Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

NordVPN confirms it was hacked

techcrunch.com

Post reply on HN
Print view View original

281–290 of 666 posts

Re: NordVPN confirms it was hacked

#281

Post by trigger89 »

"On the same note, the only possible way to abuse the website traffic was by performing a personalized and complicated man-in-the-middle attack to intercept a single connection that tried to access NordVPN."

If I had root, can't I just find out what crypto libraries are in use? and trigger an uprobe to decrypt the traffic on that crypto library ?

Every user connection handled by that vpn server would have been plain text for me.

I think they are downplaying the importance of this hack

Re: NordVPN confirms it was hacked

#282

Post by tmikaeld »

FDSGSG wrote: post #260
tmikaeld wrote: post #93

Earlier quoted context omitted.

For dedicated servers this would work, especially for VPN where data-loss is "acceptable". But if it where based on containers like LXC or OpenVZ, then the host can force root access via a command without even changing the root password of the container.

>For dedicated servers this would work, especially for VPN where data-loss is "acceptable". FWIW there's no need for data loss when you ditch the server, just download the encrypted data and decrypt using a clean environment elsewhere. >But if it where based on containers like LXC or OpenVZ, then the host can force root access via a command without even changing the root password of the container. You should never do…

I mean that encryption puts the entire data-store at risk, I've seen it happen more than twice due to RAM being faulty (In one incident it was using ECC RAM) and a power-failure.

Even the backups where corrupt due to being backed up in encrypted images. When encrypted volumes and images are corrupted by RAM or power-failure, they are locked forever.

Of course one should never force root access, I'm saying that you can't keep out the hosting from access the server in that case.

Re: NordVPN confirms it was hacked

#283

Post by jrockway »

BjoernKW wrote: post #242
CiPHPerCoder wrote: post #105

This is always topical: Don't use VPN Services https://gist.github.com/joepie91/5a9909939e6ce7d09e29

> You are on a known-hostile network Which is precisely the use case I use a VPN for. I'd rather trust an at least somewhat trustworthy VPN provider with my data than a random coffee shop and clients who happen to be on the same network at the time.

I feel like that's crazy. There should be no traffic entering or leaving your machine that's not end-to-end encrypted already. Trusting some fly-by-night VPN provider because they buy a lot of YouTube ads is no substitute for proper end-to-end session level encryption.

Re: NordVPN confirms it was hacked

#284

Post by gambler »

dehrmann wrote: post #248
apecat wrote: post #230

Earlier quoted context omitted.

I find NordVPN's marketing reprehensible. Too many claims and broad strokes about the "anonymity" their service can provide. While I certainly would recommend that US consumers use a VPN router to prevent their ISP from selling data, I think NordVPN really overplays the role of changing IP addresses in the age of browser fingerprinting.

> I certainly would recommend that US consumers use a VPN router to prevent their ISP from selling data I wouldn't. Much of the web is moving over to https, VPNs are hit-or-miss on whether they route DNS requests, and having to deal with blocked websites because of abuse isn't worth it. That, and you're trusting the VPN to not sell your data. > browser fingerprinting I mean...your IP address changes on cell networks…

HTTPs will not stop Google from logging your IP + activity on their services. I'm not convinced that ad-blockers are 100% effective in disabling trackers either. One of the appeals of VPNs is that you have multiple points of exit and they rotate.

Re: NordVPN confirms it was hacked

#285

Post by phamilton »

slantedview wrote: post #276
vianneychevalie wrote: post #228

Earlier quoted context omitted.

They could argue that they don't have proof that the exposed private key led to a personal data breach.

Exposing a private key is basically a breach.

"breach" usually has a legal definition, which varies by jurisdiction

Re: NordVPN confirms it was hacked

#286

Post by Snawoot »

uniformlyrandom wrote: post #119
SimeVidas wrote: post #104

The best thing NordVPN can do right now is make a statement that clearly and honestly describes how its users are affected. No bullshit marketing language, no trying to hide facts, just a short and simple explanation of what this means for users and what they should do next.

Linked article says: > “The server itself did not contain any user activity logs; none of our applications send user-created credentials for authentication, so usernames and passwords couldn’t have been intercepted either,” said the spokesperson. “On the same note, the only possible way to abuse the website traffic was by performing a personalized and complicated man-in-the-middle attack to intercept a single connect…

> According to the spokesperson, the expired private key could not have been used to decrypt the VPN traffic on any other server.

It's simply not true.

Their CA private key which is used to issue certificates for ALL servers also leaked along with RADIUS key which is used to secure EAP session [1].

They DO hide facts.

[1] https://gist.githubusercontent.com/Snawoot/85f77356e229d77aa...

Re: NordVPN confirms it was hacked

#287

Post by ahmedalsudani »

gambler wrote: post #284
dehrmann wrote: post #248

Earlier quoted context omitted.

> I certainly would recommend that US consumers use a VPN router to prevent their ISP from selling data I wouldn't. Much of the web is moving over to https, VPNs are hit-or-miss on whether they route DNS requests, and having to deal with blocked websites because of abuse isn't worth it. That, and you're trusting the VPN to not sell your data. > browser fingerprinting I mean...your IP address changes on cell networks…

HTTPs will not stop Google from logging your IP + activity on their services. I'm not convinced that ad-blockers are 100% effective in disabling trackers either. One of the appeals of VPNs is that you have multiple points of exit and they rotate.

Google can track you fairly effectively even if you’re behind a VPN. I’m not sure if they choose to at this time, but if a significant population switches to hiding behind VPNs, they will turn on the finer fingerprinting means.

Re: NordVPN confirms it was hacked

#288

Post by danShumway »

orbital-decay wrote: post #265
danShumway wrote: post #214

Earlier quoted context omitted.

> Your IP address is a largely irrelevant metric in modern tracking systems. I don't believe this for one second. Your IP address on its own is not sufficient to identify you. That doesn't mean your IP address is not helpful in identifying you. If you have Javascript disabled, it is a heck of a lot easier to identify you with a combination of an IP address, user agent, and OS than it is to identify you without the IP…

If you have Javascript disabled, it is a heck of a lot easier to identify you because you're one of the very few who disabled Javascript.

Eh. If you're enabling JS because you think it's going to help you blend into the crowd, I am skeptical that you understand how powerful JS fingerprinting actually is, particularly around cache abuse and super-cookies.

You don't need to go all the way, but the very least I would advise turning on the resist-fingerprinting config in Firefox. At a minimum, block things like canvas/webGL. You're making yourself more identifiable by doing so, but the alternative is worse.

Now, if you're not using a VPN, and you're in a rural area, and you're on Linux/Firefox with Javascript disabled -- sure, I definitely buy that I could do some pretty decent correlation with that info. That's why VPNs (for all their flaws) still matter.

Re: NordVPN confirms it was hacked

#290

Post by Phillipharryt »

fauigerzigerk wrote: post #137

>NordVPN said it found out about the breach a “few months ago,” but the spokesperson said the breach was not disclosed until today because the company wanted to be “100% sure that each component within our infrastructure is secure.” So instead of allowing their customers to do their own damage limitation, they left their customers in the dark and continued to expose them to a breach they weren't sure they had fully c…

In Australia under the Consumer Data Right it would be an offence to wait before disclosing this. Unfortunately it doesn't cover all industries yet.
Post reply on HN