大家好 我是为什么叫QQ

Hello everyone, I'm WhyCallQQ.

你用Tailscale远程跑AI Coding

If you use Tailscale to run AI coding remotely,

可能已经给了代理一条进入服务器群的通道

you might have unwittingly given your agent a direct pathway into your server cluster.

10月25日

On October 25,

研究者Erica Windisch发布Tailworm报告

security researcher Erica Windisch published the 'Tailworm' report.

她在实验室里用一台失陷设备

In a lab environment, starting from a single compromised machine,

通过Tailscale SSH拿到其他服务器的root权限

she leveraged Tailscale SSH to seize root privileges on other servers,

并演示自动扩散 先别急着卸载

demonstrating automated lateral worm propagation. But don't rush to uninstall just yet:

攻击者需要提前控制一台策略允许通信的设备

an attacker must already control a device permitted by your ACLs,

目标还要启用Tailscale SSH并允许相关转发

and the target must have Tailscale SSH enabled with relevant forwarding permitted.

这不是互联网上的零点击入侵

This is by no means an internet-wide zero-click exploit.

真正值得程序员检查的是

What every developer should genuinely audit,

自己的开发机 AI代理和生产服务器之间

is between your dev machine, your AI agent, and production servers,

到底留了多少条宽规则

how many overly permissive rules you've left wide open.

这份报告测试的是Tails cale

The research specifically tested Tailscale

1.104.2和head scale0. 29.5

v1.104.2 and headscale v0.29.5,

测试时间是10月22日至24日

benchmarked between October 22 and 24.

11项发现覆盖SSH 实验性app connector

Its 11 findings cover SSH, experimental app connectors,

Serve DERP客户端和headscale

Serve, DERP clients, and headscale.

截至10月26日 官方安全公告页还没有对应公告

As of October 26, the official security bulletins page lists no advisory,

也没有CVE和明确修复版本

with no CVE assigned or patched release designated.

Tails cale工程副总裁Mike Shaver在Reddit表示

On Reddit, Tailscale VP of Engineering Mike Shaver stated

公司正在处理发现的问题 并核查受影响配置

the team is actively addressing the findings and auditing affected configurations,

他不建议所有用户一律关闭Tailscale SSH

adding that he does not recommend blanket-disabling Tailscale SSH for everyone.

目前没有公开的真实入侵案例或独立复现

There are currently zero public in-the-wild breaches or third-party reproductions.

我们可以认真加固 没必要把它讲成全网已经失守

We can take hardening seriously without hyping this into an internet-wide catastrophe.

Tailscale的连接加密和设备认证

Tailscale's connection encryption and device authentication

跟这次问题要分开看

must be analyzed separately from this issue.

官方文档说明

According to official documentation,

Tails cale SSH会用Wire Guard节点密钥识别设备

Tailscale SSH uses WireGuard node keys to authenticate machines,

再由策略决定哪台设备能登录哪台机器

with ACL policies dictating which device may connect to which host.

SSH的认证阶段可以使用none

The SSH authentication stage itself can use 'none',

不再检查传统密码或私钥

dispensing with traditional passwords or SSH private keys.

普通OpenSSH over Tailscale是另一种架构

Plain OpenSSH over Tailscale operates on a different architecture:

前者由tail scaled内置服务

the former relies on the built-in tailscaled daemon

接管来自tail net的22端口

intercepting port 22 traffic from the tailnet,

后者仍由OpenSSH管理会话

while the latter lets standard OpenSSH manage user sessions.

连接被允许以后 转发操作由谁执行

Once a connection is authorized, who executes the forwarding operations

才决定了风险落在哪里

is what determines where the real risk falls.

报告里最直接的一项 是Unix socket forwarding

The report's most striking finding centers on Unix socket forwarding.

socket是本机服务的通信接口

Unix domain sockets serve as local communication endpoints

Docker systemd和Tailscale都在用

used ubiquitously by Docker, systemd, and Tailscale alike.

研究者称 Tails cale SSH的相关

The researcher notes that Tailscale SSH's socket

转发由高权限的tail scaled执行

forwarding is executed by the root-level tailscaled process.

普通会话可能借它连接root才能访问的socket

An unprivileged session could exploit it to reach root-only sockets,

或者替换root拥有的socket

or even overwrite root-owned socket paths.

实验室里 这条路径碰到了Docker控制接口

In the lab, this vector reached the Docker control socket,

随后取得root 并读取 /etc/shadow

subsequently obtaining root access and reading /etc/shadow—

不需要docker组或sudo

all without belonging to the docker group or possessing sudo.

