38 ms·

NordVPN confirms it was hacked

1368 points by afshinmeh 7y ago

ngcc_hk 7y ago
Wow. Just switch per advice of lihkg! How serious? Seems all tech talk but not impact talk
- donkeyd 7y ago
  > How serious? From my understanding, that really depends what you're using it for. My friends mostly use Nord to get around region locks for Netflix etc. I think impact for them is minimal. If you were using NordVPN in Hong Kong, to cover your involvement in the protests, then it could be a lot more serious. I wouldn't use Nord (or any comparable provider) for that anyway, since their holdings tend to be pretty opaque. That doesn't mean nobody did use it for stuff like that though.
  - Bartweiss 7y ago
    I see the Twitter thread mentions: > And someone just mentioned to me that past encrypted sessions may be able to be decrypted, which is a much bigger issue!...I haven't researched enough about OpenVPN to know if it's using forward secrecy, though you'd hope so Any idea where that claim is coming from? Nord's site mentions having forward secrecy in place, so presumably most historical stuff is safe unless they botched that. Of course, somebody in e.g. Hong Kong could still have gotten a MitM attack if they were active while these keys were being used, which is reason enough to worry about exposure.
AdmiralAsshat 7y ago
https://twitter.com/hexdefined/status/1186214904132300800 https://twitter.com/hexdefined/status/1186214904132300800 The thread indicates that VikingVPN and Torguard were also compromised at some point. Highly concerning.
Sir_Cmpwn 7y ago
NordVPN is being recommended a lot to people who don't know better by influencers on social media, especially on YouTube. This kind of endorsement is recklessly negligent and needs to stop. https://drewdevault.com/2019/04/19/Your-VPN-is-a-serious-choice.html https://drewdevault.com/2019/04/19/Your-VPN-is-a-serious-cho... Edit: note that I don't blame these influencers for their ignorance on the risks of using a VPN; rather I blame the shady VPN providers for overselling the security value of their product and leading users into a false sense of security.
- Mirioron 7y ago
  I'm pretty sure they're "recommending" it because they're getting paid for it - it's a sponsor segment. After demonetization became common YouTubers looked for other sources of revenue and there are rather few companies that try to contact them directly for ads, so you see them appear over and over again.
  - tokai 7y ago
    Yeah it's diffidently not being recommended, it is being advertised. I wonder how many money they have spend. Every freaking channel mention them at some point.
    - Nextgrid 7y ago
      You start to wonder where their money is coming from - their retail prices are already cheap, the discounts the influencers offer make it basically free. How's that sustainable?
      - tokai 7y ago
        No idea. Yesterday I saw a discount with an extremely cheap 3-year plan (under 30$ and no data limit, iirc). The price didn't offer confidence that the service would be available for all three years.
      - Mirioron 7y ago
mdorazio 7y ago
Someone is probably going to ask what other HN users recommend as an alternative. Personally, I use Private Internet Access because they're the only provider I've found with a track record of demonstrably not being able to turn your records over to someone asking for them [1]. [1] https://torrentfreak.com/private-internet-access-no-logging-claims-proven-true-again-in-court-180606/ https://torrentfreak.com/private-internet-access-no-logging-...
- tmikaeld 7y ago
  Yeah, they have been around for a very long time too. Used to be the more expensive alternative though, glad to see their prices have fallen a bit.
- FactolSarin 7y ago
  EDIT: I said I used IPVanish mostly because the EFF endorsed them, but someone pointed out below they got caught logging. I suppose that would explain why they're not endorsed on the EFF VPN page anymore. So, I guess time to find a new VPN. :(
  - rasengan 7y ago
    IPVanish was caught logging while claiming they didn’t log [1]. [1] https://torrentfreak.com/ipvanish-no-logging-vpn-led-homeland-security-to-comcast-user-180505/ https://torrentfreak.com/ipvanish-no-logging-vpn-led-homelan...
    - FactolSarin 7y ago
      Ugh. Good to know, thanks.
  - WhoIsSatoshi 7y ago
    Used IPVanish for a few years, it was great the first, sucked the 2nd. I switched. These days I use VyprVPN. I like their Chameleon encryption that hides the VPN (although some data still leaks and some sites still detect it) and the killswitch option (prevents connections out if VPN not active)
clSTophEjUdRanu 7y ago
I like Mullvad
- iaml 7y ago
  Mullvad is a decent option, they have openvpn based app and wireguard profiles. Didn’t have any connectivity issues either.
- elliekelly 7y ago
  I’ll second this. They also allow you to pay in cash which I think is an aspect of privacy that a lot of VPNs overlook.
tmikaeld 7y ago
It's odd that NordVPN, VikingVPN and Torguard all got their private keys leaked here. - Did the hackers use an SSH or a VPN service vulnerability? - Or maybe even a previously unknown vulnerability? - Was SSH access firewalled? If not, why? - Do they still have root access?
- ganoushoreilly 7y ago
  A lot of them shared physical infrastructure definitely less odd that multiple were breached at same time.
  - swiley 7y ago
    I was just thinking yesterday that people might be overly paranoid about that, I’ve always agreed that if security were important you shouldn’t share space but lately I’ve begun to question it since a lot of these data centers are pretty carefully controlled. I’m glad I didn’t speak my mind on that I guess since I was wrong.
- FDSGSG 7y ago
  >It's odd that NordVPN, VikingVPN and Torguard all got their private keys leaked here. Good reminder to set up FDE and not give your host logins for your servers. Unexpected reboots are rare enough that they're worth switching hosts over.
  - tmikaeld 7y ago
    For dedicated servers this would work, especially for VPN where data-loss is "acceptable". But if it where based on containers like LXC or OpenVZ, then the host can force root access via a command without even changing the root password of the container.
    - pm7 7y ago
      I doubt serious VPN provider are using LXC/OpenVZ containers. They don't even work with OpenVPN without special setup from provider, I don't know how about other protocols.
metalliqaz 7y ago
A while ago I read that there was a potential smear war going on between some of the larger VPN providers. Is there any chance that this is related? (I'd prefer more than just a tweet)
justicz 7y ago
If you care less about the pseudo-anonymous-but-not-really shared-IP aspect of using a VPN, and care more about the this-lan-is-sketchy use case, I have had good experiences with Algo [0]. You can just paste in an API key and spin up your own VPN on something like DigitalOcean. And it uses WireGuard! [0] https://github.com/trailofbits/algo https://github.com/trailofbits/algo
- Diederich 7y ago
  I was getting ready to paste the same thing; the command-line instructions make Algo, effectively, a somewhat technical solution, but it really does just work. And for those who have used various VPN solutions over the years but not Wireguard: it really is pretty magic. It Just Works, with fantastic performance.
- tmikaeld 7y ago
  There's also Streisand[0], that gives a lot more options. [0] https://github.com/StreisandEffect/streisand https://github.com/StreisandEffect/streisand
  - zigzaggy 7y ago
    Came here to post this. I’ve been using streisand for a long time with no problems. I’ve given out logins to a few trusted friends / colleagues and all have had good experiences as far as I know. Plus I really enjoyed learning about the in’s and outs of setting it up. I poke around in the VM just for giggles.
  - mbesto 7y ago
    Ive done this but have found that most services (Netflix, etc) recognize DO as a VPN. Does anyone know of a hosting provider that isn't blacklisted but I can still setup wireguard on?
    - sdan 7y ago
      Run it on https://1984hosting.com https://1984hosting.com. I've heard it's good although I can't attest personally.
sudoaza 7y ago
More worrisome is that this may allow old cptures to be decrypted, anyone know of VPN providers that use PFS?
- rasengan 7y ago
  Private Internet Access is PFS (using DHE - Diffie Hellman Ephemeral).
Liquix 7y ago
Nord (and perhaps others) seem to have been compromised for months/years - lifetime accounts have been available on the DN for significantly cheaper than other VPNs: https://news.ycombinator.com/item?id=20094946 https://news.ycombinator.com/item?id=20094946 Doesn't seem like a smear - glad this is coming to light.
- SlowRobotAhead 7y ago
  Nord specifically has a retailer system, I wonder if accounts can be created 3rd party and sold greymarket like that without any nefarious hacking scandals?
- NilsIRL 7y ago
  It's more that their users got hacked.
_-___________-_ 7y ago
I don't understand the obsession with VPN providers. Funneling all your Internet access through a single entity no matter where you connect from just seems like a fundamentally bad idea to me, especially if that entity's business is getting people to funnel all their traffic through, making them a juicy target for governments or hackers.
- steveeq1 7y ago
  Because for certain types of things, like pirating movies, it's good enough.
  - _-___________-_ 7y ago
    It seems a bit strange to me that you'd want to hide your movie pirating from your ISP but are happy for your VPN provider to know about it.
    - sixothree 7y ago
      I think it is more of a matter of hiding your local ip address from other torrent users.
      - _-___________-_ 7y ago
        What's the purpose of that? Genuine question, I'm trying to understand the threat model of another torrent user seeing the IP address that is currently allocated to your router. Is this related to those letters that people sometimes get sent threatening legal action for torrenting?
        sixothree 7y ago
        quite simply evading copyright strikes or legal filings. I don't know which providers still disconnect your internet after 3 strikes. But I am guessing that's the "threat" here.
    - 7y ago
rikkipitt 7y ago
NordVPN just posted this a few minutes ago: https://nordvpn.com/blog/official-response-datacenter-breach/ https://nordvpn.com/blog/official-response-datacenter-breach...
- haolez 7y ago
  I'm curious about who this cloud provider might be.
  - spoopyskelly 7y ago
    The local IP for the OpenVPN endpoint (185.212.149.9 listed in the gist) belongs to creanova.org since 2017.
- jwilk 7y ago
  They wrote: > We […] started creating a process to move all of our servers to RAM, which is to be completed next year. What does "RAM" mean here?
  - Faaak 7y ago
    I guess that all decryption keys are on ram. If the power is disconnected, then it would need a manual intervention to re-decrypt the data
  - willstrafach 7y ago
    Likely booting the OS from a RAM-disk and mounting as read-only.
- mzs 7y ago
  NordVPN is down, also looks like VikingVPN and TorGuard were affected as well: https://twitter.com/cryptostorm_is/status/1186097950327476224 https://twitter.com/cryptostorm_is/status/118609795032747622...
