NordVPN confirms it was hacked • Hacker News Board

Re: NordVPN confirms it was hacked

#211

Post by laumars » Mon, Oct 21, 2019, 3:33 PM UTC

RL_Quine wrote: post #112

LennyWhiteJr wrote: post #108

> The attacker gained access to the server — which had been active for about a month — by exploiting an insecure remote management system left by the datacenter provider, which NordVPN said it was unaware that such a system existed. This screams for clarification and I'd love for someone more knowledgeable in the area to elaborate on it. Is this common practice for data-center providers? Do I now not only have to wor…

They mean IPMI. All servers have IPMI and there’s remote root exploits against many versions of them.

> All servers have IPMI

Most (not all) servers have out-of-band management; of which IPMI is just one of many such solutions.

It's also worth noting that the hack could have been against in-band management if the Nord used an OS image provided by the DC hosts. However OOB feels more likely given their description (as vague as it was).

Re: NordVPN confirms it was hacked

#212

Post by SimeVidas » Mon, Oct 21, 2019, 3:33 PM UTC

SparkyMcUnicorn wrote: post #127

SimeVidas wrote: post #104

The best thing NordVPN can do right now is make a statement that clearly and honestly describes how its users are affected. No bullshit marketing language, no trying to hide facts, just a short and simple explanation of what this means for users and what they should do next.

They did already: https://nordvpn.com/blog/official-response-datacenter-breach...

Regular people who are NordVPN’s customers can’t possibly understand that. A highly technical explanation is not good enough. They need to put out a statement that explains clearly and concisely what this means for their users, something that all people can understand.

Re: NordVPN confirms it was hacked

#213

Post by bildung » Mon, Oct 21, 2019, 3:33 PM UTC

malux85 wrote: post #185

CiPHPerCoder wrote: post #105

This is always topical: Don't use VPN Services https://gist.github.com/joepie91/5a9909939e6ce7d09e29

"Dont use VPN services" then at the bottom: So then, what? THIS TYPE OF VPN

Which is not a service, but a self-hosted open source solution.

Re: NordVPN confirms it was hacked

#214

Post by danShumway » Mon, Oct 21, 2019, 3:33 PM UTC

CiPHPerCoder wrote: post #105

This is always topical: Don't use VPN Services https://gist.github.com/joepie91/5a9909939e6ce7d09e29

> Your IP address is a largely irrelevant metric in modern tracking systems.

I don't believe this for one second.

Your IP address on its own is not sufficient to identify you. That doesn't mean your IP address is not helpful in identifying you.

If you have Javascript disabled, it is a heck of a lot easier to identify you with a combination of an IP address, user agent, and OS than it is to identify you without the IP address cutting down the pool of potential visitors.

On top of that, if you're targeting me and do a geo-location of my IP address, it will get you within 5 miles of my house. That's close enough that you'll know which county I'm in, which with a few other easily-obtained pieces of information will let you pull up my voter registration, which will give you my exact street address.

Of course, you could mitigate this by setting up your own VPN on something like Linode, but unless you're regularly rotating IP addresses, you've just traded a pseudo-identifier that multiple people/devices share for a persistent identifier.

This argument comes up all the time, and I have never heard anyone explain it in a way that passes my sniff test. If you want me to stop using a VPN, you need to do a lot better than just claiming that IP addresses don't matter -- you need to show some kind of evidence to back that up.

Re: NordVPN confirms it was hacked

#215

Post by tejohnso » Mon, Oct 21, 2019, 3:33 PM UTC

some_furry wrote: post #120

If you're reading this and wondering which VPN service you should use to stay safe, start reading here: https://faq.dhol.es/@Soatok/cryptography/which-vpn-service-w... (Spoiler: You're asking yourself the wrong question.)

Why does the linked suggestion say "Don't use an Android phone, use an iPhone instead."

Re: NordVPN confirms it was hacked

#216

Post by luch » Mon, Oct 21, 2019, 3:34 PM UTC

LennyWhiteJr wrote: post #159

CiPHPerCoder wrote: post #110

Earlier quoted context omitted.

