Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

NordVPN confirms it was hacked

techcrunch.com

Post reply on HN
Print view View original

631–640 of 666 posts

Re: NordVPN confirms it was hacked

#631

Post by codezero »

protonmail wrote: post #627
codezero wrote: post #625

Earlier quoted context omitted.

Can you explain how Mozilla entering into a partnership is the same as vouching? Did they do any particular vetting or analysis, or was this just a marketing partnership?

You can read about what Mozilla did on their blog post about this: https://blog.mozilla.org/futurereleases/2018/10/22/testing-n... Quoting from the blog post: "We therefore set out to conduct a thorough evaluation of a long list of market-leading VPN services. Our team looked closely at a wide variety of factors, ranging from the design and implementation of each VPN service and its accompanying software, to the secu…

Thanks, that's what I was looking for!

Re: NordVPN confirms it was hacked

#632

Post by dclusin »

blaser-waffle wrote: post #618
dclusin wrote: post #566

Earlier quoted context omitted.

Which cheap data centers are you referring to? Curious as someone unfamiliar w/ the space.

Generally speaking, there are four (4) tiers of "public" data centers are on the market, ranging from essentially a big room with some alright AC and a line out, to huge, highly secure (cameras, fingerprint readers, SSAE certifications, etc.) buildings with redundant power and HVAC systems. The higher end ones are usually newer-ish, but there are lot of older "computer rooms" that offer acceptable-level benefits for…

My social network for dog walkers definitely needs 5 9's. Thank you for the insight.

Re: NordVPN confirms it was hacked

#633

Post by iscoelho »

LIV2 wrote: post #555
IshKebab wrote: post #465

Earlier quoted context omitted.

Why would they notice their server rebooting? And why would they not just assume it was a glitch or power failure?

When someone gets notified by their monitoring system that a server was unavailable (because it rebooted) they might investigate and see that the IPMI logs don't mention power loss Power failure would require both of the power feeds in the DC failing simultaneously and would be easily verified by contacting the DC and asking if they had any power outages reported at the time. Of course there are cheapskates who don't…

Servers can reboot for any reason. There are tons of kernel issues, especially since Meltdown & Spectre, that cause machine reboots in Linux especially on high traffic machines.

I've worked in production environments with thousands of machines and random reboots are a completely normal event for some workloads. Combination of hardware issues & kernel issues with hundreds of thousands of lines of code makes it inevitable. I would be surprised if NordVPN even noticed and their architecture wasn't designed to automatically start everything at boot.

You can't be perfect at scale - you just need to design your work loads to be redundant and fault tolerant.

Re: NordVPN confirms it was hacked

#634

Post by jessaustin »

CodesInChaos wrote: post #624
jessaustin wrote: post #615

Earlier quoted context omitted.

Yes, software that runs on the instance can learn instance metadata. No, that is not a problem. Running e.g. user-supplied scripts on the instance would be "pretty damn dumb", but no one is that dumb. Any widely distributed software that did something shady with instance metadata would get busted PDQ. Just like any widely distributed software that did something shady with e.g. root credentials, which is about the sam…

It's crappy design which bypasses important security mechanisms of the OS (lower privileged users) by allowing every application with network access to access such critical functionality. One sane approach would be passing this information to the OS through the hypervisor which then exposes it as a properly ACLed file system. This is like an author of a website vulnerable to CSRF (because it relies on IP for auth) bl…

Yes, in some situations it will take effort to not allow network access to untrusted software and/or users. For those situations, EC2 is not a good fit.

Re: NordVPN confirms it was hacked

#635

Post by Snawoot »

iscoelho wrote: post #629
Snawoot wrote: post #293

Earlier quoted context omitted.

Sorry for posting under top comment, but I think it is very important. Official response hides fact OpenVPN CA keys also leaked, so attacker could impersonate any other NordVPN server: https://gist.githubusercontent.com/Snawoot/85f77356e229d77aa... RADIUS secret key also leaked, so propably it is possible to break into EAP session which infers session secret key for StrongSwan.

