Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

NordVPN confirms it was hacked

techcrunch.com

Post reply on HN
Print view View original

651–660 of 666 posts

Re: NordVPN confirms it was hacked

#651

Post by soulofmischief »

protonmail wrote: post #639
class4behavior wrote: post #637

Earlier quoted context omitted.

No third party signed their certificates. Just a contracted employee who worked for Tesonet typed in his company name instead of ProtonVPN. That's just the Android keystore, nothing else. Google supports keystore rotation only starting with Android 9.

It's actually not even a contracted employee actually. It was a Proton employee who in 2016 was getting payroll through another company before we had our own corporate entity. Keystore rotation is still not yet available yet in Android, so the old key (which we solely control) can't be changed or modified. Android actually also hashes with the certificate metadata so even that can't be edited separately.

On principle I am not impressed with what happened and I think it's very sloppy. After the Lavabit fiasco we have to be extra scrutinuous about the leadership in privacy-oriented companies. That said, I still have a few accounts with Protonmail and I think the service itself is pretty good.

Re: NordVPN confirms it was hacked

#652

Post by abbadadda »

Did NordVPN know about this hack when they were offering their deal for something like $88 for 3 years? I went back and looked at their prices from 2017 and it was something like $69 to $83.99 billed annually (https://www.pcworld.com/article/3200777/nordvpn-vpn-review.h...). I've been a NordVPN customer for a while but have been thinking of switching due to some articles touching on nefarious marketing practices and/or questionable data practices. Then I see this deal for $88 for 3 years and it was tempting to re-up. Coincidentally, when the deal ran out the news broke several days later about the hack. I for one will be finding a new VPN provider, but I can't help to think they were trying to rope in as many existing customers as possible before news of the hack broke. Suspect at best.

Re: NordVPN confirms it was hacked

#653

Post by illuminati1911 »

LennyWhiteJr wrote: post #108

> The attacker gained access to the server — which had been active for about a month — by exploiting an insecure remote management system left by the datacenter provider, which NordVPN said it was unaware that such a system existed. This screams for clarification and I'd love for someone more knowledgeable in the area to elaborate on it. Is this common practice for data-center providers? Do I now not only have to wor…

It seems NordVPN fucked up themselves are are now trying to avoid responsibility: https://www.theregister.co.uk/2019/10/21/nordvpn_security_is...

""All servers we provide have the iLO or iDRAC remote access tool, and as a matter of fact this remote access tool has security problems from time to time, as almost all software in the world. We patched this tool as new firmware was released from HP or Dell.

"We have many clients, and some large VPN service providers among them, who take care of their security very strongly. They pay more attention to this than NordVPN, and ask us to put iLO or iDRAC remote-access tool inside private networks or shut down access to this tool until they need it. We bring [iLO or iDRAC] ports up when we get requests from clients, and shut them down when they are done using this tools. NordVPN seems it did not pay more attention to security by themselves, and somehow try to put this on our shoulders.""

Re: NordVPN confirms it was hacked

#654

Post by commoner »

dicknuckle wrote: post #601
commoner wrote: post #572

Earlier quoted context omitted.

Another option is Outline VPN, Jigsaw/Google's open source implementation of Shadowsocks: https://getoutline.org https://github.com/Jigsaw-Code/outline-client https://github.com/Jigsaw-Code/outline-server Shadowsocks is more resistant to censorship from adverse actors (such as the Great Firewall) than OpenVPN. Outline's user experience is the best I've seen among self-hosted VPN solutions, as it includes apps for bot…

It's an alternative for sure and has specific use cases, but calling Outline a VPN is disingenuous. It's just a Socks proxy with some obfuscation built in.

Shadowsocks handles all of the use cases of a VPN. When all of a device's internet traffic is routed through Shadowsocks, there is no functional difference to the user. This is the default behavior for all Outline clients (desktop and mobile).

Re: NordVPN confirms it was hacked

#655

Post by malux85 »

bildung wrote: post #213
malux85 wrote: post #185

Earlier quoted context omitted.

