0

I know using outdated software is a bad idea, but until recently I have only been able to boot TAILS from LiveCDs that come with some Linux magazines. Since these arrive in my country late, I end up using some outdated version. I haven't had any problems with it until this happened. With recent updates to TAILS, I'm guessing a LiveCD from a downloaded image should probably boot on my computer now.

For obvious reasons, downloading TAILS on an unencrypted and unanonymized connection is not an option, but now I'm worried about downloading TAILS using a possibly vulnerable version as well.

I'm aware that tor, and especially TAILS are somewhat safe from mitm attacks and tampering, but I assume this is mostly true for the most up-to-date versions.

What kinds of attacks and exploits are possible on outdated versions of TAILS? Would it be safe to download the newver versions using one?

0

Every new release of Tails lists the vulnerabilities fixed in this version. For example if you go to https://tails.boum.org/ and look down at "Security" heading, you will see "numerous security holes in ".

So indeed, there are vulnerabilities in the older versions of Tails. However for the sole purpose of downloading a new version of Tails those are less relevant, and many of those won't even apply. While it is still possible to attack you using those exploits (for example, by patching the downloaded image as you're writing it to USB), the effort required to implement and execute such attack is enormous. So unless you consider yourself a desirable target of a three-letter agency, you likely are ok.

Please keep in mind that most people download the new version of Tails on their regular operating systems, so security-wise they might be even worse than old Tails.

| improve this answer | |
  • I don't see how they are less relevant. It doesn't take an enormous effort to execute an attack against, say, GnuPG to exploit it during verification. If one of the vulnerabilities impacts anything used for downloading and installing a new image, then the likelihood is that it is not only exploitable by an APT. – forest Aug 19 '18 at 7:02
  • Hi. Thanks for answering. I noticed the answer and the comment both assume a case where the image is written to a USB after downloading. Would using a different, clean computer to write the image be safer then? Is it a different case for writing to CD? – user942937 Aug 19 '18 at 7:09
  • @forest If you check the list, the majority of vulnerabilities there are local. Thus to execute an attack, one needs to get into the running Tails image. This is difficult as Tails is started for a short period of time and is only used to download the image from Tails site and copy it to USB. Here you have an approximately 20 minute timeframe to execute attacks. I don't see it happening without putting major effort, unless the entity compromised the Tails website itself - and in this case they can put malware in the latest version and it would be independent on your vulnerabilities. – George Y. Aug 20 '18 at 2:30
  • @user942937 in this case the main threat is malicious code injected into the downloaded image. This can only happen after you downloaded it, and verified its GPG signature (if it is modified before, the verification will fail). But it should happen before it is written to disk (otherwise you would reboot, or even boot it on another machine, and the old vulnerabilitles are gone). But if the attacker succeeded in modifying the image, it doesn't matter whether you put it on USB or on CD. – George Y. Aug 20 '18 at 2:48
  • @GeorgeY. Tails connects to more than just the Tails website. It uses tlsdate, it connects to Tor guard nodes or bridges, it runs a DHCP client, etc. All of these may be vulnerable and could be exploited during the download of the next ISO without compromising the Tails website itself. – forest Aug 29 '18 at 1:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.