NordVPN confirms it was hacked • Hacker News Board

Re: NordVPN confirms it was hacked

#361

Post by SlowRobotAhead » Mon, Oct 21, 2019, 5:48 PM UTC

colechristensen wrote: post #350

SlowRobotAhead wrote: post #344

Earlier quoted context omitted.

That supplier may be in violation of their contract. If Nord put in that there are to be no undisclosed methods to access the supplier system they're renting, and there are, this doesn't change any facts about the incident here. If I was a Nord user, I wouldn't care that the supplier will refund Nord their service charges. I don't think "no one could know" is ridiculous on it's own. Think about the level of access yo…

AWS has external auditors verify their policies, procedures, and actual methods meet a wide variety of compliance requirements from many different agencies. The level of access those auditors and other verification methods have to AWS is not none but very significant. https://aws.amazon.com/compliance/programs/

Yea, but my example wasn't access that auditors have, it's you, as a client.

Now on topic... You could argue that Nord perhaps was a bigger client than you or I am to AWS, and maybe they should have had better access, but the fact of the matter here is that it's absolutely possible that Nord is being accurate when they say "[we] could not have known".

Contract violation or not, you should never have full 100% confidence in someone else's system. If I was Nord and renting cloud I would absolutely assume there were undisclosed accesses, as I bet they are viewing everything now.

Re: NordVPN confirms it was hacked

#362

Post by novok » Mon, Oct 21, 2019, 5:48 PM UTC

rsync wrote: post #142

_-___________-_ wrote: post #34

I don't understand the obsession with VPN providers. Funneling all your Internet access through a single entity no matter where you connect from just seems like a fundamentally bad idea to me, especially if that entity's business is getting people to funnel all their traffic through, making them a juicy target for governments or hackers.

"I don't understand the obsession with VPN providers. Funneling all your Internet access through a single entity no matter where you connect from just seems like a fundamentally bad idea to me, especially if that entity's business is getting people to funnel all their traffic through, making them a juicy target for governments or hackers." Agreed - especially when it is so very, very cheap and easy to fire up a handf…

You can fire up VMs, but then issue becomes the VM provider, which definitely has their own logs. Doing torrents through a VPN you setup on a VM provider usually gets the automated emails being forwarded to you.

Re: NordVPN confirms it was hacked

#363

Post by mvexel » Mon, Oct 21, 2019, 5:49 PM UTC

apecat wrote: post #348

kevindong wrote: post #291

Earlier quoted context omitted.

> I find NordVPN's marketing reprehensible. A claim that really, really bothered me was something along the lines of "use us and no one will be able to read your email!" Every mainstream email provider (Google, Yahoo, Microsoft, Apple) now require HTTPS for emails. No one was ever going to be able to read your emails.

I normally don’t mind YouTube ads all that much, and I don’t see them on desktop browsers anyway. However, I was bombarded with ads for NordVPN and their crap made me so angry it pretty much sold me a paid YouTube membership. Hard to relax with some totally not weird ASMR when my blood pressure is through the roof because some chirpy ad agency dude wants to show me how much a VPN is like an umbrella or whatever.

> However, I was bombarded with ads for NordVPN and their crap made me so angry it pretty much sold me a paid YouTube membership.

For me it was those incessant Grammarly ads. A service, by the way, that has its own serious security and privacy concerns[0].

(I feel like YouTube Premium ($18/mo for up to 6 people) is a better deal than Spotify Premium ($15/mo for up to 6 people) for a household like mine where we listen to a lot of music and use YouTube a lot. I don't know how YouTube compares to Spotify when it comes to music selection however.)

[0] https://news.ycombinator.com/item?id=16315684

Re: NordVPN confirms it was hacked

#364

Post by pm7 » Mon, Oct 21, 2019, 5:49 PM UTC

tmikaeld wrote: post #282

FDSGSG wrote: post #260

Earlier quoted context omitted.

>For dedicated servers this would work, especially for VPN where data-loss is "acceptable". FWIW there's no need for data loss when you ditch the server, just download the encrypted data and decrypt using a clean environment elsewhere. >But if it where based on containers like LXC or OpenVZ, then the host can force root access via a command without even changing the root password of the container. You should never do…

I mean that encryption puts the entire data-store at risk, I've seen it happen more than twice due to RAM being faulty (In one incident it was using ECC RAM) and a power-failure. Even the backups where corrupt due to being backed up in encrypted images. When encrypted volumes and images are corrupted by RAM or power-failure, they are locked forever. Of course one should never force root access, I'm saying that you ca…

> Even the backups where corrupt due to being backed up in encrypted images. When encrypted volumes and images are corrupted by RAM or power-failure, they are locked forever.

That sounds more like issue with backup procedure (and testing of backups), even if it was amplified by encryption.

> Of course one should never force root access, I'm saying that you can't keep out the hosting from access the server in that case.

LXC and especially OpenVZ containers seems to be replaced by KVM in hosting/cloud. Of course, it's still possible to attack VM as host has control over VM's memory. Even dedicated servers are potentially vulnerable to attacks like cold boot.

> In one incident it was using ECC RAM

Did it at least warn about issues or was it ignored?

> I mean that encryption puts the entire data-store at risk, I've seen it happen more than twice due to RAM being faulty (In one incident it was using ECC RAM) and a power-failure.

How can this cause data loss? Header containing encryption key should not change during normal work. Did it just corrupt writes?

