And of course the "kill switch" is implemented using OS features, so you can say it is implemented at the OS level, one just need to configure it. On Linux this is fairly easy to do using standard networking tools.

It is an isolated use case. The majority of VPN users until recently were (and probably still are) business customers who use VPN to access internal resources. For them this "kill switch" is not that useful, as without VPN those resources are not available anyway.

@user942937 in this case the main threat is malicious code injected into the downloaded image. This can only happen after you downloaded it, and verified its GPG signature (if it is modified before, the verification will fail). But it should happen before it is written to disk (otherwise you would reboot, or even boot it on another machine, and the old vulnerabilitles are gone). But if the attacker succeeded in modifying the image, it doesn't matter whether you put it on USB or on CD.

@forest If you check the list, the majority of vulnerabilities there are local. Thus to execute an attack, one needs to get into the running Tails image. This is difficult as Tails is started for a short period of time and is only used to download the image from Tails site and copy it to USB. Here you have an approximately 20 minute timeframe to execute attacks. I don't see it happening without putting major effort, unless the entity compromised the Tails website itself - and in this case they can put malware in the latest version and it would be independent on your vulnerabilities.

The person would have to click on a link. Clicking on an attached image, (which is then embedded into email) will not work.

You can even bind to 0.0.0.0 which means "all IP addresses" (but in reality this means "all IP addresses the box offers".

To be fair, it is possible to redirect the traffic this way via BGP manipulation - there are articles about it such as theverge.com/2018/4/24/17275982/… - but this requires dedicated effort, and cannot be possibly done by an honest mistake.

It is not NAT which prevents this, but the global network routing rules. For example, you can change your local IP address to 8.8.8.8 and listen on it, but you will not receive any packets which go to real 8.8.8.8, because the Internet routers will route this traffic to Google, and not to your server.

Indeed there is plenty of evidence NotPetya was not designed as ransomware. For example they only offered a public e-mail channel to communicate - which they knew would be blocked right away. And once it was blocked, there was no way to get any files back and thus nobody has any reason to pay ransom.

Wouldn't a simple power line filter which filters out PS/2 clock frequencies be enough?