NordVPN confirms it was hacked • Hacker News Board

Re: NordVPN confirms it was hacked

#231

Post by tyfon » Mon, Oct 21, 2019, 3:45 PM UTC

vianneychevalie wrote: post #228

tyfon wrote: post #209

Earlier quoted context omitted.

> I wonder when that sort of thing will become a criminal offence. If they have EU customers then article 33 of GDPR should see to that. "In the case of a personal data breach, the controller shall without undue delay and, where feasible, not later than 72 hours after having become aware of it, notify the personal data breach to the supervisory authority competent in accordance with Article 55, unless the personal da…

They could argue that they don't have proof that the exposed private key led to a personal data breach.

Yeah, I think that's their only option actually.

Re: NordVPN confirms it was hacked

#232

Post by SparkyMcUnicorn » Mon, Oct 21, 2019, 3:46 PM UTC

SimeVidas wrote: post #212

SparkyMcUnicorn wrote: post #127

Earlier quoted context omitted.

They did already: https://nordvpn.com/blog/official-response-datacenter-breach...

Regular people who are NordVPN’s customers can’t possibly understand that. A highly technical explanation is not good enough. They need to put out a statement that explains clearly and concisely what this means for their users, something that all people can understand.

"To recap, in early 2018, one isolated datacenter in Finland was accessed without authorization. That was done by exploiting a vulnerability of one of our server providers that hadn’t been disclosed to us. No user credentials have been intercepted. No other server on our network has been affected. The affected server does not exist anymore and the contract with the server provider has been terminated."

Not sure what you're asking for? If someone doesn't understand that, then they probably aren't using a VPN.

Re: NordVPN confirms it was hacked

#233

Post by thenewnewguy » Mon, Oct 21, 2019, 3:46 PM UTC

lijogdfljk wrote: post #151

thenewnewguy wrote: post #132

Earlier quoted context omitted.

Buy a $5/month VPS and run your own VPN on that (popular setup script: https://github.com/StreisandEffect/streisand ). It'll cost you a little bit of time in setup and maintenance (mostly just upgrading packages), but it has many benefits: - Cheaper than most VPN providers - You won't be using a known VPN IP - VPN providers are more likely to snoop on your traffic or be targeted by snoopers (such as the government),…

But then your security rests on your ability to manage a server. I mostly agree with you, but, I don't run one because I'm not a seasoned Ops. At least, not enough that I want to put my security on the line. In all but the most hostile networks I trust another VPN or my ISP more than I trust my ability to keep a server secure. Thoughts?

It's not like you're running a website on there - all you have to keep secure is SSH and your VPN. Keeping up to date with security updates and using a strong password (or better yet, private key) is essentially all you need to do.

I wouldn't necessarily recommend it to random non-technical people, but I figure most HN users could figure it out.

Re: NordVPN confirms it was hacked

#234

Post by ceejayoz » Mon, Oct 21, 2019, 3:47 PM UTC

voxic11 wrote: post #96

ceejayoz wrote: post #92

Earlier quoted context omitted.

The browser (as should your email client) appears to have rejected those certs.

ok, so they have been rejected. Now what? I still would like to read my email... which is where VPN's come in handy.

If you're running your own VPN, fine.

If you're using something like NordVPN, you're just swapping one shady outfit for another. Worse, in many cases.

Might be better to just wait until you land.

Re: NordVPN confirms it was hacked

#235

Post by yread » Mon, Oct 21, 2019, 3:47 PM UTC

jen_h wrote: post #186

lijogdfljk wrote: post #151

Earlier quoted context omitted.

But then your security rests on your ability to manage a server. I mostly agree with you, but, I don't run one because I'm not a seasoned Ops. At least, not enough that I want to put my security on the line. In all but the most hostile networks I trust another VPN or my ISP more than I trust my ability to keep a server secure. Thoughts?

Some thoughts: 1. You have to keep two ports locked down. If you can secure your own laptop, you can secure a cloud instance. The cloud instance you're basically just using as a proxy is a lot less important than what's on your phone or computer. 2. Only you are using the system, and you're not logging. Have an issue? Tear it down and start another. Automated scripts out there generate unique keys every time. 3. A co…

> You have to keep two ports locked down

That's what NordVPN thought as well

Re: NordVPN confirms it was hacked

#236

Post by astine » Mon, Oct 21, 2019, 3:48 PM UTC

protonimitate wrote: post #229

entropicdrifter wrote: post #174

Earlier quoted context omitted.

Yeah, that sounds like flagrant incompetence

Calling it incompetence lets them off the hook I think. This was a deliberate choice to keep customers in the dark, which is worse IMO.

Yeah, the word for this is 'negligence'. Sounds like someone should get sued at the very least.

Re: NordVPN confirms it was hacked

#237

Post by sli » Mon, Oct 21, 2019, 3:49 PM UTC

golergka wrote: post #223

CiPHPerCoder wrote: post #105

This is always topical: Don't use VPN Services https://gist.github.com/joepie91/5a9909939e6ce7d09e29

It absolutely ignores government's censorship, though. I use NordVPN simply because I want to access resources that would be otherwise banned for me.

It also ignores that some VPN services have proven their no logging claims in court, multiple times.

Re: NordVPN confirms it was hacked

#238

Post by teslaberry » Mon, Oct 21, 2019, 3:49 PM UTC

What if nord vpn is a government operation? Why wouldnt it be?

Re: NordVPN confirms it was hacked

#239

Post by hannob » Mon, Oct 21, 2019, 3:49 PM UTC

saurik wrote: post #200

_-___________-_ wrote: post #63

Earlier quoted context omitted.

What exactly can they be doing with your data other than selling a list of which DNS queries you make and which IP addresses you connect to? (Which the VPN provider can also do.)

They can do active attacks on you, as most people don't actively attempt to ban and absolutely block unencrypted connections (and there are also sometimes attacks on SSL stacks anyway); and like... SSL isn't really designed to protect the content of your connection anyway: due to size and timing attacks, people have deployed practical implementations of stuff like "figure out where I am looking at on Google Maps" and…

> SSL isn't really designed to protect the content of your connection anyway: due to size and timing attacks, people have deployed practical implementations of stuff like "figure out where I am looking at on Google Maps" and "figure out what movie I am watching on Netflix", and while I haven't seen a practical implementation of it yet, "learn too much about my search queries due to find-as-you-type".

A VPN won't protect you from these sidechannel attacks.

Re: NordVPN confirms it was hacked

#240

Post by pm7 » Mon, Oct 21, 2019, 3:50 PM UTC

kryogen1c wrote: post #154

The interesting thing about OOB on most modern servers is that its a separate, physical NIC. Not only is that easily VLAN able, a more security conscious datacenter could even air-gap the out of band LAN!

> The interesting thing about OOB on most modern servers is that its a separate, physical NIC. Not only is that easily VLAN able

On lower grade servers OOB is using main NIC. It's still possible (in all implementation I have seen, which is not too many) to have OOB in VLAN.

> a more security conscious datacenter could even air-gap the out of band LAN!

1. If you air-gap remote management, you take away it's function.

2. It's not possible to truly air-gap OOB if servers with OOB are not air-gapped (it's theoretically possible to use server to get into OOB network by exploiting/flashing custom OOB from OS).