Everytime a new version of TAILS comes out, it's recommended to download and install immediately because of known vulnerabilities with the last one.

Since no relay except the middle relay knows the origin of the traffic and since scanning using something like nmap won't show tor on the client system, how would an attacker know what version of tor or TAILS you are using and so what exploits to use?

If there are differences between the two, please include it in the answers.

  • 1
    Why would an attacker need to know the version to try exploits? Couldn't he just attempt all the exploits which work against any of the latest versions and see which works against this one? Also, I could imagine that new versions of Tor browser show small differences to previous versions in terms of timing of specific operations, reaction to specific features etc. – Steffen Ullrich Aug 27 '18 at 5:13
  • Hi. Thanks for answering. Doesn't an attacker generally need to know the version a service is running to know what vulnerabilities will work? Won't trying all available vulnerabilities be too time-consuming? – user942937 Aug 27 '18 at 7:00
  • Knowing the version will help in finding matching exploits but this does not mean that one cannot do it without having the correct version. As for needing too much time to try all exploits - what do you think how much remote exploits exists for Tails and how much time a hacker might have? – Steffen Ullrich Aug 27 '18 at 7:07

Theoretically, if you visit a website in the Tor Browser, the User Agent will tell the web server the version of your browser. If different versions of TAILS have different versions of the Tor Browser, being based on different versions of Firefox, you could fingerprint it that way. But this is very limited, and hit-and-miss. You'd end up with a string like this:

Mozilla/5.0 (X11; Linux i686 on x86_64; rv:10.0) Gecko/20100101 Firefox/10.0

Could you reasonably say from that "Someone is definitely using a year-old version of TAILS"? Nope.

That said, do you have to know the exact version of the OS to run an exploit? Nope. If I see a browser running Chrome 64, there's probably a few exploits I can run, as long as it's older than Chrome 67.

For the super-paranoid (rightly or otherwise), you can spoof your user agent. You could even impersonate a Netscape Navigator browser, if you wanted.

|improve this answer|||||

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.