"Dont use VPN services" then at the bottom: So then, what? THIS TYPE OF VPN

Which is not a service, but a self-hosted open source solution.

Yeah much better, a server that the user will probably not be talented enough to secure and will forget to patch the OS, libraries or application itself. /s

Re: NordVPN confirms it was hacked

#656

Post by okal »

russiandriver wrote: post #324
malux85 wrote: post #185

Earlier quoted context omitted.

"Dont use VPN services" then at the bottom: So then, what? THIS TYPE OF VPN

Analogy: "Don't eat at restaurants if you want to control your food." "If you for some reason cannot do that, here is a way to set up a food truck"

Analogies are imperfect, but I think the intention was more like "If for some reason you cannot do that, here is a simple meal you can make in your own kitchen."

Re: NordVPN confirms it was hacked

#657

Post by privateSFacct »

protonmail wrote: post #611
privateSFacct wrote: post #598

Earlier quoted context omitted.

Their Google cert literally is "Tesonet" - how is this claim debunked - you can check it yourself.

There's actually a point by point write-up about this on Reddit: https://www.reddit.com/r/ProtonVPN/comments/8ww4h2/protonvpn... There's a historical, almost accidental connection dating back to the infamous November 2015 DDoS against Proton, but zero connection today, and certainly not in the way it has been portrayed by people seeking to attack Proton. Android certs are permanent and can never be changed so that is…

It's against almost all certificate standards for the certificate holder - Tesonet to allow an unrelated third party to use a certificate with their name on it. Or for a third party (proton) to use a certificate that has another companies name on it.

If you would like, I can pursue this issue further given what seems to be confirmation here of a certificate violation.

Re: NordVPN confirms it was hacked

#658

Post by chousuke »

CodesInChaos wrote: post #624
jessaustin wrote: post #615

Earlier quoted context omitted.

Yes, software that runs on the instance can learn instance metadata. No, that is not a problem. Running e.g. user-supplied scripts on the instance would be "pretty damn dumb", but no one is that dumb. Any widely distributed software that did something shady with instance metadata would get busted PDQ. Just like any widely distributed software that did something shady with e.g. root credentials, which is about the sam…

It's crappy design which bypasses important security mechanisms of the OS (lower privileged users) by allowing every application with network access to access such critical functionality. One sane approach would be passing this information to the OS through the hypervisor which then exposes it as a properly ACLed file system. This is like an author of a website vulnerable to CSRF (because it relies on IP for auth) bl…

You can use iptables to limit metadata access to certain users but that takes effort so no-one does it.

I guess a machine-local service that takes ownership of the metadata service and implements additional restrictions (such as limiting access keys to privileged users) might be doable.

Re: NordVPN confirms it was hacked

#659

Post by FDSGSG »

kadoban wrote: post #646
FDSGSG wrote: post #583

Earlier quoted context omitted.

If you just ignore random reboots, sure. But why would you?

I don't think that'd be necessary, couldn't you make changes and then wait for natural reboots?

You couldn't, not via console access anyway.

However, if the attacker gains RCE many IPMI implementations theoretically allow for DMA, but this is a significantly more complex attack to mount in practice with no public PoCs available.

Re: NordVPN confirms it was hacked

#660

Post by KirinDave »

darkwater wrote: post #247
KirinDave wrote: post #139

Earlier quoted context omitted.

You should probably ask for a refund, then set up your own VPN. Commerical VPNs are, for the vast majority of cases, simply not a good bet for your privacy. You're changing your network traffic path from a diffuse and byzantine series of paths to once centralized collection point. The payoff for an attack on a VPN rises very quickly. Meanwhile, you're also conditioning yourself to say, "My traffic is secure while my…

But how can a DIY VPN serve you if you want to, say, avoid geoblocked pages? usually with those VPN services you can choose where your exit node is. I don't feel like using a multi-region setup for this (well, now that i think of it using Terraform + Algo it could be neatly automated...)

Run a vpn instance in a different region? Lots of providers do this and it's fairly inexpensive for burst use.
Post reply on HN