Developers of the popular Tails Linux distribution (opens in new tab) have warned users to abstain from the OS until the next version is released, if they use it for entering, or accessing, sensitive information (opens in new tab).
“We recommend that you stop using Tails until the release of 5.1 (May 31) if you use Tor Browser for sensitive information (passwords, private messages, personal information, etc.),” the warning reads.
The announcement comes days after the Pwn2Own 2022 Vancouver event, where contestants successfully exploited two zero-days found in the Firefox JavaScrip engine. If the two vulnerabilities, tracked as CVE-2022-1802 and CVE-2022-1529, are abused successfully, they could allow threat actors to access information submitted to legitimate sites via the Tor browser on targeted endpoints (opens in new tab).
Exceptions to the rule
“For example, after you visit a malicious website, an attacker controlling this website might access the password or other sensitive information that you send to other websites afterwards during the same Tails session,” the warning explains.
Mozilla, which said some threat actors were already exploiting this vulnerability in the wild, has addressed the issue, BleepingComputer has found, but given that Tails is a live Linux distro, the devs cannot deliver patches for any of the included apps until the next release, which is due on May 31.
There are a few exceptions as well, including using Tor Browser on the Safest security level, which disables JavaScript by default. Email client Thunderbird also comes with JavaScript disabled by default, making it safe to use.
It was also said that if users refrain from accessing, or submitting, sensitive information via Tor, they can still safely use it, as these flows don’t break the encryption and anonymity provided by Tor.
Tails, short for The Amnesic Incognito Live System, is a Debian-based Linux distro, usually used by journalists, whistleblowers, civil rights activists, and other individuals looking to stay fully anonymous online, and bypass any censorship or government restrictions.
“Mozilla is aware of websites exploiting this vulnerability already. This vulnerability will be fixed in Tails 5.1 (May 31), but our team doesn't have the capacity to publish an emergency release earlier,” the Tails team warned.
English
Arabic
Belarusian
Bengali
Bosnian
Bulgarian
Chinese (Simplified)
Croatian
Czech
Danish
Dutch
Estonian
Filipino
Finnish
French
Georgian
German
Greek
Gujarati
Hausa
Hebrew
Hindi
Hmong
Hungarian
Igbo
Indonesian
Italian
Japanese
Javanese
Kazakh
Korean
Kurdish (Kurmanji)
Kyrgyz
Lao
Latvian
Lithuanian
Macedonian
Malagasy
Norwegian
Persian
Polish
Portuguese
Punjabi
Romanian
Russian
Serbian
Slovak
Slovenian
Spanish
Swedish
Thai
Turkish
Ukrainian
Vietnamese
Yoruba