Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

NordVPN confirms it was hacked

techcrunch.com

Post reply on HN
Print view View original

271–280 of 666 posts

Re: NordVPN confirms it was hacked

#271

Post by jorvi »

protonmail wrote: post #168
jorvi wrote: post #99

Earlier quoted context omitted.

I mean this[1] is pretty convincing and not directly from the accused company's blog. The only thing it gets wrong is framing ProtonVPN Lithuania as the main ProtonVPN company instead of as a subsidiary. Regardless of that, there is so much mud being slung I recommend anyone to just search for 'protonvpn nordvpn tesonet', read a few articles on the topic and form your own opinion. Like I said, you can decide if you w…

There's a couple ways to look at this. On one hand, there's anonymous websites, competing VPN companies, and hundreds of Twitter bots pushing a story that is demonstratively false (just check public records). Then, on the other hand, you have Mozilla and the EU (which has access to all European corporate records) vouching for Proton, which also operates in a highly transparent way, examples here: https://protonvpn.co…

> On one hand, there's anonymous websites, competing VPN companies, and hundreds of Twitter bots pushing a story that is demonstratively false (just check public records).

I agree, the VPN industry is rife with shady business practices. But the story being pushed isn't 'demonstratively false'.

* TesoNet offers data mining services

* You did contract TesoNet employees

* Due to an error and unyielding policies by Google TesoNet holds your Android app signing keys in name

* There is a lot of intermingling between TesoNet and NordVPN and to a lesser extent TesoNet and ProtonVPN.

Like I already stated, it's very unlikely you are compromised. But unlike, say, a billing company that handles my energy or water provider (where I care much less if they have tenuous links to data mining) my standard is extremely high for a VPN. Internet traffic is supremely personal and for me to trust a company handling that there cannot even be the slightest sheen of misconduct.

For me to trust you you would have to completely cut out your Lithuanian subsidiary and any employees, board members, etc. that were or are related to TesoNet, as well as any reliance on their infrastructure. Obviously businesses don't operate with such 'scorched earth' policies and I don't expect you to gut your company based on a HN comment, but it is what it would take for me and many other privacy-conscious individuals to regain our trust.

Re: NordVPN confirms it was hacked

#272

Post by numlock86 »

Maybe they should spend more money on security than throw at people like PewDiePie to advertise them ... by also giving false claims like protecting you from hackers and making you magically "secure", whatever that's supposed to mean. Doesn't give the impression they know what a VPN actually is. Considering that most likely the phrasing comes from NordVPN themselves I always questioned them as a whole. Good to have some positive feedback (from my point of view) on that now.

Re: NordVPN confirms it was hacked

#273

Post by ryanlol »

CiPHPerCoder wrote: post #110
LennyWhiteJr wrote: post #108

> The attacker gained access to the server — which had been active for about a month — by exploiting an insecure remote management system left by the datacenter provider, which NordVPN said it was unaware that such a system existed. This screams for clarification and I'd love for someone more knowledgeable in the area to elaborate on it. Is this common practice for data-center providers? Do I now not only have to wor…

Sounds like an iDRAC exploit (assuming Dell servers). But, yes, remote management is pretty common in datacenters. The fact that NordVPN wasn't aware of them just shows incompetence.

I’d guess that the DC got owned, no need for iDRAC exploits when lazy VPN company staff never changed the pws.

Re: NordVPN confirms it was hacked

#275

Post by apecat »

dehrmann wrote: post #248
apecat wrote: post #230

Earlier quoted context omitted.

I find NordVPN's marketing reprehensible. Too many claims and broad strokes about the "anonymity" their service can provide. While I certainly would recommend that US consumers use a VPN router to prevent their ISP from selling data, I think NordVPN really overplays the role of changing IP addresses in the age of browser fingerprinting.

> I certainly would recommend that US consumers use a VPN router to prevent their ISP from selling data I wouldn't. Much of the web is moving over to https, VPNs are hit-or-miss on whether they route DNS requests, and having to deal with blocked websites because of abuse isn't worth it. That, and you're trusting the VPN to not sell your data. > browser fingerprinting I mean...your IP address changes on cell networks…

> Much of the web is moving over to https

Yes, but US consumer ISPs, to the best of my understanding, still have this nasty habit of tracking and injecting code whenever they feel like it. HTTP is still a thing.

Also, if the point is to avoid an ISP snooping on metadata for profiling, HTTPS adoption is good, because it encrypts real session data, but it does not stop data collection.

Remember that DNS goes in the clear, until browser and OS vendors decide to turn on DNS over HTTPS by default on consumer devices. The ISP industry, being assholes, have already started to make DoH appear somehow controversial, and they're probably going after google on antitrust grounds. [1] [2]

But even with DoH, we're still going to be stuck with SNI, which spells out the target domain of every HTTPS connection in the connection metadata. And whenever encrypted SNI is in place, services on the internet that aren't behind a CDN are still going to have identifiable IP addresses.