  - Matthias1 7y ago
charles_f 7y ago
I guess it depends what you want from your VPN. When I want to secure a shady connection in a coffee house, I have a raspberry 3 at home that I use only for that purpose with an openVpn setup with https://www.pivpn.io/ https://www.pivpn.io/ - super easy to use. Downside, I rely on my isp not to spy on me. Upside, it's mine and unless I'm specifically targeted it's unlikely someone will mitm me. To hide my location for various purposes, I have used TigerVPN. They have been reliable so far, but I wouldn't trust entirely any third party when it comes to privacy. Upside - somewhat reliable and not my isp. Downside - for all I know someone in Czech Republic is watching what I stream with a bucket of popcorn
arshbot 7y ago
Lots of talk here from highly technical folks but not one person brings up the fact that these are expired keys - as in not usable? I understand that the fact that these keys were obtained is concerning but the security of nord and etc prevailed at the end of the day. The question is: were they leaked before they expired or long after?
- esnard 7y ago
  They were leaked on March 2018 [0][1], and they expired on October 2018 [2]. [0] https://web.archive.org/web/20180504001844/https://8ch.net/b/res/7948898.html https://web.archive.org/web/20180504001844/https://8ch.net/b... [1] https://nordvpn.com/fr/blog/official-response-datacenter-breach/ https://nordvpn.com/fr/blog/official-response-datacenter-bre... [2] https://crt.sh/?id=10031443 https://crt.sh/?id=10031443
  - arshbot 7y ago
    > However, the key couldn’t possibly have been used to decrypt the VPN traffic of any other server. On the same note, the only possible way to abuse website traffic was by performing a personalized and complicated MiTM attack to intercept a single connection that tried to access nordvpn.com. However crt.sh shows > Validity > Not Before: Oct 6 12:53:38 2015 GMT > Not After : Oct 6 12:53:38 2018 GMT What exactly were these keys for if they were only usable in such a manner according to nord?
    - wswope 7y ago
      Nord has a couple thousand severs, and each has their own key. In order to decrypt traffic, you'd have to intercept some traffic to decrypt, which would require a MitM attack unless you're an ISP/state actor.
- thenewnewguy 7y ago
  Depending on the web server configuration they could be used to decrypt past traffic.
Talentener 7y ago
I've just read the official statement and it seems that the data center was compromised, not the VPN traffic, it wasn't affected by this
godelmachine 7y ago
This is troublesome. I was planning to eke out $85/ annum and go for NordVPN, but now even this is unreliable
- readhn 7y ago
  Im using PIA for 2 years now - pretty happy with the service.
  - majora2007 7y ago
    Yeah been on PIA myself for 5 years. Amazing speeds and service. No issues at all and they have been in court twice where they showed they have no logs.
    - readhn 7y ago
      Its great - i use it on my work PC to reroute my personal traffic, on my families personal devices, when traveling abroad etc. That said, there is a no 100% guarantee so use it responsibly.
  - qertoip 7y ago
    It's based in US.
    - readhn 7y ago
      So am I.
- rf15 7y ago
  Except this isn't their fault because their infrastructure provider messed up and didn't even disclose this possible backdoor. If anyone the provider should be named and shamed, not NVPN.
  - hellcow 7y ago
    > NordVPN said it found out about the breach a “few months ago,” but the spokesperson said the breach was not disclosed until today because the company wanted to be “100% sure that each component within our infrastructure is secure.” Not acceptable.
SimeVidas 7y ago
The best thing NordVPN can do right now is make a statement that clearly and honestly describes how its users are affected. No bullshit marketing language, no trying to hide facts, just a short and simple explanation of what this means for users and what they should do next.
- uniformlyrandom 7y ago
  Linked article says: > “The server itself did not contain any user activity logs; none of our applications send user-created credentials for authentication, so usernames and passwords couldn’t have been intercepted either,” said the spokesperson. “On the same note, the only possible way to abuse the website traffic was by performing a personalized and complicated man-in-the-middle attack to intercept a single connection that tried to access NordVPN.” > According to the spokesperson, the expired private key could not have been used to decrypt the VPN traffic on any other server. > NordVPN said it found out about the breach a “few months ago,” but the spokesperson said the breach was not disclosed until today because the company wanted to be “100% sure that each component within our infrastructure is secure.”
  - SimeVidas 7y ago
    If I were a NordVPN customer, these quotes would not give me confidence that my traffic wasn’t exposed.
  - Snawoot 7y ago
    > According to the spokesperson, the expired private key could not have been used to decrypt the VPN traffic on any other server. It's simply not true. Their CA private key which is used to issue certificates for ALL servers also leaked along with RADIUS key which is used to secure EAP session [1]. They DO hide facts. [1] https://gist.githubusercontent.com/Snawoot/85f77356e229d77aa36f16059a629eea/raw/e4e4af26e4c411d32bbc6bd3ba26301c2ae074bd/nordvpn.txt https://gist.githubusercontent.com/Snawoot/85f77356e229d77aa...
- readhn 7y ago
  Truth is - if hackers did a MIM attack and collected a bunch user traffic (for how long?) they could have everything.. banking info, emails, logins... at this point if i was a user of that VPN service - i'd be replacing all of my sensitive passwords, secret questions/answers to key accounts.
CiPHPerCoder 7y ago
This is always topical: Don't use VPN Services https://gist.github.com/joepie91/5a9909939e6ce7d09e29 https://gist.github.com/joepie91/5a9909939e6ce7d09e29
- crazydoggers 7y ago
  The article is slightly more nuanced... know when and why to use VPN is more accurate. As mentioned near the end of that article, using known or suspected hostile networks, like public WiFi is a good reason to use VPN.
  - Spooky23 7y ago
    The problems addressed by avoiding a locally hostile network by connecting to another, globally hostile network is solving a very limited, nuanced set of problems. Unless you're VPNing to your home or office, these public providers are just asking for trouble. They're too cheap to run well.
    - crazydoggers 7y ago
      Yes, you can run your own VPN... that’s a great solution. Also public WiFi attracts low hanging fruit sort of exploits. Incentives for the VPN company that already makes money, to actively hack and exploit your machine are significantly less. It’s not a privacy issue, it’s a security issue.
- malux85 7y ago
  "Dont use VPN services" then at the bottom: So then, what? THIS TYPE OF VPN
  - bildung 7y ago
    Which is not a service, but a self-hosted open source solution.
    - 7y ago
jwilk 7y ago
See also: https://news.ycombinator.com/item?id=21311475 https://news.ycombinator.com/item?id=21311475
LennyWhiteJr 7y ago
> The attacker gained access to the server — which had been active for about a month — by exploiting an insecure remote management system left by the datacenter provider, which NordVPN said it was unaware that such a system existed. This screams for clarification and I'd love for someone more knowledgeable in the area to elaborate on it. Is this common practice for data-center providers? Do I now not only have to worry about my own infrastructure security but also worry that my IaaS provider hasn't installed some backdoor to my servers?
- CiPHPerCoder 7y ago
  Sounds like an iDRAC exploit (assuming Dell servers). But, yes, remote management is pretty common in datacenters. The fact that NordVPN wasn't aware of them just shows incompetence.
  - lucb1e 7y ago
    Depends on what kind. In case of idrac, yes; but it's weird that it was insecure by default in the first place. Usually credentials are configured and provided to the customer. Makes me think there might have been some other interface. Clarification is definitely needed.
    - CiPHPerCoder 7y ago
      It could have been something like https://www.zdnet.com/article/vulnerabilities-found-in-the-remote-management-interface-of-supermicro-servers https://www.zdnet.com/article/vulnerabilities-found-in-the-r... There were many IPMI/iDRAC/etc. exploits published in the past few years. Throw a dart at a list of them, and you'll probably find one that was unpatched in most systems as of March 2018.
  - LennyWhiteJr 7y ago
    How the hell do you pwn a server with iDRAC?
    - 7y ago
HugoDaniel 7y ago
Should be ok, after all they dont keep any logs right ?
- LeonM 7y ago
  NordVPN doesn't (or so they claim), but the hacker may have been logging activity.
some_furry 7y ago
If you're reading this and wondering which VPN service you should use to stay safe, start reading here: https://faq.dhol.es/@Soatok/cryptography/which-vpn-service-will-protect-me-from-hackers https://faq.dhol.es/@Soatok/cryptography/which-vpn-service-w... (Spoiler: You're asking yourself the wrong question.)
- KirinDave 7y ago
  You shouldn't have buried the lede.You should have just said, "Here is a link on why commercial VPNs are a honeypot and bad privacy."
- tejohnso 7y ago
  Why does the linked suggestion say "Don't use an Android phone, use an iPhone instead."
  - some_furry 7y ago
    Ask tptacek and idlewords?
chickenpotpie 7y ago
This is so well timed, I just bought a 3-year subscription to NordVPN and they have a 30 day refund policy.
- dagurp 7y ago
  So did I, 33 days ago :/
- KirinDave 7y ago
  You should probably ask for a refund, then set up your own VPN. Commerical VPNs are, for the vast majority of cases, simply not a good bet for your privacy. You're changing your network traffic path from a diffuse and byzantine series of paths to once centralized collection point. The payoff for an attack on a VPN rises very quickly. Meanwhile, you're also conditioning yourself to say, "My traffic is secure while my VPN is on." It's not a great combo.
  - chickenpotpie 7y ago
    I thinking about spinning up a Digital Ocean droplet and rolling my own right now
    - babayega2 7y ago
      Absolutely. Look for project Streisand.
    - leevlad 7y ago
      I'd keep in mind that cloud providers have well-known IP blocks that can sometimes be rate-limited by various internet sites/services, primarily to combat botting. You might inadvertently get caught in the IP range that's being actively rate limited by e.g. Instagram. YMMV.
    - ignoramous 7y ago
      https://vultr.com https://vultr.com might provide more bang for the buck at $2.50 a month for 500GB in bandwidth.
fauigerzigerk 7y ago
>NordVPN said it found out about the breach a “few months ago,” but the spokesperson said the breach was not disclosed until today because the company wanted to be “100% sure that each component within our infrastructure is secure.” So instead of allowing their customers to do their own damage limitation, they left their customers in the dark and continued to expose them to a breach they weren't sure they had fully contained. I wonder when that sort of thing will become a criminal offence.
