{
  "guidislink": false,
  "id": "https://tailscale.com/security-bulletins/#ts-2024-012",
  "link": "https://tailscale.com/security-bulletins/#ts-2024-012",
  "links": [
    {
      "href": "https://tailscale.com/security-bulletins/#ts-2024-012",
      "rel": "alternate",
      "type": "text/html"
    }
  ],
  "published": "Wed, 02 Oct 2024 00:00:00 GMT",
  "summary": "\u003cp\u003e\u003cstrong\u003e\u003cem\u003eDescription\u003c/em\u003e\u003c/strong\u003e: Tailscale Funnel abused for phishing\u003c/p\u003e\n\u003ch4\u003eWhat happened?\u003c/h4\u003e\n\u003cp\u003eA malicious user abused \u003ca href=\"https://tailscale.com/kb/1223/funnel\"\u003eTailscale Funnel\u003c/a\u003e to host a phishing page\ntargeting Facebook users. This user created multiple free Tailscale accounts to\nuse as an obfuscation/anonymity proxy for their VPS instance hosting the\nphishing page.\u003c/p\u003e\n\u003cp\u003eWe received the first report about a phishing page on September 23rd, 2024, and\ntook down the Funnel page the same day. We received the second report on October\n1st, 2024, for the same phishing page on a different Tailscale account. We took\ndown the second page, added detection for new similar pages, and repeatedly\nshut down new attacker accounts as they were created. After a few more\nattempts, the attacker stopped creating new accounts.\u003c/p\u003e\n\u003ch4\u003eWho was affected?\u003c/h4\u003e\n\u003cp\u003e232 unique IP addresses accessed the attacker\u0027s Funnel nodes. Of those, 87 IP addresses made more\nthan one request, suggesting a possible phishing form submission.\u003c/p\u003e\n\u003ch4\u003eWhat was the impact?\u003c/h4\u003e\n\u003cp\u003eSome Facebook users could have been phished for their credentials. Since\nTailscale Funnel proxies can only see encrypted TLS traffic, we cannot confirm\nwhether anyone was successfully phished.\u003c/p\u003e\n\u003ch4\u003eWhat do I need to do?\u003c/h4\u003e\n\u003cp\u003eDon\u0027t use Tailscale Funnel for phishing.\u003c/p\u003e",
  "summary_detail": {
    "base": "https://tailscale.com/security-bulletins/index.xml",
    "language": null,
    "type": "text/html",
    "value": "\u003cp\u003e\u003cstrong\u003e\u003cem\u003eDescription\u003c/em\u003e\u003c/strong\u003e: Tailscale Funnel abused for phishing\u003c/p\u003e\n\u003ch4\u003eWhat happened?\u003c/h4\u003e\n\u003cp\u003eA malicious user abused \u003ca href=\"https://tailscale.com/kb/1223/funnel\"\u003eTailscale Funnel\u003c/a\u003e to host a phishing page\ntargeting Facebook users. This user created multiple free Tailscale accounts to\nuse as an obfuscation/anonymity proxy for their VPS instance hosting the\nphishing page.\u003c/p\u003e\n\u003cp\u003eWe received the first report about a phishing page on September 23rd, 2024, and\ntook down the Funnel page the same day. We received the second report on October\n1st, 2024, for the same phishing page on a different Tailscale account. We took\ndown the second page, added detection for new similar pages, and repeatedly\nshut down new attacker accounts as they were created. After a few more\nattempts, the attacker stopped creating new accounts.\u003c/p\u003e\n\u003ch4\u003eWho was affected?\u003c/h4\u003e\n\u003cp\u003e232 unique IP addresses accessed the attacker\u0027s Funnel nodes. Of those, 87 IP addresses made more\nthan one request, suggesting a possible phishing form submission.\u003c/p\u003e\n\u003ch4\u003eWhat was the impact?\u003c/h4\u003e\n\u003cp\u003eSome Facebook users could have been phished for their credentials. Since\nTailscale Funnel proxies can only see encrypted TLS traffic, we cannot confirm\nwhether anyone was successfully phished.\u003c/p\u003e\n\u003ch4\u003eWhat do I need to do?\u003c/h4\u003e\n\u003cp\u003eDon\u0027t use Tailscale Funnel for phishing.\u003c/p\u003e"
  },
  "title": "TS-2024-012",
  "title_detail": {
    "base": "https://tailscale.com/security-bulletins/index.xml",
    "language": null,
    "type": "text/plain",
    "value": "TS-2024-012"
  }
}