Critical TailsOS Security Bug

[@BadBoiFX]

I'm running TempleOS just fine with networking support and never got hacked, take that glowies

[@darkcoeficient]

As intended by God

[@kneel1]

Besides best opsec, TempleOS also has the best games

[@NeverMetTheGuy]

The most Enlightened OS.

[@ktsmells]

Ring 0 only

[@4megii]

@@darkcoeficient God didn't intend internet connectivity. That's essentially eating from the forbidden apple.

[@codefallacy]

The beauty of open source software, there will always be someone way smarter and more paranoid than you that will sniff out these vulnerabilities

[@HAL-ol1lh]

Apparently not.

[@harekrishnabagh]

Actually it's the fact that there is a community that spends their own time to save everyone. Don't mean that they are more paranoid!

[@MGSBESTProductions]

And there will always be entire government teams that work in coordination to find the vulnerabilities and hoard them. 😅

[@Entropy67]

Na not unless you are sniffing yourself. Who actually is doing all this volunteer code maintenance?

[@Jadty]

Based.

[@DanSavageGames]

I love how he gets straight to the point. Literally 0:00 he says to update TailsOS due to critical vulnerability that's immune to TailsOS's amnesiac nature. Thank you Mental Outlaw, I love your videos.

[@ripjoe.-_-.]

get off dis video and go cheat in mc bruh

[@diztinger]

​@@ripjoe.-_-.who hurt you?

[@AKAK-rh7lr]

@@ripjoe.-_-.😂😂😂😂

[@robotron1236]

That’s because he knows most of us are gonna watch/listen to the end anyway.

[@robotron1236]

@@ripjoe.-_-. learn English…

[@elmercybersec]

Just a reminder that there no such thing as perfect OPSEC.

[@rubenfrost]

@@elmercybersec letters printed by a modified printer to hide yellow tracking dots gets pretty close

[@eddiewramos]

>he doesn’t telepathically send messages to desired recipient

[@BadBoiFX]

@@elmercybersec there is. There is no consistent long term perfect OpSec

[@NeverMetTheGuy]

Always wear a condom, mask, and stay strapped before getting online.

[@nikhilnarayanan5949]

​@@BadBoiFXI'm having some pretty serious diahorrea. Thank you for this comment, but I can't stop fucking farting my dude. What do I do?

[@shioq.]

Sonic is looking at Tails right now with suspicion

[@ValleyMansonOfficial]

I haven't trusted Tails since I saw him sitting on that park bench 😭

[@Xiao_PP]

Sonichu's just banging his mom

[@the_lyden]

say that again

[@jessl1934]

And what's his fascination with that damn rotating cat that does covers of popular song anyway? That alone is sus.

[@devviz]

who is sonic? or do you mean "seytonic" youtube channel?

[@theycallme_nightmaster]

has imagine my shock. How could this ever happen

[@KajuTheRudeMonke]

Right? Unbelievable.

[@samuelhulme8347]

Oh no! The fence to our super secret military base has been broken into. How could that ever happen?

[@muhdiversity7409]

AI will fix it all. LMAO

[@Bob-of-Zoid]

🤪

[@JohnDoe-ip3oq]

Open source is run by organizations susceptible to glowie infiltration. There's better ways than using red flag methods. Not that I go full mudahar, just use normal stuff normally with basic privacy control.

[@Anikio_1]

QubesOS philosophy was right, NO ONE IS SAFE FROM THE GLOWIES

[@BobBarkerHeretictoScientism]

Glowies?

[@perpetualcollapse]

@@BobBarkerHeretictoScientism The alphabet boys

[@alanhasmemes]

​@@BobBarkerHeretictoScientismgovernment interference/spying

[@papakamirneron2514]

Remind me what that philosophy is again please. How does it differ from other’s?

[@Jmvars]

@@papakamirneron2514 others*

[@drTERRRORRR]

The concept of beating the glowies with piece of string is simply amazing.