- entropicdrifter 7y ago
  Yeah, that sounds like flagrant incompetence
  - protonimitate 7y ago
    Calling it incompetence lets them off the hook I think. This was a deliberate choice to keep customers in the dark, which is worse IMO.
    - astine 7y ago
      Yeah, the word for this is 'negligence'. Sounds like someone should get sued at the very least.
- digitalengineer 7y ago
  Within 72 hours According to GDPR I thought? “ The GDPR introduces a duty on all organisations to report certain types of personal data breach to the relevant supervisory authority. You must do this within 72 hours of becoming aware of the breach, where feasible.” https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/personal-data-breaches/ https://ico.org.uk/for-organisations/guide-to-data-protectio...
  - eterm 7y ago
    Maybe NordVPN would argue personal data wasn't breached? It's a bad look in any case.
kryogen1c 7y ago
The interesting thing about OOB on most modern servers is that its a separate, physical NIC. Not only is that easily VLAN able, a more security conscious datacenter could even air-gap the out of band LAN!
- pm7 7y ago
  > The interesting thing about OOB on most modern servers is that its a separate, physical NIC. Not only is that easily VLAN able On lower grade servers OOB is using main NIC. It's still possible (in all implementation I have seen, which is not too many) to have OOB in VLAN. > a more security conscious datacenter could even air-gap the out of band LAN! 1. If you air-gap remote management, you take away it's function. 2. It's not possible to truly air-gap OOB if servers with OOB are not air-gapped (it's theoretically possible to use server to get into OOB network by exploiting/flashing custom OOB from OS).
inian 7y ago
https://nordvpn.com/blog/official-response-datacenter-breach/ https://nordvpn.com/blog/official-response-datacenter-breach...
throwaway_nord 7y ago
Why would their website's SSL certificate be on one of their VPN servers? Do all of their current 3000 servers have the private key for their website right now?
- Snawoot 7y ago
  OpenVPN CA key also leaked: https://gist.githubusercontent.com/Snawoot/85f77356e229d77aa36f16059a629eea/raw/e4e4af26e4c411d32bbc6bd3ba26301c2ae074bd/nordvpn.txt https://gist.githubusercontent.com/Snawoot/85f77356e229d77aa...
  - pram 7y ago
    oof
saurik 7y ago
This is difficult to track, as it is really just a sentence attached to some screenshots, with some commentary but no technical detail... but this seem to be a website key, not an OpenVPN key? (edit: And, in fact, this is confirmed by NordVPN's statements on the matter: "The expired TLS key was taken at the same time the datacenter was exploited. However, the key couldn’t possibly have been used to decrypt the VPN traffic of any other server. On the same note, the only possible way to abuse website traffic was by performing a personalized and complicated MiTM attack to intercept a single connection that tried to access nordvpn.com.")
FillardMillmore 7y ago
I can't help but notice that NordVPN is one of the most heavily advertised VPNs from what I've seen (which raises the question, as one researcher pointed out in the article - are they not spending enough money on their security and infrastructure to protect their users?). They are claiming that: "no-one could know about an undisclosed remote management system left by the [data center] provider". Apparently the hacker was able to find out - so while it may be unknown, it's not an impossibility to detect it. Beyond whether or not sensitive information was accessed, what will NordVPN do in the future to eliminate or mitigate the possibility that this will occur again?
- apecat 7y ago
  I find NordVPN's marketing reprehensible. Too many claims and broad strokes about the "anonymity" their service can provide. While I certainly would recommend that US consumers use a VPN router to prevent their ISP from selling data, I think NordVPN really overplays the role of changing IP addresses in the age of browser fingerprinting.
  - sushid 7y ago
    They’re also not based in a Nordic country, which I find misleading.
    - jen_h 7y ago
      For awhile, my brain conflated it with [OpenVPN-NL](https://openvpn.fox-it.com/about.html https://openvpn.fox-it.com/about.html), a publicly-available, hardened version of OpenVPN used by the Dutch government. You can't really blame NordVPN for that (I mean, the Netherlands aren't even a Nordic country, my brain is just broken), but it's a data point.
    - krn 7y ago
      > They’re also not based in a Nordic country, which I find misleading. Ironically, Lithuania is a part of Northern Europe, but because of the data retention laws they have to pretend that they are based somewhere else[1]. [1] https://vpnscam.com/wp-content/uploads/2018/08/2018-08-24-09_09_14-Window.png https://vpnscam.com/wp-content/uploads/2018/08/2018-08-24-09...
teslaberry 7y ago
What if nord vpn is a government operation? Why wouldnt it be?
pickle-wizard 7y ago
I only use NordVPN to get around GeoIP blocks on a couple of streaming apps. So I'm not too worried about my data being compromised, but I don't like the way they handled this. Think I'll start looking for another provider? Looks like you can side load OpenVPN onto a FireTV. Maybe I'll go the roll my own this time.
numlock86 7y ago
Maybe they should spend more money on security than throw at people like PewDiePie to advertise them ... by also giving false claims like protecting you from hackers and making you magically "secure", whatever that's supposed to mean. Doesn't give the impression they know what a VPN actually is. Considering that most likely the phrasing comes from NordVPN themselves I always questioned them as a whole. Good to have some positive feedback (from my point of view) on that now.
misiti3780 7y ago
Off topic a bit, what what other VPNs are people using. I have been using ExpressVPN and am very happy with it.
- computerex 7y ago
  Torguard for me, relatively happy with it. Also hideMe was very good too.
  - bugbug99 7y ago
    Per OP article Torguard was hacked to
    - computerex 7y ago
      Torguard is contesting the extent of their breach: https://torguard.net/blog/why-torguards-network-is-secure-after-an-isolated-2017-server-breach/ https://torguard.net/blog/why-torguards-network-is-secure-af...
- smush 7y ago
  Private Internet Access. They should rename to Premier VPN since that is what level of service they provide.
weinzierl 7y ago
Apart from deanonymizing customers and potentially reading the traffic of customers they sent over the VPN what are other risks for customers? What I'm thinking about is that the VPN essentially tunnels through my firewall so a malicious VPN provider may possibly be able to do things that, for example, an arbitrary web server cannot.
trigger89 7y ago
"On the same note, the only possible way to abuse the website traffic was by performing a personalized and complicated man-in-the-middle attack to intercept a single connection that tried to access NordVPN." If I had root, can't I just find out what crypto libraries are in use? and trigger an uprobe to decrypt the traffic on that crypto library ? Every user connection handled by that vpn server would have been plain text for me. I think they are downplaying the importance of this hack
phantom_oracle 7y ago
There's a bittersweet irony with this story. They were recently pushing ads claiming that "Ain't no hacker can steal your online life. (If you use VPN)." The ad has since been deleted :D
1000units 7y ago
This is a feature in my eyes. Just stack a bunch of these hacked by different people who don't cooperate with each other. Now any user has plausible deniability over anything that happens on these networks. No?
jedisct1 7y ago
Get a VPS and run your own VPN. It doesn't have to be complicated: https://github.com/jedisct1/dsvpn https://github.com/jedisct1/dsvpn
mikuru 7y ago
Its nesesary to eari in omega
eicossa 7y ago
I remember last week's episode on Darknet Diaries where NordVPN was offering 3y plans for a hefty discount. My first reaction was "Are they going out of business ?" This week's news lets me make sense of that ad.
generalpass 7y ago
I'm frankly blown away that the comments I'm seeing here don't suggest to just roll your own. $5/mo is the typical price nowadays for a 1 GB VPS with 1TB upload. Cancel at any time. Save image, redeploy monthly/weekly/daily to protect from longer term IP address tracking. Use scheme of your choice (e.g., SOCKS proxy, VPN, standard HTTP port for everything, etc.)
rikkipitt 7y ago
Two days ago I deleted my old Digital Ocean VPN (built using the OpenVPN tutorial I found somewhere), then opted for a discounted 3-year NordVPN plan. Looks like I'm going to have to ask for a refund. facepalm.
safeplanet-fesa 7y ago
What about the data-mining and selling infrastructure of NordVPN, known as Tesonet? Are those intact? Also interesting to know how their legal departments are doing, such as the Panamanian shell and the Lithuanian headquarters. http://vpnscam.com/wp-content/uploads/2018/08/2018-08-24-09_09_14-Window.png http://vpnscam.com/wp-content/uploads/2018/08/2018-08-24-09_... http://vpnscam.com/hola-vpn-and-nordvpn-partners-in-data-mining-bot-network/ http://vpnscam.com/hola-vpn-and-nordvpn-partners-in-data-min... http://vpnscam.com/nordvpn-protonvpn-proton-mail-owned-by-tesonet-ceo-darius-bereika/ http://vpnscam.com/nordvpn-protonvpn-proton-mail-owned-by-te...
- soulofmischief 7y ago
  Thanks for sharing these. I was familiar with the Protonmail business but did not know this all connected to a bigger picture. I never trusted NordVPN... they spent way too much money on advertising and snake oil advertising at that, focusing on meaningless numbers and distractions. Hopefully you don't have similar news to share about Mullvad...
  - dmm 7y ago
    The claims about ProtonVPN have been disproven.
    - hosteur 7y ago
      Source ?
      - itchynosedev 7y ago
        As a ProtonMail client I’d like to see that myth busted too.
        protonmail 7y ago
        There's a couple ways to look at this. On one hand, there's an anonymous website and hundreds of Twitter bots pushing a story that is demonstratively false (just check public records). Then, on the other hand, you have Mozilla and the EU (which has access to all European corporate records) vouching for Proton (since they partially fund Proton). We also operate in a highly transparent way, so all information debunking this is actually in public record, details here: https://protonvpn.com/blog/is-protonvpn-trustworthy/ https://protonvpn.com/blog/is-protonvpn-trustworthy/ Proton definitely has an office and subsidiary in Vilnius, it's not a secret because it's on Instagram: https://www.instagram.com/p/BxMz62oHb6K/ https://www.instagram.com/p/BxMz62oHb6K/ The office is inside a 30 storey building, so it is not surprising the address is shared with quite a few other companies. But that doesn't mean Proton on a whole is based in Vilnius. The people spreading the false information are also falsely implying that Proton's subsidiary controls the Swiss parent company, which is never the case as it's always the other way around (parent controls the subsidiary). And its super easy to disprove because unlike most companies in the VPN space, the directors of Proton's Swiss parent company are in public record, and are all well known people who have been in the public eye for years (e.g. at TED: https://www.ted.com/talks/andy_yen_think_your_email_s_private_think_again?language=en https://www.ted.com/talks/andy_yen_think_your_email_s_privat...)
