Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

NordVPN confirms it was hacked

techcrunch.com

Post reply on HN
Print view View original

461–470 of 666 posts

Re: NordVPN confirms it was hacked

#461

Post by hinkley »

apecat wrote: post #348
kevindong wrote: post #291

Earlier quoted context omitted.

> I find NordVPN's marketing reprehensible. A claim that really, really bothered me was something along the lines of "use us and no one will be able to read your email!" Every mainstream email provider (Google, Yahoo, Microsoft, Apple) now require HTTPS for emails. No one was ever going to be able to read your emails.

I normally don’t mind YouTube ads all that much, and I don’t see them on desktop browsers anyway. However, I was bombarded with ads for NordVPN and their crap made me so angry it pretty much sold me a paid YouTube membership. Hard to relax with some totally not weird ASMR when my blood pressure is through the roof because some chirpy ad agency dude wants to show me how much a VPN is like an umbrella or whatever.

We were just complaining the other day about tech companies being run by the marketing folks.

If you were a State, wouldn’t you be attracted to organizations that seem to be market driven? First, they have brand recognition, so they’re a fat target. Also they’re signaling hard that the engineers aren’t in charge. Probably more likely corners are being cut and morale is low.

Re: NordVPN confirms it was hacked

#462

Post by SparkyMcUnicorn »

SimeVidas wrote: post #434
SparkyMcUnicorn wrote: post #396

Earlier quoted context omitted.

Have you used Nord VPN? These aren't questions users would have. I could be wrong, but I'm confident that a plumber that has used Nord would know what a datacenter is, just from using the app. My tech illiterate Dad (70s) sure does.

VPNs are advertised a lot on all kinds of YouTube channels. It is reasonable to believe that they have a bunch of customers who know almost nothing about VPNs or the Internet in general.

Those are also the customers that won't even know that this hack ever happened, or won't care, because "everyone gets hacked anyways".

You said you wanted them to give a clear explanation, which I believe they did, but you don't. Let's just leave it at that.

These companies are giving all their customers the idea that they have reasonably good anonymity with a public VPN service, which is arguably false depending on how they use it. I feel like that's where you should be targeting this concern. Not an expired key leak.

Re: NordVPN confirms it was hacked

#463

Post by pbhjpbhj »

TallGuyShort wrote: post #254
nvrspyx wrote: post #225

Earlier quoted context omitted.

I’m not a network expert, but doesn’t TLS just cover your connection with a specific website? Since your IPS is often also your DNS, can’t they still see which specific websites you’re trying to connect to? Wouldn’t TLS just obfuscate what you’re specifically sending to and receiving from that site? I’m under the impression that my ISP can (and probably does) see every website I visit, which is in the least browsing…

You're correct - TLS / SSL operate above the IP layer, so they know which servers you're talking to, when and approximately how much, and if they can see your DNS requests it makes it that much easier to know which sites that maps to. TLS stops them from seeing the actual data you're sending them (like passwords), which pages you're viewing, and it also prevents them from manipulating the data (unless they've subvert…

By looking at side-channel data it was possible to correlate the page being viewed on SSL, IIRC researchers could calculate the page viewed about 70% of the time.

I misremembered, it was about 90% -- https://scirate.com/arxiv/1403.0297.

Re: NordVPN confirms it was hacked

#465

Post by IshKebab »

LIV2 wrote: post #136
LennyWhiteJr wrote: post #108

> The attacker gained access to the server — which had been active for about a month — by exploiting an insecure remote management system left by the datacenter provider, which NordVPN said it was unaware that such a system existed. This screams for clarification and I'd love for someone more knowledgeable in the area to elaborate on it. Is this common practice for data-center providers? Do I now not only have to wor…

It doesn't make much sense to me, even with iDRAC/some other console access you don't really have access to OS unless you reboot & go to single user mode etc at which point they should be noticing their servers rebooting etc. would love more info

Why would they notice their server rebooting? And why would they not just assume it was a glitch or power failure?

Re: NordVPN confirms it was hacked

#466

Post by Forbo »

kzrdude wrote: post #458
panarky wrote: post #297

Earlier quoted context omitted.

Also allowing historical sessions to be decrypted.

Who has logs of full historical sessions, and the tools to decrypt them? NSA?

Yeah, as far as I understand that's pretty much the purpose of the Utah datacenter.

Re: NordVPN confirms it was hacked

#468

Post by mindslight »

tialaramex wrote: post #417
mindslight wrote: post #267

Earlier quoted context omitted.

... and request sizes, relative times, and time of day. It would be foolish to not assume that the complete history of your sessions can be inferred from how this data clusters, everything but the actual text of your messages. Of course the people that find this problem worthwhile to solve then go on to work for or found surveillance companies, rather than publishing proof of concepts to security lists. We also alrea…

TLS has optional padding. In TLS 1.3 clever design means the padding is "free" (each byte of padding adds exactly one byte of data transmitted) so if you would like the sizes transmitted to be misleading you can choose how much. We can't solve for you the question of how much to use. If you want a snooper to not know if you retrieved file A of 14583 bytes or file B of 14621 bytes maybe a very small amount of padding…

Sure, but that doesn't really address how clients/websites use it right now, or even scale up to solving the fundamental problem (the best you can do is hide bits by padding requests/responses to a discrete set of lengths).

If you're responding to my characterization of HTTPS/JS as "broken", I'm referring to the fact it needs to make a connection to a well-known centralized-authority server every time it wants to retrieve a resource, leaving you at the mercy of your transit (and the server itself, which is obviously another major source of surveillance). Whereas something based on ideas like content-centric networking (eg Freenet) allows a user agent to retrieve those resources from peers or broadcasts, perhaps even over virtual constant-bitrate links.

Re: NordVPN confirms it was hacked

#469

Post by [deleted] »

ehsankia wrote: post #407
FillardMillmore wrote: post #201

I can't help but notice that NordVPN is one of the most heavily advertised VPNs from what I've seen (which raises the question, as one researcher pointed out in the article - are they not spending enough money on their security and infrastructure to protect their users?). They are claiming that: "no-one could know about an undisclosed remote management system left by the [data center] provider". Apparently the hacker…

Honestly, I don't think it's exclusive to NordVPN, I've found that all VPN advertising has increased significantly in the last year or two. Noticeably, ExpressVPN is also everywhere. Almost every podcast or youtube video has some VPN ads in it. It seems like with the recent focus on privacy, they are really these two companies and others are really trying to make a run for it.

[deleted]

Re: NordVPN confirms it was hacked

#470

Post by rasengan »

ryanlol wrote: post #457
rasengan wrote: post #451

Earlier quoted context omitted.

While the helpdesk software PIA used to use years ago did have that potential vulnerability, fortunately, Private Internet Access never exposed the support desk via plain http, and therefore, PIA itself did not have the vulnerability in its helpdesk.

Hahahaha, this bug was perfectly exploitable via TLS wrapped HTTP (so HTTPS, which is still HTTP as far as the PHP application is concerned). The SWIFT_client cookie gets passed directly into unserialize(), TLS has literally nothing to do with this. FWIW rasengan is one of the PIA founders, he should know much better. This response is so utterly silly I must wonder if this is all just an incredible display of incompe…

Sorry, I glanced at the link you pasted and wrote the response as I knew this was a non issue from the past.

So, I spoke with our internal team and was able to find more details:

- We haven't used that machine since that exploit was made public.

- We were never exploited.

- There was no sign of intrusion of any kind.

- The specific machine was a backup helpdesk test server without any real user data.

Thanks again for bringing this up!

Post reply on HN