[@rubenfrost]

oh hell nah

[@daigo120]

they caught us lacking trump

[@rubenfrost]

this gives me the glows

[@andreasmayer1]

@@rubenfrostdefinetly glows

[@rubenfrost]

@@daigo120 the whole US caught lacking 😂💀

[@emmioglukant]

Feds: *Oh hell yeah!*

[@cdcopper3438]

4:20 "Which is when the party van is gonna come" Lmfao dude that line is so good I love it.

[@vaakdemandante8772]

All of those privacy platforms, either on PC or phone have their own tailor-made 0-days/backdoors used by 3 letter agencies. Don't for one second think you can be anonymous when doing the truly questionable stuff. If it's digital they have a way of accessing it - it's just a matter of how much your actions motivate them to do so.

[@efflux89]

Well said. I’m not doing jack shit illegal online. I just like cybersecurity. People are kidding themselves if they think they’re safe from the nation state actors by using this stuff.

[@xj3nr]

They are sus in the first place unless their binaries are reproducible

[@xj3nr]

And prob 99 of all vpns are honeypots

[@TerpGoblin666]

@@efflux89 All of the times someone has been caught using tails it was when it was on the persons computer. Once tails leaves the pc no trace is found. That’s why everyone uses tails. You don’t even know what you are talking about. If the government had a back door inside tails every market right now would be down. It’s secure for a reason. Not for paranoid people like you to say it’s got the back door lol 😂

[@Sandyk-k2k]

Didn't think anyone actually used the updater. I've always just installed a new version of TAILS from scratch.

[@glossyfpv1155]

I think the updater is really only useful for noobs and for people with stuff in their persistent that they don't want to move constantly. Me personally I prefer just making a new stick but I can see the usefulness behind the updater

[@MrDeejayjfx]

I hope the glowies got replace by HB1 visas.

[@r.b.ratieta6111]

Underrated comment. 😂😂

[@Monojoe]

sar we have warrant sar

[@FrankHarwald]

Naa, they might end up being more efficient & nothing is more totalitarian than efficient government.

[@MrDeejayjfx]

@@FrankHarwald lol.

[@H4KD11]

​@@FrankHarwaldEfficient? No. Totalitarian? Yes

[@RERM001]

This is the only time I've heard that my local McDowell's Wi-Fi is the safest option. Also, thanks for that FOSS McGriddle recipe, it is quite a tasty thing from burgerland unlike the usual spicy stuff they make on my rancho for those times when aguas locas are truly locas.

[@wrathofainz]

Ain't no way I'm leaving a laptop in a fast food joint without me present.

[@TakeApartLab]

It also helps for if the police try to drag you away from it. There is a famous case of this happening to the person that ran the silk road, iirc, they staged a distraction (people fighting? i cant remember) and when he got away from his computer to help they captured him and his laptop.

[@seeibe]

"It would apply to anyone living under an oppressive government as well" That's basically everybody on the planet at this stage of global decline

[@HAL-ol1lh]

I think China and Russia is doing just fine and that's a good thing because the deceit and double crossing and betrayal through all 4 Estates of our own regime , (not just of enemies of the State but also of law abiding tax payers ) has reached a point where I have lost all faith in the system.

[@comfeytimid1207]

​@@HAL-ol1lh russia is NOT doing fine lol. people are stealing butter now

[@kristoffer8609]

@@HAL-ol1lh How exactly are they doing fine?

[@thewhitefalcon8539]

​@@kristoffer8609 they're not doing any worse than the USA

[@HAL-ol1lh]

@ For one, they're about to overtake USA as the global power. With far less fanfare. And from the outside it seems to me - in general- the Chinese government's raison d'etre is to solve problems of its citizens, rather than solve the problem that IS its citizens.

[@eyezikandexploits]

Switching to cubes now.

[@MrDeejayjfx]

I wished had more ram.

[@rubenfrost]

@@eyezikandexploits yeah same but my laptop has nvidia😭😭😭

[@IQof2]

Inb4 QubesOS Critical Security Bug

[@SS-gu2tx]

Good luck getting anything done.