yjftsjthsd-h 7y ago
@dang or mods - I'm surprised that this isn't merged with https://news.ycombinator.com/item?id=21311475 https://news.ycombinator.com/item?id=21311475 ; is there some special value in keeping them separate?
- dang 7y ago
  No, we just hadn't seen it yet. They're merged now. If you want to let us know about something, it's best to email hn@ycombinator.com. We don't see all the comments—I only saw this one by accident—but we do see all the emails. (Well, except possibly a few that go into spam. We comb through the spam folder and rescue most, but a few with unfortunate subject lines probably get missed.)
  - yjftsjthsd-h 7y ago
    Thanks and noted. I sorta assumed that you had an alert on "@dang" or "@mods" or so, but I will keep that in mind in the future.
crispyambulance 7y ago
People have been talking about using VPN's because of "dangerous" public wifi, but I have to admit, I don't understand the risks. Let's say you go to a coffee house and sign-in to their wifi with their password and use it browse https websites, like gmail or you favorite social media... what's the main risk? What can happen? What does happen?
- pram 7y ago
  The primary concern is MITM attacks I'd presume.
  - xvector 7y ago
    OP specified HTTPS, so MITM is a non-issue. DNS leakage maybe?
- wppick 7y ago
  DNS spoofing is one I think. You request mybankwebsite.com and end up entering you login info on mybankwebslte.com
Angeo34 7y ago
>trusting companies outside of EU jurisdiction Literally your own fault
- ju-st 7y ago
  Or trusting companies only known because of extensive marketing.
TazeTSchnitzel 7y ago
From the amazing service providing “Double VPN” (yes, really) for extra privacy and “Onion VPN” (with the Tor bit being behind NordVPN, not the other way around) for ultra extra privacy!
- xvector 7y ago
  > with the Tor bit being behind NordVPN, not the other way around This is so dumb that I'm not sure if it's an inside joke or not. (Looking at you, ProtonVPN.)
  - protonmail 7y ago
    We are pretty clear though that Tor over VPN is for convenience and not necessarily more security or privacy, depending on your threat model.
meh206 7y ago
Security has never been priority for any of these public VPN providers.
Attained 7y ago
Just use Cloudflare WARP since it's finally out. You're never really anymous unless it's a lifestyle anyways.
codesushi42 7y ago
This is the last time I trust a product endorsement from the Angry Videogame Nerd.
ineedasername 7y ago
"no-one could know about an undisclosed remote management system left by the [data center] provider" Why not? I'm generally familiar with the services offered by dedicated-server/co-lo/vps providers, and remote management systems are very common. This includes out-of-band (OOB) access when using dedicated systems. Seems like the sort of thing that solid due diligence would pick up. Even if it's completely undocumented, designing a robust security checklist to be completed by the vendor should find this sort of thing. This excuse also makes NordVPN look extremely bad for future use: If you say "nobody could have known" then you're also saying "it could happen again" because if you can't know about it, you can't know if other vendors do the same. If you can stop it from happening in the future by implementing additional measures, that means those additional measures could have been used to prevent it the first time. So either you're inherently unsecure, or the issue was preventable.
goshx 7y ago
This is called karma. People have been using their services to run cyberattacks and NordVPN people do NOTHING to stop them. This news brings me joy.
sellingwebsite 7y ago
How feasible is to run and administer your own VPN in cloud ?
therealmarv 7y ago
Any one knows WHICH server provider in Finland caused this? Just following the chain because NordVPN says it was this provider who does not told about their security leak?
- willstrafach 7y ago
  Oy Creanova Hosting Solutions Ltd.
ga-vu 7y ago
NordVPN blog post, and the source: https://nordvpn.com/blog/official-response-datacenter-breach/ https://nordvpn.com/blog/official-response-datacenter-breach...
john_alan 7y ago
NordVPN subscriber here, I just use DSVPN now. Simple and works.
discordance 7y ago
NordVPN runs a desktop app with escalated local privileges. Surely if they were compromised that would be the attack vector for a bad actor.
kbenson 7y ago
This sounds suspiciously like the Supermicro BMC bug reported here a while back[1], and while it actually can be hard to make sure the IPMI stuff doesn't take over a NIC you don't want it to[2], there are things you can do to prevent that, such as explicitly setting IPMI interface and address information so it won't use "smart" behavior to negate all your security. As to whether "no-one could know", well, I knew after I read that HN submission, and at work we made sure to double check all our configs. This ended up being mostly a known problem, but the extra context helped us find another edge case I believe. It's not great that you have to be aware of the latest security problems and how they may interact in obscure ways with system configs, but that's the nature of security and state of the industry right. Not much to do except buckle down and pay attention. To everything. 1: https://news.ycombinator.com/item?id=20870686 https://news.ycombinator.com/item?id=20870686 2: https://news.ycombinator.com/item?id=20872084 https://news.ycombinator.com/item?id=20872084
catoc 7y ago
Any comments about Encrypt.me as a NordVPN alternative? It looks much more reliable. (from their website; the team's CV's; etc -> i.e.: no hard evidence)
lmaophp 7y ago
Lmao
dlphn___xyz 7y ago
what can a paid vpn service provide that you couldn’t get with free / open source tools?
kebman 7y ago
"It's an older code, but it checks out." :D Sorry, I just couldn't help myself!
knolax 7y ago
Wasn't NordVPN the one that was created by a marketeer? I wouldn't be suprised if this was just cover for them to sell their customer's data indirectly. If anybody finds a dump of the data they sold they could just claim it was from the breach.
badrabbit 7y ago
ProtonVPN uses Nord servers infrastructure right? Were they affected?
- protonmail 7y ago
  No, that is not true. We run our own infrastructure for ProtonVPN and also own the hardware for our core servers: https://protonvpn.com/support/secure-core-vpn/ https://protonvpn.com/support/secure-core-vpn/ This can be verified by inspecting our VPN endpoints which are all public. We have no connection with Nord or any other VPN. ProtonVPN is however owned and operated by ProtonMail, with some support from the European Union.
  - badrabbit 7y ago
    Cheers, glad you cleared that up. I must have gotten bad info. Love all your services!
    - protonmail 7y ago
      No worries. Transparency is important to us so we're always happy to answer questions.
gerdesj 7y ago
There are quite a lot of anti NordVPN and VPN in general experts pontificating here. A quick scroll down through all comments and I note a distinct lack of green handles. This is a 500+ comment article with hardly any near null comment commentards. My analysis is not very rigorous.
jbillow2000 7y ago
Wonder if there will be a class action.
HNLurker2 7y ago
ROFL at the ads
craftoman 7y ago
Could this be another marketing trick to lure more customers? Last time I checked, companies are actually favourable when they "get slightly hacked". They get front page from top tech websites, magazines, forums...
eyegor 7y ago
What this article is missing is that the hackers had root access and had NordVPNs private key for their HTTPS cert for several months in 2018. This went undetected for months and they're only now publically admitting what happened due to press attention. Their public response seems to be "it's not a big deal guys, mitm is hard". > The key wasn't set to expire until October 2018, some seven months after the March 2018 breach https://crt.sh/?id=10031443 https://crt.sh/?id=10031443 And here's a dump of their logs: https://share.dmca.gripe/hZYMaB8oF96FvArZ.txt https://share.dmca.gripe/hZYMaB8oF96FvArZ.txt
- stebann 7y ago
  Why isn't anybody in journalism publishing this? Really, they're scammers!
samwhiteUK 7y ago
So what does this mean for an every day consumer? I had been debating using the 30-day money back guarantee as I realised I didn't use it as much as I thought I would. I want to stay protected on public Wifi. Added anonymity occasionally would be good too, as well as accessing US Netflix from here in the UK. Now my 30 days is up. What would be the best course of action? Should I email and say that I'm not comfortable being their customer any more, and asked to be reimbursed? Carry on, for my use case? I'd never connected to a Finnish server.
- g4d 7y ago
  It's so hard to understand what is correct (I'm aware this is a problem with every news story) between the people telling me that they're almost certainly evil, keeping logs and selling data and those that are telling me that it's a smear campaign by the competing VPN providers. My gut tells me that the level of advertising and incredibly low prices is too good to be true... Now with this hack it's the same problem, how bad is it, does it affect me and should i be concerned?
ty7yt 7y ago
nord vpn will sell out. i happen to know this for a fact. same as any other big company. think how many times facebook has said sorry over the past 10 years. just the same with vpn providers. your best bet is tor, and even then just use it for privacy reasons, not illegal ones.
hemant6488 7y ago
can't get hacked if you don't use a VPN. I use sshuttle (https://www.terminalbytes.com/sshuttle-vpn-over-ssh-vpn-alternative/ https://www.terminalbytes.com/sshuttle-vpn-over-ssh-vpn-alte...).
Digg_mov 7y ago
what TechCrunch is hacked????
joezhai 7y ago
I am concerned most about one thing: When can the VPN defeat China's Firewall?
abbadadda 7y ago
Did NordVPN know about this hack when they were offering their deal for something like $88 for 3 years? I went back and looked at their prices from 2017 and it was something like $69 to $83.99 billed annually (https://www.pcworld.com/article/3200777/nordvpn-vpn-review.html https://www.pcworld.com/article/3200777/nordvpn-vpn-review.h...). I've been a NordVPN customer for a while but have been thinking of switching due to some articles touching on nefarious marketing practices and/or questionable data practices. Then I see this deal for $88 for 3 years and it was tempting to re-up. Coincidentally, when the deal ran out the news broke several days later about the hack. I for one will be finding a new VPN provider, but I can't help to think they were trying to rope in as many existing customers as possible before news of the hack broke. Suspect at best.
kjjknnkn 7y ago
okn