Read up on "Perfect forward secrecy": https://en.wikipedia.org/wiki/Forward_secrecy Assuming their IPsec was enabled with it (and OpenVPN should be enabled by default), them leaking their keys does not matter. The sessions can not be decrypted even if the master key is leaked. TLS also has perfect forward secrecy by default. Impersonation is an issue, but the article stated the CA keys have already been rotated and a…

> Impersonation is an issue, but the article stated the CA keys have already been rotated and are out of date.

They were not rotated back then in 2018, so we can only guess if MITM had place. Their line of defence appealing to keys which are NOW outdated is just ridiculous.

> Read up on "Perfect forward secrecy": https://en.wikipedia.org/wiki/Forward_secrecy

> The sessions can not be decrypted even if the master key is leaked.

It's not true. PFS provides cryptographic isolation between long-term keys and session key used to encrypt data. Obviously, if MSK compromised it is irrevelant, how it was inferred: with PFS or not.

Re: NordVPN confirms it was hacked

#636

Post by glitter1 »

protonmail wrote: post #626
privateSFacct wrote: post #622

Earlier quoted context omitted.

For a company based in Switzerland to be "accidentally" connected to a company in another country they claim to have no connection to such that their permanent google cert lists the name of the company they are supposedly not connected with - that doesn't seem odd to you? That fact that this had to be slowly pried out with changing explanations along the way? When you say the claim that has been debunked - I expect t…

Given all that is going on with VPNs, your caution is warranted, but one should also critically examine the claims that are being made. Proton definitely has an office and subsidiary in Vilnius, it's not a secret because it's on our Instagram: https://www.instagram.com/p/BxMz62oHb6K/ The office is inside a 30 storey building, so it is not surprising the address is shared with quite a few other companies. That doesn't…

Protonvpn is avoided by people who care about their privacy worse than a STD.

Re: NordVPN confirms it was hacked

#637

Post by class4behavior »

soulofmischief wrote: post #597
class4behavior wrote: post #592

Earlier quoted context omitted.

Just search for proton in this thread. They've explained what happened themselves. Besides, the argumentation from that vpnscam website and its followers reminds you of the typical conspiracy retards that follow Trump.

In no world is it excusable to have your ostensible competitor sign your binaries or certificates. They can make all the excuses they want, but it doesn't dissolve their incompetence, and shows they are unfit for running such a user-critical business.

No third party signed their certificates. Just a contracted employee who worked for Tesonet typed in his company name instead of ProtonVPN. That's just the Android keystore, nothing else. Google supports keystore rotation only starting with Android 9.

Re: NordVPN confirms it was hacked

#638

Post by ty7yt »

nord vpn will sell out. i happen to know this for a fact. same as any other big company. think how many times facebook has said sorry over the past 10 years. just the same with vpn providers. your best bet is tor, and even then just use it for privacy reasons, not illegal ones.

Re: NordVPN confirms it was hacked

#639

Post by protonmail »

class4behavior wrote: post #637
soulofmischief wrote: post #597

Earlier quoted context omitted.

In no world is it excusable to have your ostensible competitor sign your binaries or certificates. They can make all the excuses they want, but it doesn't dissolve their incompetence, and shows they are unfit for running such a user-critical business.

No third party signed their certificates. Just a contracted employee who worked for Tesonet typed in his company name instead of ProtonVPN. That's just the Android keystore, nothing else. Google supports keystore rotation only starting with Android 9.

It's actually not even a contracted employee actually. It was a Proton employee who in 2016 was getting payroll through another company before we had our own corporate entity. Keystore rotation is still not yet available yet in Android, so the old key (which we solely control) can't be changed or modified. Android actually also hashes with the certificate metadata so even that can't be edited separately.

Re: NordVPN confirms it was hacked

#640

Post by blaser-waffle »

Snawoot wrote: post #349
chelmzy wrote: post #333

Earlier quoted context omitted.

What is the source of the gist you linked?

It is copy of snippet linked from 8ch.net: https://web.archive.org/web/20180504001844/https://8ch.net/b...

Hasn't that site been down for weeks now?
Post reply on HN