禁止直接登录root账户有价值

Blocking direct root SSH logins remains valuable,

却挡不住普通会话借用root进程做转发

yet it cannot stop an ordinary session from piggybacking on a root daemon's forwarding.

你觉得普通用户权限还够用吗？

Do you still think standard user isolation is sufficient?

把看法打在公屏上

Drop your thoughts in the comments.

路径白名单也可能被时间差绕过

Path whitelists can also be circumvented by timing windows.

这类问题叫TOCTOU 即检查和使用之间

This class of vulnerability is known as TOCTOU—Time of Check to Time of Use—

对象被替换

where the target object is swapped in between.

程序先检查一个位于 /tmp的安全路径

The software first checks a benign path under /tmp,

随后才真正连接或删除它

only connecting to or unlinking it moments later.

攻击者趁机替换路径指向 绕过白名单

An attacker exploits that gap to swap symlinks, bypassing whitelist checks.

报告用这种方法接触了systemd

The report used this technique to reach systemd,

Docker和tailscaled的LocalAPI

Docker, and tailscaled's own LocalAPI.

研究者还演示了获取节点注册密钥

The researcher also demonstrated extracting node registration keys

并在未启用Tail net Lock的网络里加入伪造节点

to introduce rogue nodes into tailnets lacking Tailnet Lock.

部分竞态利用并不稳定

Granted, some race conditions proved finicky:

systemd路径成功率只有零到百分之四

the systemd exploit yielded an empirical success rate of just 0% to 4%.

不过 低成功率可以靠反复尝试弥补

However, low single-shot odds can be brute-forced through rapid retries;

防护不能寄托在对手运气差上

defensive posture must never rely on an attacker having bad luck.

这件事跟AI Coding的关系很直接

This ties directly to today's AI coding landscape.

你让代理远程维护开发服务器

When you have an agent remotely maintain a dev server,

代理可以执行shell 安装依赖 读取项目

it can run shell commands, install dependencies, read repo source,

还可能调用Docker

and even interact with Docker.

它还可能继承当前设备在tailnet里的通信资格

Crucially, it also inherits that machine's verified credentials on the tailnet.

Tailscale官方文档提醒

Tailscale's official docs explicitly warn

客户端机器上的任何操作系统用户

that any local OS user on an authorized client machine

都可能通过这台设备连接策略允许的SSH服务

can connect through it to any policy-permitted SSH host.

文档也明确说 如果机器会运行你不信任的代码

The docs clearly state: if a machine executes code you don't fully trust,

Tailscale SSH未必适合

Tailscale SSH might not be the right fit.

代理的依赖 脚本和工具调用 都应纳入威胁模型

An agent's package dependencies, shell scripts, and tool calls must be modeled as threats.

模型没有恶意

The foundation model may harbor no malice,

也可能执行被仓库 Issue或依赖包诱导的命令

yet it can be tricked into executing malicious commands injected via repo issues or packages.

设备授权不会分辨命令来自人还是代理

Device-level authorization cannot distinguish whether a command came from a human or an agent.

开发机失陷 损失未必停在这一台

When a dev box falls, the damage rarely stays confined to that single machine.

宽SSH规则会改变这个边界

Broad SSH ACL rules drastically expand that blast radius.

比如 整个开发组都能访问所有带tag:

For instance, if the entire engineering group can access all nodes tagged

prod的机器 攻击者拿到其中一台

tag:prod, compromising any developer laptop

就拿到规则允许的全部入口

grants immediate entry to every production target permitted by policy.

报告把实验室里的自动扩散称为wormable

The report labeled this automated lab propagation 'wormable',

每跳低于一秒

spreading across hops in under a second.

Hacker News上有人质疑这个叫法

Hacker News commentators pushed back on the term,

因为它不能跨租户传播

pointing out that it cannot cross tenant boundaries

也需要已有立足点和策略许可

and requires pre-existing foothold and policy allowance.

更准确的描述是

A more precise description would be:

在策略允许的范围内自动横向移动并提权

automated lateral movement and privilege escalation within policy boundaries.

研究者的测试里

In the researcher's own benchmark tests,

明确指定单一来源和单一目标的per-pair规则

strict per-pair rules specifying exact 1-to-1 source-to-destination pairs

阻断了继续扩散

successfully halted further propagation.

Hacker News的讨论很分裂

Community debate on Hacker News has been polarized:

有人认为socket转发导致root提权很严重

some view root escalation via socket forwarding as a severe architectural defect,

也有人批评报告过长 措辞像AI生成

while others criticize the report for being overly verbose and AI-generated in tone.

也有人争论披露流程

Disclosing etiquette also sparked debate:

研究者称 公开前已把报告和PoC发给安全联系人

the researcher noted the full report and PoC were sent to security contacts prior to release,

只是没有协调发布

albeit without establishing a coordinated disclosure embargo.