1368 points by afshinmeh 7y ago

ngcc_hk 7y ago

Wow. Just switch per advice of lihkg! How serious? Seems all tech talk but not impact talk

donkeyd 7y ago
> How serious? From my understanding, that really depends what you're using it for. My friends mostly use Nord to get around region locks for Netflix etc. I think impact for them is minimal. If you were using NordVPN in Hong Kong, to cover your involvement in the protests, then it could be a lot more serious. I wouldn't use Nord (or any comparable provider) for that anyway, since their holdings tend to be pretty opaque. That doesn't mean nobody did use it for stuff like that though.
- Bartweiss 7y ago
  I see the Twitter thread mentions: > And someone just mentioned to me that past encrypted sessions may be able to be decrypted, which is a much bigger issue!...I haven't researched enough about OpenVPN to know if it's using forward secrecy, though you'd hope so Any idea where that claim is coming from? Nord's site mentions having forward secrecy in place, so presumably most historical stuff is safe unless they botched that. Of course, somebody in e.g. Hong Kong could still have gotten a MitM attack if they were active while these keys were being used, which is reason enough to worry about exposure.

AdmiralAsshat 7y ago

https://twitter.com/hexdefined/status/1186214904132300800 https://twitter.com/hexdefined/status/1186214904132300800 The thread indicates that VikingVPN and Torguard were also compromised at some point. Highly concerning.

Sir_Cmpwn 7y ago

NordVPN is being recommended a lot to people who don't know better by influencers on social media, especially on YouTube. This kind of endorsement is recklessly negligent and needs to stop. https://drewdevault.com/2019/04/19/Your-VPN-is-a-serious-choice.html https://drewdevault.com/2019/04/19/Your-VPN-is-a-serious-cho... Edit: note that I don't blame these influencers for their ignorance on the risks of using a VPN; rather I blame the shady VPN providers for overselling the security value of their product and leading users into a false sense of security.

Mirioron 7y ago
I'm pretty sure they're "recommending" it because they're getting paid for it - it's a sponsor segment. After demonetization became common YouTubers looked for other sources of revenue and there are rather few companies that try to contact them directly for ads, so you see them appear over and over again.
- tokai 7y ago
  Yeah it's diffidently not being recommended, it is being advertised. I wonder how many money they have spend. Every freaking channel mention them at some point.
  - Nextgrid 7y ago
    You start to wonder where their money is coming from - their retail prices are already cheap, the discounts the influencers offer make it basically free. How's that sustainable?
    - tokai 7y ago
      No idea. Yesterday I saw a discount with an extremely cheap 3-year plan (under 30$ and no data limit, iirc). The price didn't offer confidence that the service would be available for all three years.
    - Mirioron 7y ago

mdorazio 7y ago

Someone is probably going to ask what other HN users recommend as an alternative. Personally, I use Private Internet Access because they're the only provider I've found with a track record of demonstrably not being able to turn your records over to someone asking for them [1]. [1] https://torrentfreak.com/private-internet-access-no-logging-claims-proven-true-again-in-court-180606/ https://torrentfreak.com/private-internet-access-no-logging-...

tmikaeld 7y ago
Yeah, they have been around for a very long time too. Used to be the more expensive alternative though, glad to see their prices have fallen a bit.
FactolSarin 7y ago
EDIT: I said I used IPVanish mostly because the EFF endorsed them, but someone pointed out below they got caught logging. I suppose that would explain why they're not endorsed on the EFF VPN page anymore. So, I guess time to find a new VPN. :(
- rasengan 7y ago
  IPVanish was caught logging while claiming they didn’t log [1]. [1] https://torrentfreak.com/ipvanish-no-logging-vpn-led-homeland-security-to-comcast-user-180505/ https://torrentfreak.com/ipvanish-no-logging-vpn-led-homelan...
  - FactolSarin 7y ago
    Ugh. Good to know, thanks.
- WhoIsSatoshi 7y ago
  Used IPVanish for a few years, it was great the first, sucked the 2nd. I switched. These days I use VyprVPN. I like their Chameleon encryption that hides the VPN (although some data still leaks and some sites still detect it) and the killswitch option (prevents connections out if VPN not active)

clSTophEjUdRanu 7y ago

I like Mullvad

iaml 7y ago
Mullvad is a decent option, they have openvpn based app and wireguard profiles. Didn’t have any connectivity issues either.
elliekelly 7y ago
I’ll second this. They also allow you to pay in cash which I think is an aspect of privacy that a lot of VPNs overlook.

tmikaeld 7y ago

It's odd that NordVPN, VikingVPN and Torguard all got their private keys leaked here. - Did the hackers use an SSH or a VPN service vulnerability? - Or maybe even a previously unknown vulnerability? - Was SSH access firewalled? If not, why? - Do they still have root access?

ganoushoreilly 7y ago
A lot of them shared physical infrastructure definitely less odd that multiple were breached at same time.
- swiley 7y ago
  I was just thinking yesterday that people might be overly paranoid about that, I’ve always agreed that if security were important you shouldn’t share space but lately I’ve begun to question it since a lot of these data centers are pretty carefully controlled. I’m glad I didn’t speak my mind on that I guess since I was wrong.
FDSGSG 7y ago
>It's odd that NordVPN, VikingVPN and Torguard all got their private keys leaked here. Good reminder to set up FDE and not give your host logins for your servers. Unexpected reboots are rare enough that they're worth switching hosts over.
- tmikaeld 7y ago
  For dedicated servers this would work, especially for VPN where data-loss is "acceptable". But if it where based on containers like LXC or OpenVZ, then the host can force root access via a command without even changing the root password of the container.
  - pm7 7y ago
    I doubt serious VPN provider are using LXC/OpenVZ containers. They don't even work with OpenVPN without special setup from provider, I don't know how about other protocols.

