TAILS: "Probable" information leakage

Question

From https://tails.boum.org/security/index.en.html :

Probable holes
Until an audit of the bundled network applications is done, information leakages at the protocol level should be considered as − at the very least − possible.

My main question is: What are the security implications of this and how should Tails users behave to minimize risks from this?

But I also would like to ask (if any Tails developers happen to be hanging around here): Why is this very important piece of information not mentioned much more prominently on the Tails home page? Why are these applications even included?? Is Tor Browser affected??

Answer 1

This is nothing to do with the I2P bug. They are referring to the possibility that there may be information leaks at application protocol level that may be used by an attacker to identify, fingerprint or track users, see https://trac.torproject.org/projects/tor/wiki/doc/TorifyHOWTO#Protocolleaks:

Many applications can also leak other problematic and/or sensitive data, such as:

• Your real external non-Tor IP address, as described above
• Your time zone (for example: IRC clients through CTCP)
• Your user name (for example: ssh through login)
• The name and version of the client or server you are using (for example: Apache web server leaks software name and version number; IRC clients leak client name and client version number through CTCP)
• ​Metadata can be a risk. Click ​MAT and read 'What is a metadata?' and 'Why metadata can be a risk for your privacy?'
• Depending on your Mode Of Anonymity you obviously shouldn't mix your use of protected (anonymous) applications with applications not passing through the Tor network or some other form of anonymity. For example, if a log in name or password of yours can be traced back to your personal identity, then you are defeating the purpose entirely. Tor can not protect you from this kind of activity
• Even sending the contents of your RAM can be dangerous. For example: error reporting, leading to Transparent Proxy Leaks)
• A lot of information which the application sends on request from a server (for example: most web browsers beside the Tor Browser)
• Hardware serial numbers might be used for fingerprinting and in the worst case scenario, lead back to you.
• License keys of non-free software is often transmitted and might lead back to you.

In other words, even if Tor is doing its job and an application has been torified correctly, your identity could still be exposed if that application is sending personally identifying information down the Tor circuits.

The Tails developers are warning you that not all network applications bundled with Tails have been audited to a sufficient degree to be confident that there are no such leaks.

If in doubt, stick to applications that have been well audited (e.g. the Tor Browser).

Answer 2

Please be aware that this is listed as a probable hole. So there might be a problem, but nobody knows. To be sure someone has to audit and test the software. This gives a better understanding what the specific risks are. In general you should be aware of this issue and take it into account when you are online. You might need other safeguards, but this depends on your risk profile.

I assume this piece is not mentioned, because it is a quite abstract and theoretical risk. This can be said for nearly all (networking) software and so is a quite common risk.

One needs most of the software to go online. So leaving it out is no option here. In general Tails developers are quite conservative with their choice of software and don't put you on a extra risk.

Answer 3

This is a zero day flaw, and was recently reported to Tails folks by Exodus Intelligence. Following is a short excerpt from Exodus blog:

We publicized the fact that we’ve discovered these issues for a very simple reason: no user should put full trust into any particular security solution. By bringing to light the fact that we have found verifiable flaws in such a widely trusted piece of code, we hope to remind the Tails user base that no software is infallible. Even when the issues we’ve found are fixed by the Tails team, the community should keep in mind that there are most certainly other flaws still present and likely known to others.

http://blog.exodusintel.com/2014/07/23/silverbullets_and_fairytails/ My view is that, it is best to refrain from using Tails until dust settles. Be aware that this flaw existed for very long time and maybe used by adversaries for ages, so cover yourself if you can. COMPUTERWORLD have an interesting article on this subject. http://blogs.computerworld.com/malware-and-vulnerabilities/24177/zero-day-broker-exploits-vulnerability-i2p-de-anonymize-tails-users It estimates that 30000 users of I2P are unmasked.

The zero-day is in the Invisible Internet Project, or I2P, networking component that comes bundled with Tails to encrypt web traffic and hide a user’s real IP address. The 30,000 I2P users who previously felt anonymous could be unmasked, their true IP address revealed, by visiting a booby-trapped website.

Your best option at this point is to use Tor browser bundle, But be careful, more revelations will going to be uncovered.

P.S. There are other issues beside this zero day flaw too.

On July 4 2014 we found a group of relays that we assume were trying to de-anonymize users. They appear to have been targeting people who operate or access Tor hidden services. The attack involved modifying Tor protocol headers to do traffic confirmation attacks.

Read Tor security advisory for detail.

https://blog.torproject.org/blog/tor-security-advisory-relay-early-traffic-confirmation-attack