Reddit上 官方选择先承认正在调查

On Reddit, Tailscale chose to promptly acknowledge the investigation

再给出临时建议

while issuing interim mitigation advice.

X上能检索到的公开内容以安全账号转发为主

Public discourse on X mainly comprised security community retweets,

样本有限 不能代表整个平台

a limited sample that cannot represent the broader developer ecosystem.

还有个细节值得保留

One critical technical rebuttal should also be noted:

报告声称节点能拿到完整对等设备清单

the report claimed nodes could harvest the entire tailnet peer inventory,

一位Tailscale员工回应

to which a Tailscale engineer clarified

官方控制面会做netmap trimming

that the control plane performs netmap trimming,

没有ACL关系的节点会被裁掉

pruning any nodes with which a given host shares no ACL relationship.

现在该做什么？先确认自己用了哪种SSH

What should you do right now? First, verify which SSH flavor you're running.

若目标机没启用Tailscale SSH

If target servers do not have Tailscale SSH enabled,

你只是通过隧道连接原有OpenSSH

and you merely tunnel to legacy OpenSSH,

前三项SSH发现的前提就不成立

the preconditions for the primary SSH exploits do not exist.

启用后 先列出所有ssh规则 再找autogroup:

If enabled, list all SSH ACL rules and search for autogroup:

member tag和大范围用户组

autogroup:members, broad tags, and sweeping user groups.

优先处理来源设备多 目标服务器多

Prioritize environments with many source devices, numerous target servers,

而且服务器存在Docker containerd

and nodes hosting high-privilege Unix sockets like Docker, containerd,

kubelet或systemd等高权限socket的环境

kubelet, or systemd.

只有家庭两台设备 规则只指向自己的环境

For home homelabs with two personal devices scoped strictly to each other,

风险和扩散面都小得多

the blast radius and attack surface are dramatically smaller.

风险评估从实际配置开始 版本号只占一部分

Security assessment starts with your live configuration—version numbers are only half the story.

无需此功能的节点 确认备用登录后

For nodes that don't need this feature, confirm out-of-band access first,

用tailscale set --ssh=false关闭

then disable it via: tailscale set --ssh=false.

临时加固最有效的一项

The single most effective interim mitigation

是把SSH许可缩到具体来源和具体目标

is narrowing SSH permissions down to explicit single sources and targets.

运维笔记本能访问构建机

If an ops laptop needs to reach a build worker,

同组电脑未必都要这条路径

peer machines in the same engineering group should not share that pathway.

AI开发节点不该继承生产入口

AI development sandboxes must never inherit ingress into production.

去掉长期不用的accept规则

Purge stale, long-forgotten 'accept' rules.

报告建议在支持的配置里

The report advises that in supported configurations,

关闭本地和远程forwarding

local and remote port forwarding should be explicitly disabled.

官方公开策略文档目前没有列出对应字段

However, Tailscale's public ACL documentation does not yet officially expose those fields,

所以不要照抄来历不明的JSON

so avoid blindly copying unverified JSON snippets into your policy.

通过控制台 官方支持或后续公告确认可用方式

Verify valid directives via the admin console, support channels, or forthcoming advisories.

headscale 0.29.5无法关闭这些转发

Headscale v0.29.5 currently lacks switches to disable these forwardings,

研究者建议把每条SSH许可

prompting the researcher to suggest treating every granted SSH rule

都按潜在root权限看待

as potentially equivalent to granting full root access.

修改后用sshTests和真实连接验证

Always validate changes with sshTests ACL unit tests and real connections—

别把自己的运维通道锁死

never accidentally lock yourself out of operational tunnels.

check mode也值得开 但要清楚它管哪一段

Enabling 'check mode' is also prudent, but understand its exact scope:

它在连接前要求重新登录身份提供方

it mandates fresh re-authentication against your IdP prior to session start,

缩短被盗设备发起会话的窗口

shrinking the window in which a stolen laptop can initiate new connections.

高风险登录可缩短checkPeriod 或每次检查

For sensitive hosts, shorten checkPeriod or enforce re-auth on every attempt.

自动化任务频繁创建连接时

When automation jobs create frequent connections,

always可能影响Ansible等工具

setting 'always' can break headless workflows like Ansible,

需要单独设计规则

requiring dedicated bypass rules.

关键来了 二次认证通过后

Here is the critical catch: once 2FA succeeds,

会话里的Unix socket转发仍然存在

the Unix socket forwarding within the active session remains fully operative.

check mode增加了一道门

Check mode adds a front door,

却不改变门后由root进程执行转发的行为

but changes nothing about the root daemon executing socket forwarding behind it.

