This is worth checking out if you are running Bitcoin nodes

[Somegory]

If you are running Bitcoin node via TailScale it's time to turn off your SSH.
There are few newly detected vulnerabilities in TailScale SSH.

I am very certain that there are many Bitcoin node runners that don't even know they have TailScalle SSH enabled by default, I'm talking about people who are still novice to nodes.

Solution

Turn off your TailScale SSH
Wait for update patches



Numbers of unpatched flaws detected to far is 11 and maybe more

https://x.com/BitcoinNewsCom/status/2114361896794980526

[FirmWars]

Who set the house of fire, was it AI? Just this week alone, I have seen more than 3 news about companies that discovered vulnerability in their system. I first saw that of Bitcoin core, and also PHP which said it found a critical vulnerabilities on 21st this month and now this one. Those bitcoiners that are running node is supposed to always be attentive to the update from the company's software they are using and I guess they will see this information already.

[Smartprofit]

It seems the world around us is becoming increasingly unsafe.🙋

I'm constantly reading news about discovered software vulnerabilities... As far as I understand, it's the advancement of AI that's led to the discovery of more and more vulnerabilities in software code every day.

I'm not a full node owner myself, but I've read a little about Tailscale and SSH. As far as I understand, they're talking about the potential for an attacker to gain control of the computer running a full node.

This trend, in my opinion, isn't very good. ColdCard's low entropy has seriously scared off some advocates of self-storing Bitcoin using hardware wallets. This news may also frighten some full node owners (I'm not talking about people with a good understanding of computer technology, of course). However, it must be admitted that the constant need to be paranoid is exhausting for everyone.🤷

[CucakRowo]

Your warning is important. But I don't think there's any need to ask everyone to disable Tailscale SSH all at once. I have reviewed the report, it mentions 11 security finding. However, not all of them are vulnerabilities in Tailscale SSH. Some of these relate to other features of Tailscale and to Headscale.

And it’s not the case that Tailscale SSH is automatically enabled just because you use Tailscale. Check whether SSH is enabled on node, and simply remove permissions of those who do not require access. And if SSH forwarding isn't needed, it's good to restrict that as well.

[Royal Cap]

I don't know what is really going on in the world..! One hack after another and vulnerabilities are being revealed. If this is the result of AI, I don't know what will happen to our internet after quantum computing become mature. We already have no privacy. It will get worse in the near future. Anyway, I ran a Bitcoin node once in my life, that too through Bitcoin Core. But the TailScale thing is new to me. Anyway, thank you for sharing this information.

[PX-Z]

Who set the house of fire, was it AI? Just this week alone, I have seen more than 3 news about companies that discovered vulnerability in their system. I first saw that of Bitcoin core, and also PHP which said it found a critical vulnerabilities on 21st this month and now this one.

It seems the world around us is becoming increasingly unsafe.🙋

I'm constantly reading news about discovered software vulnerabilities... As far as I understand, it's the advancement of AI that's led to the discovery of more and more vulnerabilities in software code every day.

Those are good ways to use AI, to make the current system/technology more secure by detecting those vulnerabilities and keep the team behind those responsible to fix and upgrade them.

But of course, using those for bad ways is inevitable, bad actors are also there to make their ways.

[Dave1]

Well you can read their response here: Recent Tailscale vulnerability reports. In summary they said,

If you want to jump to the most important part, based on our current assessment, we're not recommending that everyone disable Tailscale SSH.

And then they throw their recommendations as well for those running or have concern Tailscale SSH.