That's user data perfect for profiling and reselling.

So, to really give ISPs the finger, the user must use a VPN.

> VPNs are hit-or-miss on whether they route DNS requests

Major consumer VPNs, even clowns like NordVPN, have gotten pretty good at ensuring sane confs in their provided clients. I wouldn't rely on their kill switches etc for serious opsec, but it's enough to give the finger to an ISP.

On the other hand, the point of a VPN router is precisely to have everything go over a tunnel, including DNS.

It's not ideal to tunnel everything, but it's up to US consumers to make that choice. My suggestion would be to campaign to drive up VPN use on consumer broadband connections, just to fuck with the ISPs.

> That, and you're trusting the VPN to not sell your data.

This is an important point, and also why one would choose a VPN that relies on a reputation of not selling data.

> Browser fingerprinting is still an arms race, but if you're actually concerned about something, either do whatever Torbrowser does or use the most popular iPhone.

Yes, it's an arms race, and the point is to make life as hard as possible for the tracking industry. Nothing is perfect.

Tracking cookies don't go anywhere in a convenient to use browser setup, despite the shoddy claims from clowncar VPN companies.

While Tor is great, it's slow and not advisable as a daily driver browser connected to the user's normal online identities. For most users, sane use of Tor Browser would be special purposes, like researching medical concerns you don't want tracking companies to connect to you, and similar.

1 - https://arstechnica.com/tech-policy/2019/09/isps-worry-a-new...

2 - https://crsreports.congress.gov/product/pdf/IN/IN11182

Re: NordVPN confirms it was hacked

#276

Post by slantedview »

vianneychevalie wrote: post #228
tyfon wrote: post #209

Earlier quoted context omitted.

> I wonder when that sort of thing will become a criminal offence. If they have EU customers then article 33 of GDPR should see to that. "In the case of a personal data breach, the controller shall without undue delay and, where feasible, not later than 72 hours after having become aware of it, notify the personal data breach to the supervisory authority competent in accordance with Article 55, unless the personal da…

They could argue that they don't have proof that the exposed private key led to a personal data breach.

Exposing a private key is basically a breach.

Re: NordVPN confirms it was hacked

#277

Post by tmikaeld »

pm7 wrote: post #188
tmikaeld wrote: post #93

Earlier quoted context omitted.

For dedicated servers this would work, especially for VPN where data-loss is "acceptable". But if it where based on containers like LXC or OpenVZ, then the host can force root access via a command without even changing the root password of the container.

I doubt serious VPN provider are using LXC/OpenVZ containers. They don't even work with OpenVPN without special setup from provider, I don't know how about other protocols.

Both LXC and OpenVZ can run VPN services with just setting a couple of flags, I've done it on both.

Re: NordVPN confirms it was hacked

#278

Post by nonconvergent »

dehrmann wrote: post #248
apecat wrote: post #230

Earlier quoted context omitted.

I find NordVPN's marketing reprehensible. Too many claims and broad strokes about the "anonymity" their service can provide. While I certainly would recommend that US consumers use a VPN router to prevent their ISP from selling data, I think NordVPN really overplays the role of changing IP addresses in the age of browser fingerprinting.

> I certainly would recommend that US consumers use a VPN router to prevent their ISP from selling data I wouldn't. Much of the web is moving over to https, VPNs are hit-or-miss on whether they route DNS requests, and having to deal with blocked websites because of abuse isn't worth it. That, and you're trusting the VPN to not sell your data. > browser fingerprinting I mean...your IP address changes on cell networks…

A VPN isn't itself secure. It's only a secure tunnel. If the VPN's exit is insecure, then you're insecure. DNS-Over-HTTPS hasn't reached ubiquity yet but VPNs are very useful but are having a reckoning with serverside attacks and governments demanding "oversight" and backdoors (like the recent move by China on foreign owned but China-located companies VPN usage).

Re: NordVPN confirms it was hacked

#279

Post by concordDance »

orbital-decay wrote: post #265
danShumway wrote: post #214

Earlier quoted context omitted.

> Your IP address is a largely irrelevant metric in modern tracking systems. I don't believe this for one second. Your IP address on its own is not sufficient to identify you. That doesn't mean your IP address is not helpful in identifying you. If you have Javascript disabled, it is a heck of a lot easier to identify you with a combination of an IP address, user agent, and OS than it is to identify you without the IP…

If you have Javascript disabled, it is a heck of a lot easier to identify you because you're one of the very few who disabled Javascript.

Are there really so few of us? It feels like there should be millions of us: https://addons.mozilla.org/en-GB/firefox/addon/noscript/

Re: NordVPN confirms it was hacked

#280

Post by weinzierl »

Apart from deanonymizing customers and potentially reading the traffic of customers they sent over the VPN what are other risks for customers?

What I'm thinking about is that the VPN essentially tunnels through my firewall so a malicious VPN provider may possibly be able to do things that, for example, an arbitrary web server cannot.

Post reply on HN