171–180 of 666 posts
Earlier quoted context omitted.
Sounds like an iDRAC exploit (assuming Dell servers). But, yes, remote management is pretty common in datacenters. The fact that NordVPN wasn't aware of them just shows incompetence.
How the hell do you pwn a server with iDRAC?
I don't understand the obsession with VPN providers. Funneling all your Internet access through a single entity no matter where you connect from just seems like a fundamentally bad idea to me, especially if that entity's business is getting people to funnel all their traffic through, making them a juicy target for governments or hackers.
Well, you're funneling your traffic through a single entity in almost all cases , right? So I view it more as, who do I distrust more? My ISP or a VPN? I don't use a VPN provider, but it's tempting as I don't trust my ISP at all.
As a cherry on top, they were also the ones that successfully lobbied the government to allow that in the first place [2].
[1] https://www.privateinternetaccess.com/blog/2017/03/house-rep... [2] https://www.privateinternetaccess.com/blog/2017/02/internet-...
>NordVPN said it found out about the breach a “few months ago,” but the spokesperson said the breach was not disclosed until today because the company wanted to be “100% sure that each component within our infrastructure is secure.” So instead of allowing their customers to do their own damage limitation, they left their customers in the dark and continued to expose them to a breach they weren't sure they had fully c…
(edit: And, in fact, this is confirmed by NordVPN's statements on the matter: "The expired TLS key was taken at the same time the datacenter was exploited. However, the key couldn’t possibly have been used to decrypt the VPN traffic of any other server. On the same note, the only possible way to abuse website traffic was by performing a personalized and complicated MiTM attack to intercept a single connection that tried to access nordvpn.com.")
It's odd that NordVPN, VikingVPN and Torguard all got their private keys leaked here. - Did the hackers use an SSH or a VPN service vulnerability? - Or maybe even a previously unknown vulnerability? - Was SSH access firewalled? If not, why? - Do they still have root access?
This is always topical: Don't use VPN Services https://gist.github.com/joepie91/5a9909939e6ce7d09e29
Should be ok, after all they dont keep any logs right ?
Earlier quoted context omitted.
Sounds like an iDRAC exploit (assuming Dell servers). But, yes, remote management is pretty common in datacenters. The fact that NordVPN wasn't aware of them just shows incompetence.
How the hell do you pwn a server with iDRAC?
In secure environments one pulls IPMI module from the server or only uses the modules that have their own dedicated NICs that have to be wired to their own management network.
Earlier quoted context omitted.
Sounds like an iDRAC exploit (assuming Dell servers). But, yes, remote management is pretty common in datacenters. The fact that NordVPN wasn't aware of them just shows incompetence.
How the hell do you pwn a server with iDRAC?