Sounds like an iDRAC exploit (assuming Dell servers). But, yes, remote management is pretty common in datacenters. The fact that NordVPN wasn't aware of them just shows incompetence.

How the hell do you pwn a server with iDRAC?

iDrac have a default password : https://danblee.com/dell-idrac-default-username-and-password...

There also quite a number of sysadmins that connect idrac's to the "regular" network, instead of the sysadmin VLAN ...

Re: NordVPN confirms it was hacked

#217

Post by yread » Mon, Oct 21, 2019, 3:34 PM UTC

StreamBright wrote: post #202

LennyWhiteJr wrote: post #108

> The attacker gained access to the server — which had been active for about a month — by exploiting an insecure remote management system left by the datacenter provider, which NordVPN said it was unaware that such a system existed. This screams for clarification and I'd love for someone more knowledgeable in the area to elaborate on it. Is this common practice for data-center providers? Do I now not only have to wor…

>> Is this common practice for data-center providers? Absolutely. We had similar situation with one of the DC vendors.

So what can you do about it?

Re: NordVPN confirms it was hacked

#218

Post by SimeVidas » Mon, Oct 21, 2019, 3:35 PM UTC

uniformlyrandom wrote: post #119

SimeVidas wrote: post #104

The best thing NordVPN can do right now is make a statement that clearly and honestly describes how its users are affected. No bullshit marketing language, no trying to hide facts, just a short and simple explanation of what this means for users and what they should do next.

Linked article says: > “The server itself did not contain any user activity logs; none of our applications send user-created credentials for authentication, so usernames and passwords couldn’t have been intercepted either,” said the spokesperson. “On the same note, the only possible way to abuse the website traffic was by performing a personalized and complicated man-in-the-middle attack to intercept a single connect…

If I were a NordVPN customer, these quotes would not give me confidence that my traffic wasn’t exposed.

Re: NordVPN confirms it was hacked

#219

Post by tyfon » Mon, Oct 21, 2019, 3:35 PM UTC

chickenpotpie wrote: post #123

This is so well timed, I just bought a 3-year subscription to NordVPN and they have a 30 day refund policy.

Prepare to have to deal with their "Customer success team", I had to email a few times back and forth before they actually closed and removed my account. There is/was no way to do this in the web interface itself. This was over a year ago though so I don't know if they still operate that way.

I got a few good laughs out of that signature :)

Re: NordVPN confirms it was hacked

#220

Post by zeta0134 » Mon, Oct 21, 2019, 3:36 PM UTC

LennyWhiteJr wrote: post #108

> The attacker gained access to the server — which had been active for about a month — by exploiting an insecure remote management system left by the datacenter provider, which NordVPN said it was unaware that such a system existed. This screams for clarification and I'd love for someone more knowledgeable in the area to elaborate on it. Is this common practice for data-center providers? Do I now not only have to wor…

I work for a web hosting company in the US and at least in our case, it's quite common for remote management to be enabled on pretty much all of our dedicated hardware. However, because of the inherent dangers in opening this up to the public internet, unless explicitly requested by the customer (or Managed Colocation), the NIC used for Dell iDRAC or HP iLO is on an isolated network unique to the physical datacenter. Remote access for our techs is managed through a secured bridge that requires all sorts of security hoops on our company intranet, and remote access for general internet traffic is not available due to the firewall restrictions. While it's plausible for remote access to be gained this way, it is extremely unlikely and would require several exploits at different points along the path.

I cannot speak for the industry as a whole, but remote management systems like this are bound to be common; any large enough physical datacenter is going to need a more efficient way to access a misbehaving system than sending a tech physically running to the box to plug in a keyboard and mouse. It should be extremely uncommon to have these management interfaces open to the public though, and I'll bet that's what NordVPN is surprised by. Generally these systems should be private and isolated due to the power that an attacker can wield through them.