NordVPN Breached 19 months ago — disclosed only a few days ago (October 2019)
schneier.com/blog/archives/2019/10/nordvpn_br...Posted Oct 24, 2019, 11:35 AM UTC
46660
schneier.com
I'll take, Ways to commit corporate suicide for $1,000, Alex.
104
Yes, it’s over for them. You can’t have your whole business premise based on trust and privacy when a privacy breach happens and you don’t tell users.
For anyone saying logs were not compromised. Who needs logs when you have the TLS keys and can log every single bit yourself?
21
To be clear, I don't think the leaked key could be leveraged to decrypt traffic in the tunnel
All that could have been done here, if I'm not woefully out of date on my reading, is for someone to stand up a bullshit site pretending to be Nord where they could serve malicious shit to your browser. And even then I think you would have gotten a nag regarding the expired state of the cert.
Correct me if I'm wrong.
Edit: yeah, just read up a bit, it wasn't a transport encryption key, and even if it was, Nord use d-h perfect forward (we used to call ratchet) secrecy.
This is am embarrassing leak but I'm not seeing any technical evidence that suggests Nord users could have been compromised here in the way that some folks are suggesting.
FTR, I don't use Nord.
5
As an aside, I have noticed a major spike in suspected pro-NordVPN astroturfing taking place here and on Twitter.
65
I'm a NordVPN subscriber (re-evaluating my decision to stay with them. I have a year left on the plan but might just take the hit and switch to another one anyways) and they recently (in the last 2-3 weeks) started sending emails to subscribers advertising deals on NordVPN subscriptions even though those people are already subscribed customers. There are several threads on r/nordvpn of subscribers complaining about getting ads for new discounted 1 or 2 year subscriptions when they're already customers. Now in hindsight this might actually be more malicious than simply inconsiderate advertising. They might have known that the hack information would be made public soon and were trying to get current customers to shell out more money for a long term pre-paid extension to their plan before some of them decide to not renew due to the hack.
If that is the case, then that is way worse than me just getting annoying ads from a company I'm already a subscriber to, and would make me want to switch providers more.
37
Wow. That reflects very poorly on the provider for sure.
That is akin to Equifax briefly attempting to profit off of their failure to secure Apache Struts installs after one of the biggest personal data breaches in the history of mankind so far.
12
They are also using the good ol' "Only X hours left before it's too late!" on their pricing page. Obviously the offer is still there even though it reaches the end of the counter every day. I hate that.
1
Yeah I wish that kind of lying to customers was illegal. Because it is lying. It's not just misleading. The company knows the statement to be false. I'm not sure why it doesn't fall under false advertising law, but apparently it does not because it happens all over the place with no penalties.
The same sort of thing is rampant when booking hotels and airplane tickets.
1
I'm betting there is some loophole where if they change the deal ever so slightly it is technically not false advertising.
1
I've been getting the ads as well. I understand that they just want me as a costumer, and I appreciate the deals.
I just can't understand why I wasn't notified before. No deal will bring me back from a trust issue. I liked them, though. It's just not for me anymore.
1
*one of their servers in Finland hosted by a third party that used faulty config.
*no customer data was found
https://nordvpn.com/ru/blog/official-response-datacenter-breach/
58
TLS keys were in the wild, this is big. Someone with those keys could setup his own VPNs servers, and anyone connecting to those servers thinking it would be nordvpn servers would see nothing while the pirate servers would have access to fully unencrypted traffic.
I admit, it would require BGP or DNS hijacking to do so which is no easy task and would likely have been noticed one way or another, but still possible.
And even if in the end no data have been stolen, the way nordvpn attempted to hide this breach really sucks. They provide VPNs, users trust them with all their data and yet it takes more than a year for them to discover/admit a breach.
60
It sounds like two VPNs from opposing companies is overkill but to be honest if shit like this can happen we should all be plugged behind at least two or three VPNs
8
You could have 10 VPNs but if the first one you connect to is compromised then you're screwed, no?