Re: NordVPN confirms it was hacked

#365

Post by layoutIfNeeded » Mon, Oct 21, 2019, 5:52 PM UTC

apecat wrote: post #348

kevindong wrote: post #291

Earlier quoted context omitted.

> I find NordVPN's marketing reprehensible. A claim that really, really bothered me was something along the lines of "use us and no one will be able to read your email!" Every mainstream email provider (Google, Yahoo, Microsoft, Apple) now require HTTPS for emails. No one was ever going to be able to read your emails.

I normally don’t mind YouTube ads all that much, and I don’t see them on desktop browsers anyway. However, I was bombarded with ads for NordVPN and their crap made me so angry it pretty much sold me a paid YouTube membership. Hard to relax with some totally not weird ASMR when my blood pressure is through the roof because some chirpy ad agency dude wants to show me how much a VPN is like an umbrella or whatever.

Use hooktube & adblock

Re: NordVPN confirms it was hacked

#366

Post by apecat » Mon, Oct 21, 2019, 5:52 PM UTC

gsich wrote: post #355

apecat wrote: post #348

Earlier quoted context omitted.

I normally don’t mind YouTube ads all that much, and I don’t see them on desktop browsers anyway. However, I was bombarded with ads for NordVPN and their crap made me so angry it pretty much sold me a paid YouTube membership. Hard to relax with some totally not weird ASMR when my blood pressure is through the roof because some chirpy ad agency dude wants to show me how much a VPN is like an umbrella or whatever.

No adblock?

Yes, on desktop. Harder to achieve with the mobile app.

And as it happens, I don't use a desktop OS to play stuff that helps me fall asleep.

Re: NordVPN confirms it was hacked

#367

Post by xvector » Mon, Oct 21, 2019, 5:53 PM UTC

Snawoot wrote: post #293

fauigerzigerk wrote: post #137

>NordVPN said it found out about the breach a “few months ago,” but the spokesperson said the breach was not disclosed until today because the company wanted to be “100% sure that each component within our infrastructure is secure.” So instead of allowing their customers to do their own damage limitation, they left their customers in the dark and continued to expose them to a breach they weren't sure they had fully c…

Sorry for posting under top comment, but I think it is very important. Official response hides fact OpenVPN CA keys also leaked, so attacker could impersonate any other NordVPN server: https://gist.githubusercontent.com/Snawoot/85f77356e229d77aa... RADIUS secret key also leaked, so propably it is possible to break into EAP session which infers session secret key for StrongSwan.

> RADIUS secret key also leaked, so propably it is possible to break into EAP session which infers session secret key for StrongSwan.

Could you elaborate on this? I am familiar with PKI so the first part makes sense, but I am not familiar with the intricacies of VPNs so I am not sure what this means.

Re: NordVPN confirms it was hacked

#368

Post by metalliqaz » Mon, Oct 21, 2019, 5:54 PM UTC

rasengan wrote: post #325

biddlesby wrote: post #317

Earlier quoted context omitted.

How does this quote demonstrate that the service provider was not at fault?

“We failed by contracting an unreliable server provider...” They are casting blame on the provider. Providing remote access tools is not a fault. Failure by NordVPN to disable said access is the issue, yet they passed the blame on.

Okay that makes sense. I read differently, like they had fabricated the story about the service provider's management console.

Re: NordVPN confirms it was hacked

#369

Post by crazydoggers » Mon, Oct 21, 2019, 5:54 PM UTC

KirinDave wrote: post #205

crazydoggers wrote: post #193

Earlier quoted context omitted.

You can’t always ensure that all traffic goes over SSL. DNS traffic is an example. I always assume that hostile public networks like free WiFi have agents actively trying to man in the middle any connections they can. If your device has a known exploit and a single connection not going over SSL you drastically increase your exposure on a public WiFi, hence the one use case for VPN.

If your privacy concerns include your DNS requests then a commerical VPN isn't a realistic choice. And unlike some rando pseudo-bespoke brand-less coffee shop wifi, commerical VPNs are a big target. > I always assume that hostile public networks like free WiFi have agents actively trying to man in the middle any connections they can. And VPNs just move that problem. If you're not demanding and forcing SSL, you're not…

Try running a traffic or packet monitor on a WiFi network. Now tell me how much of that traffic is going over SSL

And even if I don’t run my own VPN, I’d prefer to “move the problem”. It’s so much easier to attack machines on public WiFi than compromise a VPN provider... and much more anonymous, and less likely to incite law enforcement activity. Public airports, libraries, etc are hotbeds of nefarious activity.

Re: NordVPN confirms it was hacked

#370

Post by crazydoggers » Mon, Oct 21, 2019, 5:57 PM UTC

Spooky23 wrote: post #256

crazydoggers wrote: post #177

Earlier quoted context omitted.

The article is slightly more nuanced... know when and why to use VPN is more accurate. As mentioned near the end of that article, using known or suspected hostile networks, like public WiFi is a good reason to use VPN.

The problems addressed by avoiding a locally hostile network by connecting to another, globally hostile network is solving a very limited, nuanced set of problems. Unless you're VPNing to your home or office, these public providers are just asking for trouble. They're too cheap to run well.

Yes, you can run your own VPN... that’s a great solution.

Also public WiFi attracts low hanging fruit sort of exploits. Incentives for the VPN company that already makes money, to actively hack and exploit your machine are significantly less.

It’s not a privacy issue, it’s a security issue.