metalliqaz 7y ago

A while ago I read that there was a potential smear war going on between some of the larger VPN providers. Is there any chance that this is related? (I'd prefer more than just a tweet)

justicz 7y ago

If you care less about the pseudo-anonymous-but-not-really shared-IP aspect of using a VPN, and care more about the this-lan-is-sketchy use case, I have had good experiences with Algo [0]. You can just paste in an API key and spin up your own VPN on something like DigitalOcean. And it uses WireGuard! [0] https://github.com/trailofbits/algo https://github.com/trailofbits/algo

Diederich 7y ago
I was getting ready to paste the same thing; the command-line instructions make Algo, effectively, a somewhat technical solution, but it really does just work. And for those who have used various VPN solutions over the years but not Wireguard: it really is pretty magic. It Just Works, with fantastic performance.
tmikaeld 7y ago
There's also Streisand[0], that gives a lot more options. [0] https://github.com/StreisandEffect/streisand https://github.com/StreisandEffect/streisand
- zigzaggy 7y ago
  Came here to post this. I’ve been using streisand for a long time with no problems. I’ve given out logins to a few trusted friends / colleagues and all have had good experiences as far as I know. Plus I really enjoyed learning about the in’s and outs of setting it up. I poke around in the VM just for giggles.
- mbesto 7y ago
  Ive done this but have found that most services (Netflix, etc) recognize DO as a VPN. Does anyone know of a hosting provider that isn't blacklisted but I can still setup wireguard on?
  - sdan 7y ago
    Run it on https://1984hosting.com https://1984hosting.com. I've heard it's good although I can't attest personally.

sudoaza 7y ago

More worrisome is that this may allow old cptures to be decrypted, anyone know of VPN providers that use PFS?

rasengan 7y ago
Private Internet Access is PFS (using DHE - Diffie Hellman Ephemeral).

Liquix 7y ago

Nord (and perhaps others) seem to have been compromised for months/years - lifetime accounts have been available on the DN for significantly cheaper than other VPNs: https://news.ycombinator.com/item?id=20094946 https://news.ycombinator.com/item?id=20094946 Doesn't seem like a smear - glad this is coming to light.

SlowRobotAhead 7y ago
Nord specifically has a retailer system, I wonder if accounts can be created 3rd party and sold greymarket like that without any nefarious hacking scandals?
NilsIRL 7y ago
It's more that their users got hacked.

_-___________-_ 7y ago

I don't understand the obsession with VPN providers. Funneling all your Internet access through a single entity no matter where you connect from just seems like a fundamentally bad idea to me, especially if that entity's business is getting people to funnel all their traffic through, making them a juicy target for governments or hackers.

steveeq1 7y ago
Because for certain types of things, like pirating movies, it's good enough.
- _-___________-_ 7y ago
  It seems a bit strange to me that you'd want to hide your movie pirating from your ISP but are happy for your VPN provider to know about it.
  - sixothree 7y ago
    I think it is more of a matter of hiding your local ip address from other torrent users.
    - _-___________-_ 7y ago
      What's the purpose of that? Genuine question, I'm trying to understand the threat model of another torrent user seeing the IP address that is currently allocated to your router. Is this related to those letters that people sometimes get sent threatening legal action for torrenting?
      - sixothree 7y ago
        quite simply evading copyright strikes or legal filings. I don't know which providers still disconnect your internet after 3 strikes. But I am guessing that's the "threat" here.
  - 7y ago

rikkipitt 7y ago

NordVPN just posted this a few minutes ago: https://nordvpn.com/blog/official-response-datacenter-breach/ https://nordvpn.com/blog/official-response-datacenter-breach...

haolez 7y ago
I'm curious about who this cloud provider might be.
- spoopyskelly 7y ago
  The local IP for the OpenVPN endpoint (185.212.149.9 listed in the gist) belongs to creanova.org since 2017.
jwilk 7y ago
They wrote: > We […] started creating a process to move all of our servers to RAM, which is to be completed next year. What does "RAM" mean here?
- Faaak 7y ago
  I guess that all decryption keys are on ram. If the power is disconnected, then it would need a manual intervention to re-decrypt the data
- willstrafach 7y ago
  Likely booting the OS from a RAM-disk and mounting as read-only.
mzs 7y ago
NordVPN is down, also looks like VikingVPN and TorGuard were affected as well: https://twitter.com/cryptostorm_is/status/1186097950327476224 https://twitter.com/cryptostorm_is/status/118609795032747622...
- Matthias1 7y ago

charles_f 7y ago

I guess it depends what you want from your VPN. When I want to secure a shady connection in a coffee house, I have a raspberry 3 at home that I use only for that purpose with an openVpn setup with https://www.pivpn.io/ https://www.pivpn.io/ - super easy to use. Downside, I rely on my isp not to spy on me. Upside, it's mine and unless I'm specifically targeted it's unlikely someone will mitm me. To hide my location for various purposes, I have used TigerVPN. They have been reliable so far, but I wouldn't trust entirely any third party when it comes to privacy. Upside - somewhat reliable and not my isp. Downside - for all I know someone in Czech Republic is watching what I stream with a bucket of popcorn

arshbot 7y ago

Lots of talk here from highly technical folks but not one person brings up the fact that these are expired keys - as in not usable? I understand that the fact that these keys were obtained is concerning but the security of nord and etc prevailed at the end of the day. The question is: were they leaked before they expired or long after?

esnard 7y ago
They were leaked on March 2018 [0][1], and they expired on October 2018 [2]. [0] https://web.archive.org/web/20180504001844/https://8ch.net/b/res/7948898.html https://web.archive.org/web/20180504001844/https://8ch.net/b... [1] https://nordvpn.com/fr/blog/official-response-datacenter-breach/ https://nordvpn.com/fr/blog/official-response-datacenter-bre... [2] https://crt.sh/?id=10031443 https://crt.sh/?id=10031443
- arshbot 7y ago
  > However, the key couldn’t possibly have been used to decrypt the VPN traffic of any other server. On the same note, the only possible way to abuse website traffic was by performing a personalized and complicated MiTM attack to intercept a single connection that tried to access nordvpn.com. However crt.sh shows > Validity > Not Before: Oct 6 12:53:38 2015 GMT > Not After : Oct 6 12:53:38 2018 GMT What exactly were these keys for if they were only usable in such a manner according to nord?
  - wswope 7y ago
    Nord has a couple thousand severs, and each has their own key. In order to decrypt traffic, you'd have to intercept some traffic to decrypt, which would require a MitM attack unless you're an ISP/state actor.
thenewnewguy 7y ago
Depending on the web server configuration they could be used to decrypt past traffic.

Talentener 7y ago

I've just read the official statement and it seems that the data center was compromised, not the VPN traffic, it wasn't affected by this

godelmachine 7y ago

This is troublesome. I was planning to eke out $85/ annum and go for NordVPN, but now even this is unreliable

readhn 7y ago
Im using PIA for 2 years now - pretty happy with the service.
- majora2007 7y ago
  Yeah been on PIA myself for 5 years. Amazing speeds and service. No issues at all and they have been in court twice where they showed they have no logs.
  - readhn 7y ago
    Its great - i use it on my work PC to reroute my personal traffic, on my families personal devices, when traveling abroad etc. That said, there is a no 100% guarantee so use it responsibly.
- qertoip 7y ago
  It's based in US.
  - readhn 7y ago
    So am I.
rf15 7y ago
Except this isn't their fault because their infrastructure provider messed up and didn't even disclose this possible backdoor. If anyone the provider should be named and shamed, not NVPN.
- hellcow 7y ago
  > NordVPN said it found out about the breach a “few months ago,” but the spokesperson said the breach was not disclosed until today because the company wanted to be “100% sure that each component within our infrastructure is secure.” Not acceptable.

SimeVidas 7y ago

The best thing NordVPN can do right now is make a statement that clearly and honestly describes how its users are affected. No bullshit marketing language, no trying to hide facts, just a short and simple explanation of what this means for users and what they should do next.

uniformlyrandom 7y ago
Linked article says: > “The server itself did not contain any user activity logs; none of our applications send user-created credentials for authentication, so usernames and passwords couldn’t have been intercepted either,” said the spokesperson. “On the same note, the only possible way to abuse the website traffic was by performing a personalized and complicated man-in-the-middle attack to intercept a single connection that tried to access NordVPN.” > According to the spokesperson, the expired private key could not have been used to decrypt the VPN traffic on any other server. > NordVPN said it found out about the breach a “few months ago,” but the spokesperson said the breach was not disclosed until today because the company wanted to be “100% sure that each component within our infrastructure is secure.”
- SimeVidas 7y ago
  If I were a NordVPN customer, these quotes would not give me confidence that my traffic wasn’t exposed.
- Snawoot 7y ago
  > According to the spokesperson, the expired private key could not have been used to decrypt the VPN traffic on any other server. It's simply not true. Their CA private key which is used to issue certificates for ALL servers also leaked along with RADIUS key which is used to secure EAP session [1]. They DO hide facts. [1] https://gist.githubusercontent.com/Snawoot/85f77356e229d77aa36f16059a629eea/raw/e4e4af26e4c411d32bbc6bd3ba26301c2ae074bd/nordvpn.txt https://gist.githubusercontent.com/Snawoot/85f77356e229d77aa...
readhn 7y ago
Truth is - if hackers did a MIM attack and collected a bunch user traffic (for how long?) they could have everything.. banking info, emails, logins... at this point if i was a user of that VPN service - i'd be replacing all of my sensitive passwords, secret questions/answers to key accounts.

