Zero-day flaws in Tails aren't for sale, vulnerability broker says

Exodus Intelligence will provide a report to Tails by the end of the week, a company executive said

A company that specializes in selling information on software vulnerabilities has reignited a debate over the handling of such information, especially when it pertains to privacy-focused tools.

Exodus Intelligence, based in Austin, Texas, tweeted on Monday it had found several vulnerabilities in Tails, an operating system and suite of applications designed to make it harder to track a user's activity online.

Exodus researches and sells information on software vulnerabilities, a legal business but one that attracts criticism for its opaque nature and worries over how governments or other entities might use the information.

The company has since announced it will supply a report with the vulnerability information to Tails' developers by the end of this week. Exodus will not share that information outside of the company before then, wrote Aaron Portnoy, vice president, in an email exchange Tuesday with IDG News Service.

When asked if Exodus was making a special exception for Tails, Portnoy wrote: "We evaluate every vulnerability we deal with on a case-by-case basis, therefore the Tails vulnerability is not an exception as we have no baseline standard."

Tails is a Linux-based operating system that uses several privacy-enhancing tools such as Tor to make using the Internet more anonymous. It is designed to be used on-the-go, such as at public Internet access points, and is considered one of the best but not foolproof ways to reduce leaving a digital footprint on a computer.

The tweet from Exodus provoked a reaction from Tails, which wrote on its blog that it was not contacted prior to the tweet. But Tails was pleased it will have the chance to see the information.

"We're told they won't disclose these vulnerabilities publicly before we have corrected it, and Tails users have had a chance to upgrade," the blog post read. "We think that this is the right process to responsibly disclose vulnerabilities, and we're really looking forward to read this report."

Portnoy said that Exodus doesn't exclude certain kinds of software from its analysis and that "we focus on things that are widely deployed."

It wasn't clear if public pressure influenced the decision by Exodus to disclose the information privately to Tails. The way the issue was handled generated a largely negative reaction against Exodus on Twitter, with some accusing the company of potentially putting users at risk.

Portnoy noted some tweets from Christopher Soghoian, who is the principal technologist with the Speech, Privacy and Technology Project at the American Civil Liberties Union. Soghoian has long been critical of the vulnerability broker business.

Soghoian took a swipe at Portnoy, writing "I'm pretty sure @aaronportnoy isn't interested in keeping anyone safe. He is interested in selling awesome 0-day for cash money."

Portnoy said in an email that he understood why Tails' developers "may have been irritated due to the hyperbolic reactions from some of the more vocal individuals on the outskirts of this industry who were under the impression we were selling the information to others."

Referring to Soghoian, Portnoy wrote: "When people have upwards of 35,000 followers, false ideas can easily spread without any attempt at validation."

Send news tips and comments to jeremy_kirk@idg.com. Follow me on Twitter: @jeremy_kirk

Join the Good Gear Guide newsletter!

Error: Please check your email address.
Rocket to Success - Your 10 Tips for Smarter ERP System Selection

Tags Exodus Intelligencesecurity

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Jeremy Kirk

IDG News Service
Show Comments

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Matthew Stivala

HP OfficeJet 250 Mobile Printer

The HP OfficeJet 250 Mobile Printer is a great device that fits perfectly into my fast paced and mobile lifestyle. My first impression of the printer itself was how incredibly compact and sleek the device was.

Armand Abogado

HP OfficeJet 250 Mobile Printer

Wireless printing from my iPhone was also a handy feature, the whole experience was quick and seamless with no setup requirements - accessed through the default iOS printing menu options.

Azadeh Williams

HP OfficeJet Pro 8730

A smarter way to print for busy small business owners, combining speedy printing with scanning and copying, making it easier to produce high quality documents and images at a touch of a button.

Andrew Grant

HP OfficeJet Pro 8730

I've had a multifunction printer in the office going on 10 years now. It was a neat bit of kit back in the day -- print, copy, scan, fax -- when printing over WiFi felt a bit like magic. It’s seen better days though and an upgrade’s well overdue. This HP OfficeJet Pro 8730 looks like it ticks all the same boxes: print, copy, scan, and fax. (Really? Does anyone fax anything any more? I guess it's good to know the facility’s there, just in case.) Printing over WiFi is more-or- less standard these days.

Ed Dawson

HP OfficeJet Pro 8730

As a freelance writer who is always on the go, I like my technology to be both efficient and effective so I can do my job well. The HP OfficeJet Pro 8730 Inkjet Printer ticks all the boxes in terms of form factor, performance and user interface.

Michael Hargreaves

Windows 10 for Business / Dell XPS 13

I’d happily recommend this touchscreen laptop and Windows 10 as a great way to get serious work done at a desk or on the road.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?