSL certificates

Whitepapers

Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Win a year’s supply of chocolate
There is no techie angle to this competition so we're not going to pretend there is, but everyone loves chocolate so who cares.
Why cloud backup?
Combining the latest advancements in disk-based backup with secure, integrated, cloud technologies offer organizations fast and assured recovery of their critical enterprise data.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Saudi Petroleum chooses Tegile storage solution
A storage solution that addresses company growth and performance for business-critical applications of caseware archive and search along with other key operational systems.