[@Rationalisyourfather]

I have doubt on your activities 🧐

[@SkyHighPatriot]

Every time I think "nah, something is off about this" stuff happens... My gut is too accurate

[@acmhfmggru]

I remember learning about branch prediction and all of the processor tricks to squeeze out extra speed and thinking "this seems exploitable" but not being able to think out the exploit, and then years later meltdown and spectre happened and I felt so vindicated.

[@efflux89]

Me too. I can’t wait until we find out 20 years from now that those facial recognition cameras at the airports that totally aren’t saving your picture, have in fact been saving your picture.

[@SkyHighPatriot]

@@efflux89 Oh most definitely. I have to wonder if the whole covid thing, wasn't just a ploy to get images of everyone with their faces covered to make identifying people easier in the future. They made us all use self checkout, which has what amounts to a selfie camera at the average machine.

[@nothingtoseehere449]

something tells me kenny is a very capable threat actor that could destabilize the power grid if he wanted too but he is benevolent cyber god that rather share knowledge instead

[@voidknight8632]

Praise the Omnissiah!

[@acmhfmggru]

You dramatically overestimate him. He's a shirt vendor and news reader.

[@yizhizhu5154]

I would not be surprised if 1 out of 10k high schoolers are capable of disabling a local power grid. Doing that and not getting caught is a very different story though.

[@randomkid8999]

@@acmhfmggru Kenny is that you?!

[@SynthwaveDuck]

​@@acmhfmggruThirsty commenter

[@vonweiss7149]

I saw this and burnt my house and devices. Ive currently got myself a new identity and im flying to Argentina and from now on i shall abide by the cubes. #FreeRoss

[@roguegryphonica3147]

Instructions unclear... leaked user data to dark web... good luck with thd good old boys network... Dos Reinas.

[@chbrules]

That USB pull at the end is some movie-esque shiz. Love it!

[@RamenRev]

I appreciate everything you do for us when it comes to warning us of vulnerabilities in systems. I hope to learn more about security soon :).

[@BlueFox61]

Thank you mental fed

[@laughingdaffodils5450]

Auto-updaters are security holes just waiting for exploits.

[@JosephAlnasl]

08:11 that covered webcam

[@rafaelgaluh]

you don't cover up your webcam? all my friends and I do this because there used to be spyware that could turn on webcams secretly

[@prezentoappr1171]

Well I got the lenovo zhuge liang camera lid since purchase so ig I read art of war now?

[@peacefuldeityspath]

BRO!!! as soon as i saw this i got scared am immediately on it rn. updating RN!!

[@avensisverso]

i just finished a mini report on it for a assignment few days ago 😭

[@peacefuldeityspath]

@avensisverso Sheeeeeeesh. did you pass the assignment?

[@avensisverso]

@ not yet it was due yesterday but i submitted 5 days ago. and indeed i used 6.10 to test it 😞

[@peacefuldeityspath]

@avensisverso r you a programmer or some sort?

[@TheCommunistRabbit]

What nefarious acts could bro be doing to be that afraid

[@StanleyBrunswick]

Eff... Good thing I definitely 'only' use TAILS for visiting my favorite Persian Rug Enthusiast Forum Edit - Just to clarify, I was making a Meme about 4Chan... not anything nasty like what our current president is.

[@pluto8404]

persian rugs are like finger prints though. Your specific preferences of exquisite rugs will burn your identity.

[@ifyouthinkthisworldisbad]

​@@pluto8404mwahahahahahah we got his ass now. KNOCK KNOCK FBI OPEN UP

[@leonkanivora]

is persian rug what i think it is?

[@dr.derekrobinson1920]

Why do you think it's called PREF?

[@redcoat4348]

what does it mean

[@nezu_cc]

Nice ad for whonix and/or qubes. Even if you compromise the VM, there is still no way to find the real IP since you still have to go through the gateway that's on a separate VM and is forcing everything through Tor.

[@BJ-sq1si]

Qubes and whonix might end up being more secure to avoid this class of vulernabilities

[@2phrogs]

1 min after post while eating? i feel chosen

[@samuelleandro2275]

At this point I'm just saving to move to the Himalayas.

