None

String updated in the repository

  1. Tails
  2. wiki/src/news/audit_by_ROS_2024.*.po
  3. Chinese (Taiwan) (zh_TW)
While preparing a major Tails release based on a new version of Debian, for example, Tails 7.0,
we will look for Perl code included in Tails
that modifies `@INC` in a dangerous way. ([[!tails_ticket 19627]])
 
yesterday
None

String updated in the repository

  1. Tails
  2. wiki/src/news/audit_by_ROS_2024.*.po
  3. Chinese (Taiwan) (zh_TW)
Postmortem of OTF-001
 
yesterday
None

String updated in the repository

  1. Tails
  2. wiki/src/news/audit_by_ROS_2024.*.po
  3. Chinese (Taiwan) (zh_TW)
Technical improvements
 
yesterday
None

String updated in the repository

  1. Tails
  2. wiki/src/news/audit_by_ROS_2024.*.po
  3. Chinese (Taiwan) (zh_TW)
This analysis was useful and we'll definitely consider doing postmortems again after future audits. It might also be useful for other projects to understand how we worked on these long-lasting improvements.
 
yesterday
None

String updated in the repository

  1. Tails
  2. wiki/src/news/audit_by_ROS_2024.*.po
  3. Chinese (Taiwan) (zh_TW)
Our team went further than simply fixing these issues. We conducted a *postmortem* to understand *how* we introduced these vulnerabilities in our releases and *what* we could do to avoid similar vulnerabilities in the future. This analysis led to technical, policy, and culture changes.
 
yesterday
None

String updated in the repository

  1. Tails
  2. wiki/src/news/audit_by_ROS_2024.*.po
  3. Chinese (Taiwan) (zh_TW)
Postmortem
 
yesterday
None

String updated in the repository

  1. Tails
  2. wiki/src/news/audit_by_ROS_2024.*.po
  3. Chinese (Taiwan) (zh_TW)
<table>
<tr><th>ID</th><th>Impact</th><th>Description</th><th>Issue</th><th>Status</th><th>Release</th></tr>
<tr><td>OTF-001</td><td>High</td><td>Local privilege escalation in <i>Tails Upgrader</i></td><td>[[!tails_ticket 20701]]</td><td>Fixed</td><td>6.11</td></tr>
<tr><td>OTF-002</td><td>High</td><td>Arbitrary code execution in Python scripts</td><td>[[!tails_ticket 20702]]</td><td>Fixed</td><td>6.11</td></tr>
<tr><td> </td><td></td><td></td><td>[[!tails_ticket 20744]]</td><td>Fixed</td><td>6.12</td></tr>
<tr><td>OTF-003</td><td>Moderate</td><td>Argument injection in privileged GNOME scripts</td><td>[[!tails_ticket 20709]]</td><td>Fixed</td><td>6.11</td></tr>
<tr><td> </td><td></td><td></td><td>[[!tails_ticket 20710]]</td><td>Fixed</td><td>6.11</td></tr>
<tr><td>OTF-004</td><td>Low</td><td>Untrusted search path in Tor Browser launcher</td><td>[[!tails_ticket 20733]]</td><td>Fixed</td><td>6.12</td></tr>
</table>
 
yesterday
None

String updated in the repository

  1. Tails
  2. wiki/src/news/audit_by_ROS_2024.*.po
  3. Chinese (Taiwan) (zh_TW)
- Other important changes since [[Tails 5.8|version_5.8]] (November 2023)
 
yesterday
None

String updated in the repository

  1. Tails
  2. wiki/src/news/audit_by_ROS_2024.*.po
  3. Chinese (Taiwan) (zh_TW)
- The automatic upgrade mechanism
 
yesterday
None

String updated in the repository

  1. Tails
  2. wiki/src/news/audit_by_ROS_2024.*.po
  3. Chinese (Taiwan) (zh_TW)
The auditors found 4 issues in:
 
yesterday
None

String updated in the repository

  1. Tails
  2. wiki/src/news/audit_by_ROS_2024.*.po
  3. Chinese (Taiwan) (zh_TW)
- The random seed feature, introduced in [[Tails 6.4|version_6.4]] (June 2024)
 
yesterday
None

String updated in the repository

  1. Tails
  2. wiki/src/news/audit_by_ROS_2024.*.po
  3. Chinese (Taiwan) (zh_TW)
- Our security improvements to [[*Thunderbird*|doc/anonymous_internet/thunderbird]]
 
yesterday
None

String updated in the repository

  1. Tails
  2. wiki/src/news/audit_by_ROS_2024.*.po
  3. Chinese (Taiwan) (zh_TW)
The creation of the Persistent Storage with LUKS2, introduced in [[Tails 5.14|version_5.14]] (June 2023)
 
yesterday
None

String updated in the repository

  1. Tails
  2. wiki/src/news/audit_by_ROS_2024.*.po
  3. Chinese (Taiwan) (zh_TW)
The auditors did not identify any vulnerability in:
 
yesterday
None

String updated in the repository

  1. Tails
  2. wiki/src/news/audit_by_ROS_2024.*.po
  3. Chinese (Taiwan) (zh_TW)
Findings
 
yesterday
None

String updated in the repository

  1. Tails
  2. wiki/src/news/audit_by_ROS_2024.*.po
  3. Chinese (Taiwan) (zh_TW)
> The Tails operating system leaves a strong security impression, addressing
> most anonymity-related concerns. We did not find any remote code execution
> vulnerabilities, and all identified issues required a compromised
> low-privileged `amnesia` user &ndash; the default user in Tails.
>
> Looking back at the [[previous audit|audit_by_ROS]], we can see the Tails
> developers have made significant progress, demonstrating expertise and a
> serious commitment to security.
 
yesterday
None

String updated in the repository

  1. Tails
  2. wiki/src/news/audit_by_ROS_2024.*.po
  3. Chinese (Taiwan) (zh_TW)
The auditors concluded that:
 
yesterday
None

String updated in the repository

  1. Tails
  2. wiki/src/news/audit_by_ROS_2024.*.po
  3. Chinese (Taiwan) (zh_TW)
We can now share with you the [final report](https://gitlab.tails.boum.org/-/project/103/uploads/56c89755aa84636e900094ed23e0919f/report_tails-1.pdf).
 
yesterday
None

String updated in the repository

  1. Tails
  2. wiki/src/news/audit_by_ROS_2024.*.po
  3. Chinese (Taiwan) (zh_TW)
To better protect our users, we addressed the security vulnerabilities as soon as they were discovered and reported to us, without waiting for the audit to be complete and public.
 
yesterday
None

String updated in the repository

  1. Tails
  2. wiki/src/news/audit_by_ROS_2024.*.po
  3. Chinese (Taiwan) (zh_TW)
Late 2024, [Radically Open Security](https://www.radicallyopensecurity.com/) conducted another security audit of critical parts of Tails.
 
yesterday

Search