NordVPN confirms it was hacked • Hacker News Board

Re: NordVPN confirms it was hacked

#221

Post by _wldu » Mon, Oct 21, 2019, 3:37 PM UTC

CiPHPerCoder wrote: post #110

LennyWhiteJr wrote: post #108

> The attacker gained access to the server — which had been active for about a month — by exploiting an insecure remote management system left by the datacenter provider, which NordVPN said it was unaware that such a system existed. This screams for clarification and I'd love for someone more knowledgeable in the area to elaborate on it. Is this common practice for data-center providers? Do I now not only have to wor…

Sounds like an iDRAC exploit (assuming Dell servers). But, yes, remote management is pretty common in datacenters. The fact that NordVPN wasn't aware of them just shows incompetence.

User root, password calvin. That's the default. And, if I had a dime for every time I've seen one of these in a data center, I'd be a rich man. I have literally begged sys admins to change the default password, but they say, "Why... we're behind a firewall using RFC 1918 addresses. No one can get to these." The rest, as they say, is history.

Re: NordVPN confirms it was hacked

#222

Post by [deleted] » Mon, Oct 21, 2019, 3:38 PM UTC

fauigerzigerk wrote: post #137

>NordVPN said it found out about the breach a “few months ago,” but the spokesperson said the breach was not disclosed until today because the company wanted to be “100% sure that each component within our infrastructure is secure.” So instead of allowing their customers to do their own damage limitation, they left their customers in the dark and continued to expose them to a breach they weren't sure they had fully c…

[deleted]

Re: NordVPN confirms it was hacked

#223

Post by golergka » Mon, Oct 21, 2019, 3:40 PM UTC

CiPHPerCoder wrote: post #105

This is always topical: Don't use VPN Services https://gist.github.com/joepie91/5a9909939e6ce7d09e29

It absolutely ignores government's censorship, though. I use NordVPN simply because I want to access resources that would be otherwise banned for me.

Re: NordVPN confirms it was hacked

#224

Post by rasengan » Mon, Oct 21, 2019, 3:40 PM UTC

fauigerzigerk wrote: post #137

>NordVPN said it found out about the breach a “few months ago,” but the spokesperson said the breach was not disclosed until today because the company wanted to be “100% sure that each component within our infrastructure is secure.” So instead of allowing their customers to do their own damage limitation, they left their customers in the dark and continued to expose them to a breach they weren't sure they had fully c…

I think that is pretty criminal already.

Basically:

1- Nord falsely blames its server provider.

2- Nord hides it from their users.

3- Nord claims all will be well with an “audit” (again, since they were already “audited”)

This is either criminal negligence, “security theater”, or both.

Re: NordVPN confirms it was hacked

#225

Post by nvrspyx » Mon, Oct 21, 2019, 3:41 PM UTC

_-___________-_ wrote: post #190

bitxbitxbitcoin wrote: post #172

Earlier quoted context omitted.

One very explicit reason to not trust your ISP with your internet traffic is that since 2017 [1], they are allowed by Congress to sell your internet history. As a cherry on top, they were also the ones that successfully lobbied the government to allow that in the first place [2]. [1] https://www.privateinternetaccess.com/blog/2017/03/house-rep... [2] https://www.privateinternetaccess.com/blog/2017/02/internet-...

To be fair, they can't actually see more than hostnames & IP addresses (assuming the use of TLS, which is becoming ubiquitous), so implying that they sell your "Internet history" makes it sound worse than it is. I've always assumed VPN providers sell whatever data they can too.

I’m not a network expert, but doesn’t TLS just cover your connection with a specific website? Since your IPS is often also your DNS, can’t they still see which specific websites you’re trying to connect to? Wouldn’t TLS just obfuscate what you’re specifically sending to and receiving from that site? I’m under the impression that my ISP can (and probably does) see every website I visit, which is in the least browsing history.

I also remember that Comcast did (and might still do) inject code onto websites to display a “pop-up” indicating that you’re reaching or have reached your datacap. It would even pop up on Steam because most of Steam is really just a webview. I’m not sure exactly how they did/do that.