8
It depends how you set it up. If it is just hops then yes any compromise along the chain brings the whole thing down so having the hops doesn't help confidentiality. But if you're using a layered tunnel then it would help anonymity because your traffic is harder to trace back to you, however if the last hop in the chain is compromised then confidentiality fails. So again might help a little but in my view not enough to make the likely extreme amount of latency worth it. If you trust the last hop in the chain so much that this isn't an issue, then why wouldn't you just use that one hop, why route through all the intermediate hosts? The most I could see would be using 2 VPN hops. Any more is excessive and doesn't add anything.
5
It depends on the attack and how it's compromised
1
Fuck you, I'm behind seven proxies and three VPNs!
4
[deleted]
1
No, it’s an easy task for anyone we use VPN to protect from. Beside watching Netflix in a different country, a VPN is used to hide user data from intermediaries. These intermediaries already handle your packets so with TLS keys, a man-in-the-middle attack becomes trivial and undetectable.
The problem isn’t that they were hacked. Google was hacked by China so being hack-proof is like being bullet-proof; it only works for common attacks. The fact that they did not disclose that their keys leaked could’ve put people in physical danger from authoritative government.
3
What do you expect? for them to say "yeah they fucked us hard for 2 years ina row"? of course they will say bullshit.. just look te way it is deisgned the "More technical" post.. grey letters and black "important" words..
5
The thing is, it doesn't matter if the only thing that got hacked was the clock on the vending machine in the employee breakroom to make it only show 80:08 instead of the time.
The problem is that they're advertised as a trusted, protected, secure solution but now it turns out they have been hiding shit for almost two years.
Breaches happen, nobody is perfect, vulnerabilities and mistakes happen all the time. All they had to do was just admit it up front and be like "Hey one of our servers just got hit, no customer data got taken, and we're taking steps to resolve the situation, more details to come. In the meantime we are monitoring our other systems extra closely to make sure this doesn't happen again." and they would have looked like heroes and basically nobody would have held it against them.
Now, how can we ever trust them again?
And what's even worse, all the poor YouTubers and podcasters who have been advertising for them end up looking like assholes too even though it isn't even remotely their fault.
1
They didn’t find out about this two years ago.
If you read the official post, it states their justification for waiting (a few months) until now. Agree with it or not.
1
A few additional links:
36
Why the russian version of NordVPN link?
5
Sorry, fixed the link. Although I believe it was showing the English version anyway.
8
Yes the blog was in english, but it made the rest of the site russian. xD
5
Now this is an avengers level threat
30
Cut back on the soy
-65
How does that smarm taste?
1†
The fuck does this comment chain even mean?
8
Wow, this is really bad
Wow, you must be a pathetic, weak little boy
Wow, you're kind of a dick
4
referencing 'soy' is a newish way of indicating a lack of masculinity that has been mostly adopted by the far-/alt-right.
4
this has nothing to do with r/programming
this stuff belongs in r/netsec
15
Fair point. Still, I thought that users of this sub should be advised about this incident as well -- it's kind of an emergency.
2
This server was part of their core infrastructure? I ask because I can't imagine why it would have their server intermediate CA private key on it if it was customer-facing. Unless they're using the same intermediate CA to issue both client certs and server certs, which would be silly.
3
next in line: ex******
1
I don't understand why anyone would trust a 3rd party VPN with their data. If you're smart enough to use a VPN you might as well set up your own on an instance that one can destroy at will.
-1
Most people use a VPN to be relatively anonymous or circument geoblocking. You can't really do that with your own instance.
8
Bandwidth tends to be expensive. Depending on your utilization you could exceed the VPS plans which provide a base level of included bandwidth. Also it's much more convenient to not have to administer the self-managed VPN endpoint. Also a self-managed one is directly tied directly to you so is fairly identifiable compared to a shared VPN service.
3
Problem with your own is that there is that you will surf all the time over the same IP. You can not switch between countries etc. The server you rend to use as a VPN is also registered into your name, so you can be tracked back way easier. To the point that all your doing is, putting a fake IP in front of your ISP provider's IP. What is kind of ironic because a lot of ISP's change the customers IP number often = harder to track ( hide in the herd kind of thing ).