[@erazerburst]

every video of yours refreshes my paranoia, although I have no reason for it🤐

[@NLozar22]

The "official" story behind how Buster Hernandez got caught makes zero sense. It is described as the exact kind of attack that Tails protects against. Supposedly Facebook hired a red hat team to develop an exploit to deanonymize him. It relied on a 0-day inside GNOME video player. (The vulnerable code has since been removed from the player, BTW.) Problem is that even if you can find such vulnerability, Tails firewall is set to drop/reject all outgoing connections that aren't routed through Tor. To change such firewall rules you need root privileges. Such privesc in Linux would make Log4shell look like a firefly against a hypernova.

[@yassenredwan8297]

I don't get it, if tails will block such connection, how did they catch him ? Did they manage to be part of the onion route also ?

[@NLozar22]

@@yassenredwan8297 most likely social engineered him to run something as root which contained a payload that opened a hole in a firewall and made a clearnet connection home, if I had to guess

[@efflux89]

I’ll put my tinfoil hat on. I bet the government has compromised TailsOS from day 1 and they had to come up with a plausible explanation for how they obtained this evidence in order for it to hold up in court. The FBI did a similar thing with the Stingray. They explicitly ordered local law enforcement users to cite other evidence when applying for warrants and testifying in court. We only know this because the training materials were released by a department after a FOIA request.

[@TheCommunistRabbit]

Yeah something is fishy, maybe the glowies are trying to discourage people using tails os

[@David.5035]

Why did he run a file while internet was on? Thats against opsec 101 on tails... strange.

[@metaldude1085]

Can you do a whonix os for the ultra paranoid?

[@David.5035]

A beginners video tutorial would be good... using tails is tiresome having no more browser settings save. Sucks

[@denissorn]

it's usually the other way around. The higher the user base, the higher the ROI the bigger the target

[@glossyfpv1155]

The roi in this case would be the gov prosecuting people. They make good money off that.

[@ArkboiX]

thanks man! the intro reminded me to sudo dnf update, even though fedora didn't have any exploits

[@TheFrantic5]

Miles Prower been real quiet since this dropped.

[@Crusaderon]

Thx for this! If you are fighting against a state actor and have not done anything illegal, it is still advisable to protect yourself as much as possible, especially if you have obtained sensitive information legally!

[@JohnnyP414]

0:33 Props for actually reading this massive run on sentence out loud and pushing through to the end. We are getting this done it one take goddammit

[@zZzZzZzZz110]

lol'd at the USB tether idea. what an awesome invention

[@unfa00]

I can see a bazillion ways this would backfire. Nobody would use that in this way.

[@kylekyle4505]

You won’t avoid a persistent efi boot kit with any of these methods which is what threat actors will do if they really want to target you. They will use some cpu or efi exploit to bypass secure boot and make it so reinstalling or live os won’t even matter. Hell at this point they in theory could do microcode patches to your cpu and make it so it’s impossible to ever not be vulnerable or remove.

[@QuantumlyImmortal]

Excellent video. Probably the best one I've seen from your channel in a very long time.

[@kexec.]

seems virtualization is only way to be safe at this point

[@MentalOutlaw]

better for data isolation but not as good as an air gap.

[@kexec.]

​@@MentalOutlawtrue

[@ScibbieGames]

​@@MentalOutlaw we should just live in a log cabin

[@witchtheer]

@@MentalOutlaw didnt you make a video few years ago that hackers can steal your data with ram signals and something with sata cables XD

[@User-gm4gg]

@witchtheeralso heat signatures through thermal sensors on your cpu and I imagine even now cables

[@mikemaldanado6015]

tails does not run inside a vm - that is a big red flag. use whonix, it is a little more difficult to set up but has never been hacked ( yet - nothing is 100 percent ). whonix vm's can now be run within hidden volumes. The whonix developers are light years ahead of the tails ones and now that tails is merging with tor the nsa now has access to it.

