NordVPN confirms it was hacked • Hacker News Board

Re: NordVPN confirms it was hacked

#141

Post by rocqua » Mon, Oct 21, 2019, 3:07 PM UTC

readhn wrote: post #125

SimeVidas wrote: post #104

The best thing NordVPN can do right now is make a statement that clearly and honestly describes how its users are affected. No bullshit marketing language, no trying to hide facts, just a short and simple explanation of what this means for users and what they should do next.

Truth is - if hackers did a MIM attack and collected a bunch user traffic (for how long?) they could have everything.. banking info, emails, logins... at this point if i was a user of that VPN service - i'd be replacing all of my sensitive passwords, secret questions/answers to key accounts.

MitM-ing a VPN does not break HTTPS. Hence, any passwords send over HTTPS are still safe. You could speculate that a VPN MitM is a nice way to get an MitM position for a further attack on TLS. But that requires a lot more speculation.

What isn't safe is your browsing history. True, any HTTP data isn't safe, but trusting that to be safe is baaaaad anyway.

In short. This leaked browser behavior, and could be a single step in getting a MitM possition on users.

Re: NordVPN confirms it was hacked

#142

Post by rsync » Mon, Oct 21, 2019, 3:07 PM UTC

_-___________-_ wrote: post #34

I don't understand the obsession with VPN providers. Funneling all your Internet access through a single entity no matter where you connect from just seems like a fundamentally bad idea to me, especially if that entity's business is getting people to funnel all their traffic through, making them a juicy target for governments or hackers.

"I don't understand the obsession with VPN providers. Funneling all your Internet access through a single entity no matter where you connect from just seems like a fundamentally bad idea to me, especially if that entity's business is getting people to funnel all their traffic through, making them a juicy target for governments or hackers."

Agreed - especially when it is so very, very cheap and easy to fire up a handful of VMs - around the world - and run your endpoints any way you like.

By far my preferred technology is 'sshuttle'[1] which allows you to use any host, anywhere, running ssh as a VPN endpoint. That cuts the setup time for your VMs down to almost zero.

[1] https://github.com/sshuttle

Re: NordVPN confirms it was hacked

#143

Post by wswope » Mon, Oct 21, 2019, 3:07 PM UTC

arshbot wrote: post #106

esnard wrote: post #78

Earlier quoted context omitted.

They were leaked on March 2018 [0][1], and they expired on October 2018 [2]. [0] https://web.archive.org/web/20180504001844/https://8ch.net/b... [1] https://nordvpn.com/fr/blog/official-response-datacenter-bre... [2] https://crt.sh/?id=10031443

> However, the key couldn’t possibly have been used to decrypt the VPN traffic of any other server. On the same note, the only possible way to abuse website traffic was by performing a personalized and complicated MiTM attack to intercept a single connection that tried to access nordvpn.com. However crt.sh shows > Validity > Not Before: Oct 6 12:53:38 2015 GMT > Not After : Oct 6 12:53:38 2018 GMT What exactly were t…

Nord has a couple thousand severs, and each has their own key. In order to decrypt traffic, you'd have to intercept some traffic to decrypt, which would require a MitM attack unless you're an ISP/state actor.

Re: NordVPN confirms it was hacked

#144

Post by SlowRobotAhead » Mon, Oct 21, 2019, 3:07 PM UTC

Liquix wrote: post #29

Nord (and perhaps others) seem to have been compromised for months/years - lifetime accounts have been available on the DN for significantly cheaper than other VPNs: https://news.ycombinator.com/item?id=20094946 Doesn't seem like a smear - glad this is coming to light.

Nord specifically has a retailer system, I wonder if accounts can be created 3rd party and sold greymarket like that without any nefarious hacking scandals?

Re: NordVPN confirms it was hacked

#145

Post by [deleted] » Mon, Oct 21, 2019, 3:07 PM UTC

readhn wrote: post #125

SimeVidas wrote: post #104

The best thing NordVPN can do right now is make a statement that clearly and honestly describes how its users are affected. No bullshit marketing language, no trying to hide facts, just a short and simple explanation of what this means for users and what they should do next.

Truth is - if hackers did a MIM attack and collected a bunch user traffic (for how long?) they could have everything.. banking info, emails, logins... at this point if i was a user of that VPN service - i'd be replacing all of my sensitive passwords, secret questions/answers to key accounts.