CiPHPerCoder 7y ago

This is always topical: Don't use VPN Services https://gist.github.com/joepie91/5a9909939e6ce7d09e29 https://gist.github.com/joepie91/5a9909939e6ce7d09e29

crazydoggers 7y ago
The article is slightly more nuanced... know when and why to use VPN is more accurate. As mentioned near the end of that article, using known or suspected hostile networks, like public WiFi is a good reason to use VPN.
- Spooky23 7y ago
  The problems addressed by avoiding a locally hostile network by connecting to another, globally hostile network is solving a very limited, nuanced set of problems. Unless you're VPNing to your home or office, these public providers are just asking for trouble. They're too cheap to run well.
  - crazydoggers 7y ago
    Yes, you can run your own VPN... that’s a great solution. Also public WiFi attracts low hanging fruit sort of exploits. Incentives for the VPN company that already makes money, to actively hack and exploit your machine are significantly less. It’s not a privacy issue, it’s a security issue.
malux85 7y ago
"Dont use VPN services" then at the bottom: So then, what? THIS TYPE OF VPN
- bildung 7y ago
  Which is not a service, but a self-hosted open source solution.
  - 7y ago

jwilk 7y ago

See also: https://news.ycombinator.com/item?id=21311475 https://news.ycombinator.com/item?id=21311475

LennyWhiteJr 7y ago

> The attacker gained access to the server — which had been active for about a month — by exploiting an insecure remote management system left by the datacenter provider, which NordVPN said it was unaware that such a system existed. This screams for clarification and I'd love for someone more knowledgeable in the area to elaborate on it. Is this common practice for data-center providers? Do I now not only have to worry about my own infrastructure security but also worry that my IaaS provider hasn't installed some backdoor to my servers?

CiPHPerCoder 7y ago
Sounds like an iDRAC exploit (assuming Dell servers). But, yes, remote management is pretty common in datacenters. The fact that NordVPN wasn't aware of them just shows incompetence.
- lucb1e 7y ago
  Depends on what kind. In case of idrac, yes; but it's weird that it was insecure by default in the first place. Usually credentials are configured and provided to the customer. Makes me think there might have been some other interface. Clarification is definitely needed.
  - CiPHPerCoder 7y ago
    It could have been something like https://www.zdnet.com/article/vulnerabilities-found-in-the-remote-management-interface-of-supermicro-servers https://www.zdnet.com/article/vulnerabilities-found-in-the-r... There were many IPMI/iDRAC/etc. exploits published in the past few years. Throw a dart at a list of them, and you'll probably find one that was unpatched in most systems as of March 2018.
- LennyWhiteJr 7y ago
  How the hell do you pwn a server with iDRAC?
  - 7y ago

HugoDaniel 7y ago

Should be ok, after all they dont keep any logs right ?

LeonM 7y ago
NordVPN doesn't (or so they claim), but the hacker may have been logging activity.

some_furry 7y ago

If you're reading this and wondering which VPN service you should use to stay safe, start reading here: https://faq.dhol.es/@Soatok/cryptography/which-vpn-service-will-protect-me-from-hackers https://faq.dhol.es/@Soatok/cryptography/which-vpn-service-w... (Spoiler: You're asking yourself the wrong question.)

KirinDave 7y ago
You shouldn't have buried the lede.You should have just said, "Here is a link on why commercial VPNs are a honeypot and bad privacy."
tejohnso 7y ago
Why does the linked suggestion say "Don't use an Android phone, use an iPhone instead."
- some_furry 7y ago
  Ask tptacek and idlewords?

chickenpotpie 7y ago

This is so well timed, I just bought a 3-year subscription to NordVPN and they have a 30 day refund policy.

dagurp 7y ago
So did I, 33 days ago :/
KirinDave 7y ago
You should probably ask for a refund, then set up your own VPN. Commerical VPNs are, for the vast majority of cases, simply not a good bet for your privacy. You're changing your network traffic path from a diffuse and byzantine series of paths to once centralized collection point. The payoff for an attack on a VPN rises very quickly. Meanwhile, you're also conditioning yourself to say, "My traffic is secure while my VPN is on." It's not a great combo.
- chickenpotpie 7y ago
  I thinking about spinning up a Digital Ocean droplet and rolling my own right now
  - babayega2 7y ago
    Absolutely. Look for project Streisand.
  - leevlad 7y ago
    I'd keep in mind that cloud providers have well-known IP blocks that can sometimes be rate-limited by various internet sites/services, primarily to combat botting. You might inadvertently get caught in the IP range that's being actively rate limited by e.g. Instagram. YMMV.
  - ignoramous 7y ago
    https://vultr.com https://vultr.com might provide more bang for the buck at $2.50 a month for 500GB in bandwidth.

fauigerzigerk 7y ago

>NordVPN said it found out about the breach a “few months ago,” but the spokesperson said the breach was not disclosed until today because the company wanted to be “100% sure that each component within our infrastructure is secure.” So instead of allowing their customers to do their own damage limitation, they left their customers in the dark and continued to expose them to a breach they weren't sure they had fully contained. I wonder when that sort of thing will become a criminal offence.

entropicdrifter 7y ago
Yeah, that sounds like flagrant incompetence
- protonimitate 7y ago
  Calling it incompetence lets them off the hook I think. This was a deliberate choice to keep customers in the dark, which is worse IMO.
  - astine 7y ago
    Yeah, the word for this is 'negligence'. Sounds like someone should get sued at the very least.
digitalengineer 7y ago
Within 72 hours According to GDPR I thought? “ The GDPR introduces a duty on all organisations to report certain types of personal data breach to the relevant supervisory authority. You must do this within 72 hours of becoming aware of the breach, where feasible.” https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/personal-data-breaches/ https://ico.org.uk/for-organisations/guide-to-data-protectio...
- eterm 7y ago
  Maybe NordVPN would argue personal data wasn't breached? It's a bad look in any case.

kryogen1c 7y ago

The interesting thing about OOB on most modern servers is that its a separate, physical NIC. Not only is that easily VLAN able, a more security conscious datacenter could even air-gap the out of band LAN!

pm7 7y ago
> The interesting thing about OOB on most modern servers is that its a separate, physical NIC. Not only is that easily VLAN able On lower grade servers OOB is using main NIC. It's still possible (in all implementation I have seen, which is not too many) to have OOB in VLAN. > a more security conscious datacenter could even air-gap the out of band LAN! 1. If you air-gap remote management, you take away it's function. 2. It's not possible to truly air-gap OOB if servers with OOB are not air-gapped (it's theoretically possible to use server to get into OOB network by exploiting/flashing custom OOB from OS).

inian 7y ago

https://nordvpn.com/blog/official-response-datacenter-breach/ https://nordvpn.com/blog/official-response-datacenter-breach...

throwaway_nord 7y ago

Why would their website's SSL certificate be on one of their VPN servers? Do all of their current 3000 servers have the private key for their website right now?

Snawoot 7y ago
OpenVPN CA key also leaked: https://gist.githubusercontent.com/Snawoot/85f77356e229d77aa36f16059a629eea/raw/e4e4af26e4c411d32bbc6bd3ba26301c2ae074bd/nordvpn.txt https://gist.githubusercontent.com/Snawoot/85f77356e229d77aa...
- pram 7y ago
  oof

saurik 7y ago

This is difficult to track, as it is really just a sentence attached to some screenshots, with some commentary but no technical detail... but this seem to be a website key, not an OpenVPN key? (edit: And, in fact, this is confirmed by NordVPN's statements on the matter: "The expired TLS key was taken at the same time the datacenter was exploited. However, the key couldn’t possibly have been used to decrypt the VPN traffic of any other server. On the same note, the only possible way to abuse website traffic was by performing a personalized and complicated MiTM attack to intercept a single connection that tried to access nordvpn.com.")