Most people use VPN services like that because its easier. When i was in China, i trying to setup a VPN service on my own server, and it was useless. China uses packed detection and after X minutes closes your connection. So your forced to use a VPN service that build in a series of evasion or faked packages, to avoid the Chinese Firewall its detection software. Trust me, when it takes 3 days to find a stable and fast in-outbound source, just to see Youtube, you will think twice about setting up your own service. :)
2
[deleted]
-6†
Website hacked Hackers programmed hack
16
Because the sub is mostly focused on software news.
2
Absolute statements are often easy to dismiss.
1
I feel like programmers are a market for this product. It is relevant to me at least.
1
I've been hearing their lying ads in youtube videos (where they hire the video creator to read it out for them and embed it) for YEARS. They always claim it makes you more secure, when the truth is that if you're connecting to a site without SSL/TLS, you're not secure. In fact, if I was the NSA or another nefarious agency, I'd put taps on as many of those VPN exit points as I can, to suck-up all those plain-text passwords. Who cares that you won't immediately know where the user was from?
-8
In fact, if I was the NSA or another nefarious agency, I'd put taps on as many of those VPN exit points as I can, to suck-up all those plain-text passwords.
Search for:
OTP VPN Exploitation Team
8
SSL ans TTL are mandatory these days, and there no ways to send the password other than plain text in http ? (I will surprised of the opposite)
3
They're becoming near-mandatory, but they can't be completely. As for plain-text, it doesn't really matter if you send it that way or hashed. They can just reuse the hash to login to the same place.
3
IIRC, the fix for that is called a nonce. The server hands you a token which can only be used once and expires after a period of time, and you salt the password with it.
But you still can’t know that the server is who it claims to be; you need HTTPS for that.
4
Usually the connection is secured long before the password is sent. Look up Diffie-Hellman key exchange for more details, but basically there's ways to share a key without exposing it to third parties.
1
HTTPS is everywhere these days, when was the last time you used a website that an authentication page that used plain HTTP? And even then, people that are using VPNs should be aware of that risk, and use completely different passwords for those types of websites.
All in all, I think you underestimate how important anonymity is for some people. Just concealing the traffic itself is already a big selling point for VPNs too.
VPNs are not the ultimate solution for the many issues between the end user and a safe access to the Internet, but they're a good start.
1
when was the last time you used a website that an authentication page that used plain HTTP
There's that local gaming forum that I rarely visit anymore, since all the mods and admins turned full-blown Nazi, after being recruited using gamergate.
1
My subscription ends this December. Sadly, I won't be renewing my Christmas auto gift this time.
You were downvoted for pointing out that a VPN company who doesn't acknowledge they were hacked for almost 2 years is untrustworthy. There be shills in these waters.
Ya'll can be angry all you want or try to pretend it's a non-issue. They didn't disclose to their customers they were hacked. Say goodbye to your customer base.
Getting hacked happens. Not telling your customers for 2 years? That's unacceptable.
They could have announced it ASAP showing good faith while demonstrating that on their end they had a solid process since the failure came from the hosting company. It would have cost them a bit but not the total loss of trust they will now face.
Who knows what other breaches they may have had and not told anyone? They'll only disclose if someone else comes forward with proof and that's really a bad way to handle it.
A smart company discloses this information as a small news item ( after it happen ) on Friday night, during the slow news cycle. Most will overlook it and that is it. Now that same news is 10x more widespread as the company does not control the narrative. Add to this the delay also makes it more newsworthy.
Couldn't agree more with you.
Texan here. This is the only thing I’m angry about. Other than that, I upvoted both of y’all.
Naw he ain't. Can't even spell "y'all".
I probably should’ve used a comma to highlight my being Texan, not them. Texas revokes your drivers license and state residency if you misspell “y’all” and the State Troopers will drive you to the closest border of Texas and drop you off as a part of being exiled, be it Louisiana or Mexico, they don’t care.
There are many other VPN services around.