自动更新也应该开启

Auto-updates should certainly stay on,

但最新版尚未公告修复本次发现

yet no official release has claimed to patch these specific findings yet.

升级到1.104.2能处理另一项证书问题

Upgrading to 1.104.2 resolves an unrelated certificate bug,

不能据此宣布Tailworm已经解决

which cannot be conflated with solving the Tailworm vector.

AI Coding环境可以再隔离一层

AI coding environments warrant an extra layer of defensive isolation.

我会给代理使用独立节点

I strongly advise assigning agents to isolated, dedicated nodes,

独立系统用户和独立策略

under dedicated OS users governed by tailored, least-privilege ACLs.

只开放代码仓库 测试机与必要API

Grant access strictly to code repos, staging testboxes, and required APIs;

生产服务器不放进它的目的地列表

never place production servers anywhere on its destination list.

Docker socket不挂进代理容器

Never bind-mount the Docker socket into an agent container,

云服务凭证也不写进它能读取的主目录

nor store cloud provider credentials inside a home directory it can inspect.

无人值守时 再加出站限制和命令审计

For unattended runs, layer on strict egress firewalls and shell command auditing.

高权限运维继续走人工确认

High-privilege infrastructure changes should remain firmly behind manual human sign-off.

必要时保留OpenSSH over Tailscale

Where needed, retain OpenSSH over Tailscale

减少内置SSH的攻击面

to minimize exposure to the built-in daemon's attack surface.

这能把提示词注入

This firmly constrains prompt injections,

恶意依赖或误执行限制在测试区

malicious dependencies, or accidental commands inside a safe sandbox.

把你的看法打在公屏上：

Drop your take in the chat:

你敢让能自由执行命令的AI代理

would you dare allow an autonomous shell-executing AI agent

直接持有生产环境的SSH权限吗？

to hold direct SSH credentials to your production fleet?

发现设备失陷后 重新安装系统只是清理本机

If a device is compromised, wiping the OS only sanitizes local disk;

攻击者可能已复制节点状态和密钥

an adversary may already have cloned the node state and private keys

换机继续使用原身份

to persist using that machine's identity elsewhere.

报告建议先在控制面删除设备 使节点密钥失效

The report urges first deleting the node in the admin console to revoke its key,

再轮换它能接触到的authkey 云凭证和其他秘密

then rotating every authkey, cloud secret, and credential it ever touched,

然后才重新安装

before finally reinstalling the operating system.

服务器应开启节点密钥过期

Servers should enforce node key expiry,

并用TPM或Secure Enclave绑定设备状态

backed by TPM or Secure Enclave hardware binding.

Tailnet Lock也能限制未经签名的节点加入

Tailnet Lock provides cryptographic guarantees against unauthorized node additions.

告警要放到失陷服务器无法修改的位置

Telemetry logs must ship to storage that compromised hosts cannot alter,

关注异常注册 authkey使用和高频路径重命名

monitoring for rogue registrations, authkey consumption, and rapid socket renaming.

应急流程如果只写着重新安装

If an incident response runbook only prescribes OS reinstallation,

可能把攻击者留在网络里 今天可以做完四件事

it leaves the attacker entrenched inside your net. Here are 4 actions for today:

确认目标机有没有启用Tailscale SSH

1. Audit whether target servers actually run Tailscale SSH;

导出并审查SSH策略 把AI代理与生产权限分开

2. Export and review SSH ACLs, severing AI agent nodes from production access;

再检查Serve是否把TCP转发指向Unix socket

3. Verify whether Tailscale Serve routes TCP forwarding into privileged Unix sockets;

使用实验性conn25的团队 还要收回多余授权

4. For teams testing experimental conn25, revoke excessive grants

并在connector上限制真实出站目的地

and enforce strict destination filtering on the connector host.

headscale自托管用户应限制注册接口暴露

Self-hosted headscale administrators must restrict registration endpoints,

配置速率限制 内存上限和自动重启

enforcing rate limiting, memory quotas, and supervisor auto-restarts.

我警惕的是 方便功能把设备身份

What I caution against is convenience features binding machine identity,

网络授权和高权限服务连在一起

network authorization, and root services into a single monolithic chain.

远程AI编程越顺手 越要画清这条链

The smoother remote AI coding becomes, the sharper that boundary line must be drawn.

你现在会让AI代理接触生产机吗？

Do you let AI agents anywhere near your production servers today?

欢迎评论区聊聊 感谢观看 记得一键三连

Let's discuss in the comments. Thank you for watching, and remember to like and subscribe.

我是为什么叫QQ 我们下期见

I'm WhyCallQQ—see you in the next episode.