[@answerman9933]

Use a live DVD on a laptop (with battery and internal storage removed) plugged into a wall socket. 🤔

[@BobBarkerHeretictoScientism]

I don't know anything about tech, nor do I know most of what is discussed here, but I'm still compelled to watch lol

[@TheCommunistRabbit]

Keep going man, and make sure you google what you don't understand, it's the fastest way to learn

[@haruki7134]

I was waiting for this man !!! Since they announced it in their website!!

[@autumnjeserich2689]

My favorite fed

[@TFSimple]

Windows doesn't have this problem.

[@croozerdog]

i think sitting around tethered to your laptop with a giant wifi antenna is bad reallife opsec lmao

[@CarnisChampion]

I am not that worried since mine is not connected to the internet and the work I do with it is kind of usb gapped. there is no data moving from outside to the device only data moving out from it using usb memory. but thanks for the news it is very good to know.

[@HAL-ol1lh]

Hardcore!

[@acehotgram1618]

I just googled buster why isn’t his face publicly available

[@mattv18930]

Wow! This is shocking!

[@GegoXaren]

Totem uses GStreamer. Probobly one of the most used media backends out there...

[@Rui_Siang_Lin_Pharaoh]

Radically Open Security are the MVP!

[@SpaceGuy101]

Did you change the title a few seconds after posting? :)

[@Bayharboursaladseller]

700K subs, dude I remember when you were like 1K. Nice!

[@LeagueBeer]

It glows

[@catyasna12]

Why

[@efflux89]

Because almost every time a service purports to be able anonymize you, it turns out the government was behind it outright or had it backdoored from day 1. Remember that secure phone Kenny talked about that was a favorite of drug dealers? Every single message was going to the alphabet boys because it was a sting operation.

[@TheCommunistRabbit]

GLOWIES 😭😭🦅🦅🦅🦅

[@thechadbuddha]

tactical shoelaces

[@BrainDamageIV]

TempleOS the all mighty

[@yizhizhu5154]

If you are physically caught with laptop, it is just over. The biggest vulnerability is you against a punch in the face and there is nothing you can do about it...

[@DizzyAndHigh]

Professionals use $5 wrenches

[@TakeApartLab]

But its better than nothing, itll slow down evidence gathering massively, as long as you use a secure password and the usb is unpluged they are not really getting anything out of it other than that it is and encrypted linux system. If they get it while the system is running then they just have full access to everything. This is how silk road got taken in iirc.

[@MsZiomallo]

And I've just burned a fresh Tails 6.10 DVD a couple of weeks ago... Glad to know it's now a coaster ¯\_(ツ)_/¯

[@ari-athbadminton0301]

re-writable dvd is the way to go.

[@thewhitefalcon8539]

​@ari-athbadminton0301 no

[@MsZiomallo]

@ari-athbadminton0301 I use DVD-R discs because they're immutable. If you want to use DVD-RW, you miss the point - just get a flashdrive if you want your medium to be rewritable...

[@sniper_in_bush]

i respect and use DVD's, but why do you chose them for a live OS?

[@thewhitefalcon8539]

@@sniper_in_bush they cannot be modified

[@GhostStrats]

Thank you for this!

[@1q3er5]

how does tails decide what app to use in their OS?? like why isn't it using vlc?

[@Mars-j9x]

Good question

[@kerduslegend2644]

Wow would you look at that. Its not even a year yet

[@Danglutas]

Another win for Whonix

[@sir3337]

FYI. Kenny your videos aren't being uploaded automatically to Odysee. I think you have to upload them manually now.

[@OrioMaldo]

2:10 wasn't it VLC?

[@a_nickname028]

no actually, it was gnome videos.

[@MinePossu]

Would be great to make a usb stick with a tilt switch.

[@ClaraEvans-r7h]

Thanks for the insights! Just a quick question: I have a safepal wallet with USDT, and I have the 12word phrase: ( proof inner hobby bounce blouse able donate virtual luggage cart morning ticket ). How can I send it to Binance?

