May 2024 Summaries

Auto exit nodes, a new feature from Tailscale, aim to enhance secure internet access for remote and hybrid workforces by automatically connecting users to the most efficient exit nodes based on their location. This feature builds on previous innovations like regional routing, offering a scalable solution for organizations to manage secure and reliable internet connections across global infrastructures. Auto exit nodes support various operating systems, including MacOS, Windows, iOS, Android, Linux, and CLI, and work with Mullvad servers to optimize connections using latency and IP geolocation data. Advanced options like forced exit nodes will soon allow enterprises to ensure consistent security practices across their workforce using mobile device management tools, mitigating risks associated with unsecured networks. This capability is available to customers on Tailscale's Starter, Premium, and Enterprise plans, or those with the Mullvad add-on, facilitating a seamless and protected online experience without requiring manual input from users.

The TunnelVision bug (CVE 2024-3661) disclosed by Leviathan Security has prompted questions about its impact on Tailscale, a VPN, overlay, and mesh networking service. While the bug does not pose a major security threat to most Tailscale users, its effects vary depending on usage, environment, and operating system. Tailscale’s routing management on Linux and Android prevents the attack, but Apple platforms, including macOS and iOS, are more susceptible due to DHCP-provided routes taking precedence. Tailscale on Windows is partially impacted, with some traffic issues arising when using exit nodes. Tailscale has updated its macOS client to warn users of DHCP Option 121 routes, and users can disable these warnings via system settings. Despite the challenges in mitigating the issue on iOS due to platform restrictions, the company advises users to manually check for suspicious routes and use secure application protocols to minimize risk. The company emphasizes that the bug's adverse effects stem from standard use of DHCP option 121 and stresses the importance of encrypted communication protocols like HTTPS and SSH to safeguard Internet traffic.

Expanding on egress traffic visibility, Tailscale now offers Enterprise customers the ability to monitor destination addresses for traffic exiting the network via an exit node, thereby enhancing forensic analysis during security incidents. Previously, destination logging was redacted to prevent misuse, as exit nodes are designed to secure internet traffic over untrustworthy connections, not for surveillance. However, understanding which external endpoints a compromised device accessed can aid in assessing the incident's severity and tracing attack vectors. This feature, compliant with frameworks like MITRE’s ATT&CK, helps in identifying lateral movements and external threats. Enterprise users can activate exit node destination logging through the Tailscale admin console, providing crucial insights while maintaining the network's security integrity.

Tailscale has revamped its Android app, enhancing the user experience with a major update that aligns with its design system across platforms like iOS and the web client while incorporating Android-specific design elements. The update includes support for enterprise Mobile Device Management (MDM) solutions, allowing easy deployment and configuration of Tailscale on managed devices using systems like Google Workspace and Microsoft Intune. Users can now enjoy improved exit node functionality, fast user switching, and expanded support for Amazon Fire devices. The app also features detailed status indicators, enhanced DNS settings, and improved accessibility, including a new dark mode. The redevelopment utilized Jetpack Compose, replacing the previous Gio UI framework, to offer a more native experience, and integrated the handlers for the tailscaled API, thus modernizing backend interactions. This update aims to deliver a consistent and efficient user experience, and user feedback is encouraged to further refine the app. The updated Tailscale v1.66 is available on the Google Play Store and Amazon Appstore.

Tailscale has announced the general availability of its device posture management integrated with CrowdStrike's Falcon Zero Trust, enhancing security and control within Zero Trust networks. This collaboration allows organizations to use the Falcon Zero Trust Assessment (ZTA) score alongside Tailscale's device posture management to enforce granular access control based on device health and security. As Zero Trust requires continuous verification of device and user identities, this integration simplifies the implementation of Zero Trust strategies by enabling dynamic, attribute-based access policies. By leveraging real-time monitoring and AI-driven threat detection from the CrowdStrike Falcon platform, organizations can adapt network access policies to reflect changes in device security posture within 15 minutes, ensuring that only authorized and secure devices connect to their resources. This partnership aims to streamline the adoption of Zero Trust principles, offering a robust solution for enhancing network security.