4 ms·

ProtonVPN and NordVPN Bugs Left Windows Vulnerable to Hackers

23 points by axiomdata316 8y ago

retox 8y ago
Non-AMP link; https://www.pcmag.com/news/363619/protonvpn-and-nordvpn-bugs-left-windows-vulnerable-to-hacker https://www.pcmag.com/news/363619/protonvpn-and-nordvpn-bugs...
- craftyguy 8y ago
  I know folks around here hate AMP stuff, but tell me which one of these is more readable than the other: https://imgtc.com/a/XyS61Ej https://imgtc.com/a/XyS61Ej
  - client4 8y ago
    My hate for walled gardens exceeds my annoyance at non-optimized mobile sites ;)
    - craftyguy 8y ago
      I actually agree with you. My point is not that the original is not optimized for mobile, but that it sucks hard for desktop. I wish there were an open, non-AMP way to remove the crap that AMP removes.
      - kijin 8y ago
        Reader view on Firefox does this beautifully without the need for any middleman. Client-side solutions are the way to go.
  - Dylan16807 8y ago
    I like this one, to be honest: https://i.imgur.com/j6ZnWkH.png https://i.imgur.com/j6ZnWkH.png That gray background is not great. (Though it looks different to me on amp. Weird.)
    - craftyguy 8y ago
      > That gray background is not great. That's the default background color I set for my browser when a site does not specify a background. I like it more than staring at blinding white #FFF.
  - pvg 8y ago
    I know folks around here hate AMP stuff I think just about everyone must be developing some very strong negative feelings about having a boring, offtopic debate about AMP in any AMP-unrelated post that happens to contain an AMP link. Please don't start more of them.
  - deleted 8y ago
    [deleted]
- dang 8y ago
  Thanks. Changed from https://www-pcmag-com.cdn.ampproject.org/v/s/www.pcmag.com/news/363619/protonvpn-and-nordvpn-bugs-left-windows-vulnerable-to-hacker?amp=1&amp_js_v=0.1#amp_tf=From%20%251%24s&ampshare=https%3A%2F%2Fwww.pcmag.com%2Fnews%2F363619%2Fprotonvpn-and-nordvpn-bugs-left-windows-vulnerable-to-hacker https://www-pcmag-com.cdn.ampproject.org/v/s/www.pcmag.com/n....
craftyguy 8y ago
> Hackers could have used the bugs to execute code via an OpenVPN exploit That seems to imply it's not specific to ProtonVPN and NordVPN, but any VPN service (including self-hosted) using OpenVPN...
- Dylan16807 8y ago
  Normal OpenVPN puts the configs inside Program Files.
  - craftyguy 8y ago
    I see, thanks for the clarification. I don't use Windows, but putting configs in Program Files seems just.. weird. It would be like putting user configs under /usr/share or /bin on Linux, I would think.
    - yjftsjthsd-h 8y ago
      It could be viewed as akin to /opt which would be less odd.
    - Dylan16807 8y ago
      It's an admin-controlled config, so it's kind of like /etc. Windows has separation for user configs, but per-system stuff is all a mess.
deleted 8y ago
[deleted]
solomondrix 8y ago
But this is old news and that vulnerability is already fixed, at least in NordVPN. Here's a blog post explaining it: https://nordvpn.com/blog/cve-vulnerability/ https://nordvpn.com/blog/cve-vulnerability/
- Baarsella 8y ago
  That's good to hear. I'm surprised why it made the news in the first place. That vulnerability is really hard to exploit, only when the hacker has full control of the machine. Don't people update their software?
dguido 8y ago
And people always criticize me for avoiding OpenVPN in AlgoVPN. Here's the entry from my FAQ: OpenVPN does not have out-of-the-box client support on any major desktop or mobile operating system. This introduces user experience issues and requires the user to update and maintain the software themselves. OpenVPN depends on the security of TLS, both the protocol and its implementations, and we simply trust the server less due to past security incidents. source: https://github.com/trailofbits/algo/blob/master/docs/faq.md#why-arent-you-using-openvpn https://github.com/trailofbits/algo/blob/master/docs/faq.md#... Stop using OpenVPN! Use whatever client ships with your operating system for IPSEC or use Wireguard.
RantMan 8y ago
Not even surprised. I have had issues as well with the premium VPN brands such as Nord and Express related to logs. I use Ivacy VPN now. Its far cheaper and so far haven't troubled me in any way. Ivacy VPN: www.ivacy.com