[@Krish-K31_nErd]

Your Humor of Implementation of Gif/Memes in videos are perfect 😅.

[@robtihanyi1155]

Great job bloke...love your work.

[@AurélienDORE]

Hi Unrelated to the video but I noticed that your Odysee channel has not been updated in a month Is it voluntary ?

[@HAL-ol1lh]

Of course. he's a fed .

[@OldQueer]

Feeling like Mr Burns in that alien episode rn

[@ArkenGAMES]

At this point you can only use web apps instead of actual apps if you want to be secure. Crazy...

[@Ultrajamz]

Glow’d

[@lawrencemueller778]

new opsec bible vid?

[@jamesm5192]

Is burning a new flash drive every time these non-installed distros need an update what everyone does? I guess we should just write a script so that every time our TailOS / liveOS USB flash drive docks in our computer it gets all of the images updated automatically?

[@blacklodgegames7351]

Ventoy. Just copy the ISO to the flash drive and you're done.

[@jamesm5192]

@@blacklodgegames7351 Of course, been using ventoy for years. But you still gotta keep each image on there up-to-date... I guess writing an "upgrade when docked" script is the way where it checks each image you have on your ventoy partition and downloads and copies, etc.

[@jamesm5192]

​@@blacklodgegames7351Of course, been using ventoy for years. But you still gotta keep each image on there up-to-date... I guess writing an "upgrade when docked" script is the way where it checks each image you have on your ventoy partition and downloads and copies, etc.

[@Aranimda]

Doesn't all software have critical security bugs?

[@pianokeyjoe]

read only memory way of doing things is the better way like an AmigaOS machine that uses a ROM chip for the OS and your data is only stored on removable media like the usb flash drives and cdrom discs,etc. If Tails is like MXlinux that can allow a full customized live session in ram booted from a read only disc then that would be the best scenario. But yes, if your lappy or tablet is yoinked from you while you are using tails or MXlinux live, you have more things to worry about than some software exploit for sure.. just sayin

[@lordbarron3352]

Lol, silly peasants. My encrypted yodeling and smoke signals upon the mountaintops haven't been broken yet!

[@CheekyBird790]

Salt Typhoon 🌀 🌀 enters the chat lol

[@xanaxity]

A pattern I've observed, higher the sevearity, lower the chances of exploiting the bug. (You need specific conditions)

[@cowingtonpost6837]

Whonix would have prevented against this exploit as even in the case of full compromise of the Whonix-Workstation, the real IP cannot be found.

[@IT10T]

I see he is making the satire more apparent now

[@seventhtenth]

can I hear more about the persistent tailsOS bad usb hijack? or is it like the totem flaw? wion know but finna get it, classic glowly posty ty mane

[@luszczi]

It's ok. I'm invulnerable to this exploit, because I never update. :D

[@Andoxico]

That just means you're vulnerable to all the exploits that target old software

[@Im_Awsum]

Have you seen the video?

[@stevea1708]

How does one even get to that level of techieness

[@TheCommunistRabbit]

Keep consuming content, and google anything you don't understand. These days chatgpt is also good because you can ask it all the stupid questions without consequences

[@Alex-x6q5b]

Just don't mess with it!

[@patrikkula7117]

How about monthly reinstall of Tails? Would that help?

[@chrisalex82]

noway TailsOS ??? How

[@kairysisKrantas]

You have to be really important to get busted on Tails. So I think we are good.

[@answerman9933]

Looks like Plan 9 from Bell Labs for me.

[@haruki7134]

Help! So what's better than tails? And what if i don't have a public wifi network near me?

[@markuslanggeng]

another win for temple os

[@arshadcheng]

Gonna reinstall later to a later version

[@hydra3468]

Hey Kenny, how come you're no longer uploading on Odysee?

[@haruki7134]

So what's better than tails? And what if i don't have a public wifi network near me?

Important video Kenny 👌

[@Shocker99]

You really do like that Monero

[@shodanxx]

Step 1 opsec, abolish the state.

[@mileineles]

Based