Again, I’m not a network or security expert, so I’m not really sure of how TLS protects your internet history, which I take to mean a list of websites you visit and when.

Re: NordVPN confirms it was hacked

#226

Post by djsumdog » Mon, Oct 21, 2019, 3:41 PM UTC

LennyWhiteJr wrote: post #108

> The attacker gained access to the server — which had been active for about a month — by exploiting an insecure remote management system left by the datacenter provider, which NordVPN said it was unaware that such a system existed. This screams for clarification and I'd love for someone more knowledgeable in the area to elaborate on it. Is this common practice for data-center providers? Do I now not only have to wor…

Yes, network KVMs are expected of any co-location center. You want to be able to access the console and the power switches of any real physical server without having to send someone out to the center, and is a common feature of most high end data centers.

Even a lot of VM/cloud systems have some kind of virtual management console (Linode has their LISH system that lets you SSH in to console and Vultr/Digital Ocean have similar web based consoles .. AWS surprisingly doesn't. You can get console output but can't send VMs any console input).

Not only should have NordVPN been aware of this hardware KVM, they should have secured it and had version checks on its firmware as an essential part of their security. I could see this oversight with other companies, but not with one whose primary business claims to be security.

Re: NordVPN confirms it was hacked

#227

Post by coldpie » Mon, Oct 21, 2019, 3:43 PM UTC

CiPHPerCoder wrote: post #105

This is always topical: Don't use VPN Services https://gist.github.com/joepie91/5a9909939e6ce7d09e29

More importantly, don't do anything private on a networked computer. As the daily breaches show, there is no such thing as computer security in 2019.

Re: NordVPN confirms it was hacked

#228

Post by vianneychevalie » Mon, Oct 21, 2019, 3:44 PM UTC

tyfon wrote: post #209

fauigerzigerk wrote: post #137

>NordVPN said it found out about the breach a “few months ago,” but the spokesperson said the breach was not disclosed until today because the company wanted to be “100% sure that each component within our infrastructure is secure.” So instead of allowing their customers to do their own damage limitation, they left their customers in the dark and continued to expose them to a breach they weren't sure they had fully c…

> I wonder when that sort of thing will become a criminal offence. If they have EU customers then article 33 of GDPR should see to that. "In the case of a personal data breach, the controller shall without undue delay and, where feasible, not later than 72 hours after having become aware of it, notify the personal data breach to the supervisory authority competent in accordance with Article 55, unless the personal da…

They could argue that they don't have proof that the exposed private key led to a personal data breach.

Re: NordVPN confirms it was hacked

#229

Post by protonimitate » Mon, Oct 21, 2019, 3:44 PM UTC

entropicdrifter wrote: post #174

fauigerzigerk wrote: post #137

>NordVPN said it found out about the breach a “few months ago,” but the spokesperson said the breach was not disclosed until today because the company wanted to be “100% sure that each component within our infrastructure is secure.” So instead of allowing their customers to do their own damage limitation, they left their customers in the dark and continued to expose them to a breach they weren't sure they had fully c…

Yeah, that sounds like flagrant incompetence

Calling it incompetence lets them off the hook I think. This was a deliberate choice to keep customers in the dark, which is worse IMO.

Re: NordVPN confirms it was hacked

#230

Post by apecat » Mon, Oct 21, 2019, 3:45 PM UTC

FillardMillmore wrote: post #201

I can't help but notice that NordVPN is one of the most heavily advertised VPNs from what I've seen (which raises the question, as one researcher pointed out in the article - are they not spending enough money on their security and infrastructure to protect their users?). They are claiming that: "no-one could know about an undisclosed remote management system left by the [data center] provider". Apparently the hacker…

I find NordVPN's marketing reprehensible. Too many claims and broad strokes about the "anonymity" their service can provide.

While I certainly would recommend that US consumers use a VPN router to prevent their ISP from selling data, I think NordVPN really overplays the role of changing IP addresses in the age of browser fingerprinting.