23 points by axiomdata316 8y ago

Non-AMP link; https://www.pcmag.com/news/363619/protonvpn-and-nordvpn-bugs-left-windows-vulnerable-to-hacker https://www.pcmag.com/news/363619/protonvpn-and-nordvpn-bugs...

craftyguy 8y ago
I know folks around here hate AMP stuff, but tell me which one of these is more readable than the other: https://imgtc.com/a/XyS61Ej https://imgtc.com/a/XyS61Ej
- client4 8y ago
  My hate for walled gardens exceeds my annoyance at non-optimized mobile sites ;)
  - craftyguy 8y ago
    I actually agree with you. My point is not that the original is not optimized for mobile, but that it sucks hard for desktop. I wish there were an open, non-AMP way to remove the crap that AMP removes.
    - kijin 8y ago
      Reader view on Firefox does this beautifully without the need for any middleman. Client-side solutions are the way to go.
- Dylan16807 8y ago
  I like this one, to be honest: https://i.imgur.com/j6ZnWkH.png https://i.imgur.com/j6ZnWkH.png That gray background is not great. (Though it looks different to me on amp. Weird.)
  - craftyguy 8y ago
    > That gray background is not great. That's the default background color I set for my browser when a site does not specify a background. I like it more than staring at blinding white #FFF.
- pvg 8y ago
  I know folks around here hate AMP stuff I think just about everyone must be developing some very strong negative feelings about having a boring, offtopic debate about AMP in any AMP-unrelated post that happens to contain an AMP link. Please don't start more of them.
- deleted 8y ago
  [deleted]
dang 8y ago
Thanks. Changed from https://www-pcmag-com.cdn.ampproject.org/v/s/www.pcmag.com/news/363619/protonvpn-and-nordvpn-bugs-left-windows-vulnerable-to-hacker?amp=1&amp_js_v=0.1#amp_tf=From%20%251%24s&ampshare=https%3A%2F%2Fwww.pcmag.com%2Fnews%2F363619%2Fprotonvpn-and-nordvpn-bugs-left-windows-vulnerable-to-hacker https://www-pcmag-com.cdn.ampproject.org/v/s/www.pcmag.com/n....

craftyguy 8y ago

> Hackers could have used the bugs to execute code via an OpenVPN exploit That seems to imply it's not specific to ProtonVPN and NordVPN, but any VPN service (including self-hosted) using OpenVPN...

Dylan16807 8y ago
Normal OpenVPN puts the configs inside Program Files.
- craftyguy 8y ago
  I see, thanks for the clarification. I don't use Windows, but putting configs in Program Files seems just.. weird. It would be like putting user configs under /usr/share or /bin on Linux, I would think.
  - yjftsjthsd-h 8y ago
    It could be viewed as akin to /opt which would be less odd.
  - Dylan16807 8y ago
    It's an admin-controlled config, so it's kind of like /etc. Windows has separation for user configs, but per-system stuff is all a mess.

deleted 8y ago

[deleted]

solomondrix 8y ago

But this is old news and that vulnerability is already fixed, at least in NordVPN. Here's a blog post explaining it: https://nordvpn.com/blog/cve-vulnerability/ https://nordvpn.com/blog/cve-vulnerability/

Baarsella 8y ago
That's good to hear. I'm surprised why it made the news in the first place. That vulnerability is really hard to exploit, only when the hacker has full control of the machine. Don't people update their software?

dguido 8y ago

And people always criticize me for avoiding OpenVPN in AlgoVPN. Here's the entry from my FAQ: OpenVPN does not have out-of-the-box client support on any major desktop or mobile operating system. This introduces user experience issues and requires the user to update and maintain the software themselves. OpenVPN depends on the security of TLS, both the protocol and its implementations, and we simply trust the server less due to past security incidents. source: https://github.com/trailofbits/algo/blob/master/docs/faq.md#why-arent-you-using-openvpn https://github.com/trailofbits/algo/blob/master/docs/faq.md#... Stop using OpenVPN! Use whatever client ships with your operating system for IPSEC or use Wireguard.

RantMan 8y ago

Not even surprised. I have had issues as well with the premium VPN brands such as Nord and Express related to logs. I use Ivacy VPN now. Its far cheaper and so far haven't troubled me in any way. Ivacy VPN: www.ivacy.com