Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

NordVPN confirms it was hacked

techcrunch.com

Post reply on HN
Print view View original

531–540 of 666 posts

Re: NordVPN confirms it was hacked

#531

Post by snazz »

errantspark wrote: post #529
justicz wrote: post #12

If you care less about the pseudo-anonymous-but-not-really shared-IP aspect of using a VPN, and care more about the this-lan-is-sketchy use case, I have had good experiences with Algo [0]. You can just paste in an API key and spin up your own VPN on something like DigitalOcean. And it uses WireGuard! [0] https://github.com/trailofbits/algo

The problem with this is that jumping out onto the net from a VPS-allocated IP causes all sorts of trouble for "normal" internet use. For example you won't be able to use Netflix doing something like this.

I can see why Netflix would try to block it, but I haven't run into any issues with it myself (OpenIKEd on OpenBSD on a $3.50/mo Vultr server as detailed here: https://www.snazz.xyz/how-to/2019/09/13/vpn.html). A lot of websites seem aggressive towards Tor users, but my VPS IP address was treated the same as my home, work, and LTE addresses. Are there any other documented cases I should be aware of?

Re: NordVPN confirms it was hacked

#532

Post by protonmail »

_8j50 wrote: post #520

ProtonVPN uses Nord servers infrastructure right? Were they affected?

No, that is not true. We run our own infrastructure for ProtonVPN and also own the hardware for our core servers: https://protonvpn.com/support/secure-core-vpn/ This can be verified by inspecting our VPN endpoints which are all public.

We have no connection with Nord or any other VPN. ProtonVPN is however owned and operated by ProtonMail, with some support from the European Union.

Re: NordVPN confirms it was hacked

#533

Post by snazz »

roter wrote: post #40
justicz wrote: post #12

If you care less about the pseudo-anonymous-but-not-really shared-IP aspect of using a VPN, and care more about the this-lan-is-sketchy use case, I have had good experiences with Algo [0]. You can just paste in an API key and spin up your own VPN on something like DigitalOcean. And it uses WireGuard! [0] https://github.com/trailofbits/algo

If you already have a DigitalOcean droplet up and running and you have ssh access, you can use sshuttle [0]. e.g. run this from the command line: sshuttle -r example.com 0/0 -x example.com --dns [0] https://github.com/sshuttle/sshuttle

OpenSSH also includes a SOCKS proxy which you can use with no additional software: https://ma.ttias.be/socks-proxy-linux-ssh-bypass-content-fil...

Whether it grants you any significant anonymity is debatable, but it works well for evading content filters and tunneling your traffic onto a more trustworthy network.

Re: NordVPN confirms it was hacked

#534

Post by _8j50 »

protonmail wrote: post #532
_8j50 wrote: post #520

ProtonVPN uses Nord servers infrastructure right? Were they affected?

No, that is not true. We run our own infrastructure for ProtonVPN and also own the hardware for our core servers: https://protonvpn.com/support/secure-core-vpn/ This can be verified by inspecting our VPN endpoints which are all public. We have no connection with Nord or any other VPN. ProtonVPN is however owned and operated by ProtonMail, with some support from the European Union.

Cheers, glad you cleared that up. I must have gotten bad info. Love all your services!

Re: NordVPN confirms it was hacked

#535

Post by protonmail »

_8j50 wrote: post #534
protonmail wrote: post #532

Earlier quoted context omitted.

No, that is not true. We run our own infrastructure for ProtonVPN and also own the hardware for our core servers: https://protonvpn.com/support/secure-core-vpn/ This can be verified by inspecting our VPN endpoints which are all public. We have no connection with Nord or any other VPN. ProtonVPN is however owned and operated by ProtonMail, with some support from the European Union.

Cheers, glad you cleared that up. I must have gotten bad info. Love all your services!

No worries. Transparency is important to us so we're always happy to answer questions.

Re: NordVPN confirms it was hacked

#536

Post by corford »

wool_gather wrote: post #91
_-___________-_ wrote: post #34

I don't understand the obsession with VPN providers. Funneling all your Internet access through a single entity no matter where you connect from just seems like a fundamentally bad idea to me, especially if that entity's business is getting people to funnel all their traffic through, making them a juicy target for governments or hackers.

I use one when I have to connect to a public access point, or really any network that's not owned by someone I know and trust. It's not a perfect privacy/security plan -- you're right that I can't completely trust the VPN provider either -- it's just better than the alternative.

Try Warp from Cloudflare. Does the same thing but easier to trust versus some outfit like NordVPN

Re: NordVPN confirms it was hacked

#537

Post by jessaustin »

djsumdog wrote: post #226
LennyWhiteJr wrote: post #108

> The attacker gained access to the server — which had been active for about a month — by exploiting an insecure remote management system left by the datacenter provider, which NordVPN said it was unaware that such a system existed. This screams for clarification and I'd love for someone more knowledgeable in the area to elaborate on it. Is this common practice for data-center providers? Do I now not only have to wor…

Yes, network KVMs are expected of any co-location center. You want to be able to access the console and the power switches of any real physical server without having to send someone out to the center, and is a common feature of most high end data centers. Even a lot of VM/cloud systems have some kind of virtual management console (Linode has their LISH system that lets you SSH in to console and Vultr/Digital Ocean ha…

.. AWS surprisingly doesn't.

Why is this surprising? AWS seem to know what they're doing in general, and this is obviously the right policy in this particular area.

Re: NordVPN confirms it was hacked

#538

Post by [deleted] »

djsumdog wrote: post #226
LennyWhiteJr wrote: post #108

> The attacker gained access to the server — which had been active for about a month — by exploiting an insecure remote management system left by the datacenter provider, which NordVPN said it was unaware that such a system existed. This screams for clarification and I'd love for someone more knowledgeable in the area to elaborate on it. Is this common practice for data-center providers? Do I now not only have to wor…

Yes, network KVMs are expected of any co-location center. You want to be able to access the console and the power switches of any real physical server without having to send someone out to the center, and is a common feature of most high end data centers. Even a lot of VM/cloud systems have some kind of virtual management console (Linode has their LISH system that lets you SSH in to console and Vultr/Digital Ocean ha…

[deleted]

Re: NordVPN confirms it was hacked

#539

Post by WrtCdEvrydy »

_wldu wrote: post #221
CiPHPerCoder wrote: post #110

Earlier quoted context omitted.

Sounds like an iDRAC exploit (assuming Dell servers). But, yes, remote management is pretty common in datacenters. The fact that NordVPN wasn't aware of them just shows incompetence.

User root, password calvin. That's the default. And, if I had a dime for every time I've seen one of these in a data center, I'd be a rich man. I have literally begged sys admins to change the default password, but they say, "Why... we're behind a firewall using RFC 1918 addresses. No one can get to these." The rest, as they say, is history.

> we're behind a firewall

This is the dumbest thing I've ever seen... unless your firewall is between your host versus every other host and there's no multi-tenancy, this will suck.

Re: NordVPN confirms it was hacked

#540

Post by o-__-o »

yread wrote: post #217
StreamBright wrote: post #202

Earlier quoted context omitted.

>> Is this common practice for data-center providers? Absolutely. We had similar situation with one of the DC vendors.

So what can you do about it?

- Bring your own network and limit LOM/IPMI to a private network accessible by VPN only.

- Or, request a private network with no connectivity and a VPN device connected on that private network.

- Or, hardware disable LOM.

There's no reason you shouldn't request an ASA from your datacenter provider in this day and age.

Post reply on HN