[deleted]

Re: NordVPN confirms it was hacked

#146

Post by chickenpotpie » Mon, Oct 21, 2019, 3:07 PM UTC

KirinDave wrote: post #139

chickenpotpie wrote: post #123

This is so well timed, I just bought a 3-year subscription to NordVPN and they have a 30 day refund policy.

You should probably ask for a refund, then set up your own VPN. Commerical VPNs are, for the vast majority of cases, simply not a good bet for your privacy. You're changing your network traffic path from a diffuse and byzantine series of paths to once centralized collection point. The payoff for an attack on a VPN rises very quickly. Meanwhile, you're also conditioning yourself to say, "My traffic is secure while my…

I thinking about spinning up a Digital Ocean droplet and rolling my own right now

Re: NordVPN confirms it was hacked

#147

Post by KirinDave » Mon, Oct 21, 2019, 3:08 PM UTC

some_furry wrote: post #120

If you're reading this and wondering which VPN service you should use to stay safe, start reading here: https://faq.dhol.es/@Soatok/cryptography/which-vpn-service-w... (Spoiler: You're asking yourself the wrong question.)

You shouldn't have buried the lede.You should have just said, "Here is a link on why commercial VPNs are a honeypot and bad privacy."

Re: NordVPN confirms it was hacked

#148

Post by protonmail » Mon, Oct 21, 2019, 3:08 PM UTC

SlowRobotAhead wrote: post #130

protonmail wrote: post #76

Earlier quoted context omitted.

This has been thoroughly debunked, most recently by Mozilla and the European Commission as part of their due diligence. ProtonVPN is 100% owned by the company behind ProtonMail, which in turn is funded by the European Union, so this has been verified by the European Commission. Details here: https://bit.ly/35RDKzB

> ProtonMail, which in turn is funded by the European Union Wait... that doesn’t sound ideal either.

There are pros and cons to this, we think it's positive (aligns the EU with privacy), but we provided all the details in the below link so people can draw their own conclusions: https://protonmail.com/blog/eu-funding/

Re: NordVPN confirms it was hacked

#149

Post by yk » Mon, Oct 21, 2019, 3:08 PM UTC

lkbm wrote: post #25

Sir_Cmpwn wrote: post #17

Earlier quoted context omitted.

My layman explanation is: You have to take your choice of VPN seriously. When you use a VPN, they can read all of your internet traffic, so choose a company you can trust with that information. If they screw up, like NordVPN did, then anyone can read all of your internet traffic even when you think you're safe. You're often better off without a VPN than with one.

This seems like an overstatement. Five years ago, mostly true, but can they mitm my ssl connections? (I'm getting mixed answers on StackExchange, but it seems like generally no.) They can see what sites I visit, but for most of those sites, they still shouldn't be able to see the content. (This might be more nuanced than the layman explanation needs to be. Just curious for my own sake.)

Depends, if they have a root (or a wildcard) certificate, they can show you that, and your browser will happily show you a green lock. However, the list of root CAs in your browser is public, for Firefox see [0], and hopefully someone would notice if a VPN provider has access to such an certificate.

(However, that is something that also applies to ISPs, at least Telekom has a CA and therefore a root certificate.)

[0] https://www.mozilla.org/en-US/about/governance/policies/secu...

Re: NordVPN confirms it was hacked

#150

Post by morpheuskafka » Mon, Oct 21, 2019, 3:09 PM UTC

readhn wrote: post #125

SimeVidas wrote: post #104

The best thing NordVPN can do right now is make a statement that clearly and honestly describes how its users are affected. No bullshit marketing language, no trying to hide facts, just a short and simple explanation of what this means for users and what they should do next.

Truth is - if hackers did a MIM attack and collected a bunch user traffic (for how long?) they could have everything.. banking info, emails, logins... at this point if i was a user of that VPN service - i'd be replacing all of my sensitive passwords, secret questions/answers to key accounts.

Only to the existent that any other ISP already could.

Banking info, email, etc would all be protected by encryption in transit (HTTPS or TLS), so an MItM attack shouldn't affect them. The attacker would only know what hosts you were communicating with, any unencrypted headers (ex. TLS SNI), but not the actual data itself.