FillardMillmore 7y ago

I can't help but notice that NordVPN is one of the most heavily advertised VPNs from what I've seen (which raises the question, as one researcher pointed out in the article - are they not spending enough money on their security and infrastructure to protect their users?). They are claiming that: "no-one could know about an undisclosed remote management system left by the [data center] provider". Apparently the hacker was able to find out - so while it may be unknown, it's not an impossibility to detect it. Beyond whether or not sensitive information was accessed, what will NordVPN do in the future to eliminate or mitigate the possibility that this will occur again?

apecat 7y ago
I find NordVPN's marketing reprehensible. Too many claims and broad strokes about the "anonymity" their service can provide. While I certainly would recommend that US consumers use a VPN router to prevent their ISP from selling data, I think NordVPN really overplays the role of changing IP addresses in the age of browser fingerprinting.
- sushid 7y ago
  They’re also not based in a Nordic country, which I find misleading.
  - jen_h 7y ago
    For awhile, my brain conflated it with [OpenVPN-NL](https://openvpn.fox-it.com/about.html https://openvpn.fox-it.com/about.html), a publicly-available, hardened version of OpenVPN used by the Dutch government. You can't really blame NordVPN for that (I mean, the Netherlands aren't even a Nordic country, my brain is just broken), but it's a data point.
  - krn 7y ago
    > They’re also not based in a Nordic country, which I find misleading. Ironically, Lithuania is a part of Northern Europe, but because of the data retention laws they have to pretend that they are based somewhere else[1]. [1] https://vpnscam.com/wp-content/uploads/2018/08/2018-08-24-09_09_14-Window.png https://vpnscam.com/wp-content/uploads/2018/08/2018-08-24-09...

teslaberry 7y ago

What if nord vpn is a government operation? Why wouldnt it be?

pickle-wizard 7y ago

I only use NordVPN to get around GeoIP blocks on a couple of streaming apps. So I'm not too worried about my data being compromised, but I don't like the way they handled this. Think I'll start looking for another provider? Looks like you can side load OpenVPN onto a FireTV. Maybe I'll go the roll my own this time.

numlock86 7y ago

Maybe they should spend more money on security than throw at people like PewDiePie to advertise them ... by also giving false claims like protecting you from hackers and making you magically "secure", whatever that's supposed to mean. Doesn't give the impression they know what a VPN actually is. Considering that most likely the phrasing comes from NordVPN themselves I always questioned them as a whole. Good to have some positive feedback (from my point of view) on that now.

misiti3780 7y ago

Off topic a bit, what what other VPNs are people using. I have been using ExpressVPN and am very happy with it.

computerex 7y ago
Torguard for me, relatively happy with it. Also hideMe was very good too.
- bugbug99 7y ago
  Per OP article Torguard was hacked to
  - computerex 7y ago
    Torguard is contesting the extent of their breach: https://torguard.net/blog/why-torguards-network-is-secure-after-an-isolated-2017-server-breach/ https://torguard.net/blog/why-torguards-network-is-secure-af...
smush 7y ago
Private Internet Access. They should rename to Premier VPN since that is what level of service they provide.

weinzierl 7y ago

Apart from deanonymizing customers and potentially reading the traffic of customers they sent over the VPN what are other risks for customers? What I'm thinking about is that the VPN essentially tunnels through my firewall so a malicious VPN provider may possibly be able to do things that, for example, an arbitrary web server cannot.

trigger89 7y ago

"On the same note, the only possible way to abuse the website traffic was by performing a personalized and complicated man-in-the-middle attack to intercept a single connection that tried to access NordVPN." If I had root, can't I just find out what crypto libraries are in use? and trigger an uprobe to decrypt the traffic on that crypto library ? Every user connection handled by that vpn server would have been plain text for me. I think they are downplaying the importance of this hack

phantom_oracle 7y ago

There's a bittersweet irony with this story. They were recently pushing ads claiming that "Ain't no hacker can steal your online life. (If you use VPN)." The ad has since been deleted :D

1000units 7y ago

This is a feature in my eyes. Just stack a bunch of these hacked by different people who don't cooperate with each other. Now any user has plausible deniability over anything that happens on these networks. No?

jedisct1 7y ago

Get a VPS and run your own VPN. It doesn't have to be complicated: https://github.com/jedisct1/dsvpn https://github.com/jedisct1/dsvpn

mikuru 7y ago

Its nesesary to eari in omega

eicossa 7y ago

I remember last week's episode on Darknet Diaries where NordVPN was offering 3y plans for a hefty discount. My first reaction was "Are they going out of business ?" This week's news lets me make sense of that ad.

generalpass 7y ago

I'm frankly blown away that the comments I'm seeing here don't suggest to just roll your own. $5/mo is the typical price nowadays for a 1 GB VPS with 1TB upload. Cancel at any time. Save image, redeploy monthly/weekly/daily to protect from longer term IP address tracking. Use scheme of your choice (e.g., SOCKS proxy, VPN, standard HTTP port for everything, etc.)

rikkipitt 7y ago

Two days ago I deleted my old Digital Ocean VPN (built using the OpenVPN tutorial I found somewhere), then opted for a discounted 3-year NordVPN plan. Looks like I'm going to have to ask for a refund. facepalm.

safeplanet-fesa 7y ago

What about the data-mining and selling infrastructure of NordVPN, known as Tesonet? Are those intact? Also interesting to know how their legal departments are doing, such as the Panamanian shell and the Lithuanian headquarters. http://vpnscam.com/wp-content/uploads/2018/08/2018-08-24-09_09_14-Window.png http://vpnscam.com/wp-content/uploads/2018/08/2018-08-24-09_... http://vpnscam.com/hola-vpn-and-nordvpn-partners-in-data-mining-bot-network/ http://vpnscam.com/hola-vpn-and-nordvpn-partners-in-data-min... http://vpnscam.com/nordvpn-protonvpn-proton-mail-owned-by-tesonet-ceo-darius-bereika/ http://vpnscam.com/nordvpn-protonvpn-proton-mail-owned-by-te...

soulofmischief 7y ago
Thanks for sharing these. I was familiar with the Protonmail business but did not know this all connected to a bigger picture. I never trusted NordVPN... they spent way too much money on advertising and snake oil advertising at that, focusing on meaningless numbers and distractions. Hopefully you don't have similar news to share about Mullvad...
- dmm 7y ago
  The claims about ProtonVPN have been disproven.
  - hosteur 7y ago
    Source ?
    - itchynosedev 7y ago
      As a ProtonMail client I’d like to see that myth busted too.
      - protonmail 7y ago
        There's a couple ways to look at this. On one hand, there's an anonymous website and hundreds of Twitter bots pushing a story that is demonstratively false (just check public records). Then, on the other hand, you have Mozilla and the EU (which has access to all European corporate records) vouching for Proton (since they partially fund Proton). We also operate in a highly transparent way, so all information debunking this is actually in public record, details here: https://protonvpn.com/blog/is-protonvpn-trustworthy/ https://protonvpn.com/blog/is-protonvpn-trustworthy/ Proton definitely has an office and subsidiary in Vilnius, it's not a secret because it's on Instagram: https://www.instagram.com/p/BxMz62oHb6K/ https://www.instagram.com/p/BxMz62oHb6K/ The office is inside a 30 storey building, so it is not surprising the address is shared with quite a few other companies. But that doesn't mean Proton on a whole is based in Vilnius. The people spreading the false information are also falsely implying that Proton's subsidiary controls the Swiss parent company, which is never the case as it's always the other way around (parent controls the subsidiary). And its super easy to disprove because unlike most companies in the VPN space, the directors of Proton's Swiss parent company are in public record, and are all well known people who have been in the public eye for years (e.g. at TED: https://www.ted.com/talks/andy_yen_think_your_email_s_private_think_again?language=en https://www.ted.com/talks/andy_yen_think_your_email_s_privat...)

yjftsjthsd-h 7y ago

@dang or mods - I'm surprised that this isn't merged with https://news.ycombinator.com/item?id=21311475 https://news.ycombinator.com/item?id=21311475 ; is there some special value in keeping them separate?

dang 7y ago
No, we just hadn't seen it yet. They're merged now. If you want to let us know about something, it's best to email hn@ycombinator.com. We don't see all the comments—I only saw this one by accident—but we do see all the emails. (Well, except possibly a few that go into spam. We comb through the spam folder and rescue most, but a few with unfortunate subject lines probably get missed.)
- yjftsjthsd-h 7y ago
  Thanks and noted. I sorta assumed that you had an alert on "@dang" or "@mods" or so, but I will keep that in mind in the future.

crispyambulance 7y ago

People have been talking about using VPN's because of "dangerous" public wifi, but I have to admit, I don't understand the risks. Let's say you go to a coffee house and sign-in to their wifi with their password and use it browse https websites, like gmail or you favorite social media... what's the main risk? What can happen? What does happen?

pram 7y ago
The primary concern is MITM attacks I'd presume.
- xvector 7y ago
  OP specified HTTPS, so MITM is a non-issue. DNS leakage maybe?
wppick 7y ago
DNS spoofing is one I think. You request mybankwebsite.com and end up entering you login info on mybankwebslte.com

Angeo34 7y ago

>trusting companies outside of EU jurisdiction Literally your own fault

ju-st 7y ago
Or trusting companies only known because of extensive marketing.

TazeTSchnitzel 7y ago

From the amazing service providing “Double VPN” (yes, really) for extra privacy and “Onion VPN” (with the Tor bit being behind NordVPN, not the other way around) for ultra extra privacy!

xvector 7y ago
> with the Tor bit being behind NordVPN, not the other way around This is so dumb that I'm not sure if it's an inside joke or not. (Looking at you, ProtonVPN.)
- protonmail 7y ago
  We are pretty clear though that Tor over VPN is for convenience and not necessarily more security or privacy, depending on your threat model.

meh206 7y ago

Security has never been priority for any of these public VPN providers.

Attained 7y ago

Just use Cloudflare WARP since it's finally out. You're never really anymous unless it's a lifestyle anyways.

codesushi42 7y ago

This is the last time I trust a product endorsement from the Angry Videogame Nerd.

ineedasername 7y ago

"no-one could know about an undisclosed remote management system left by the [data center] provider" Why not? I'm generally familiar with the services offered by dedicated-server/co-lo/vps providers, and remote management systems are very common. This includes out-of-band (OOB) access when using dedicated systems. Seems like the sort of thing that solid due diligence would pick up. Even if it's completely undocumented, designing a robust security checklist to be completed by the vendor should find this sort of thing. This excuse also makes NordVPN look extremely bad for future use: If you say "nobody could have known" then you're also saying "it could happen again" because if you can't know about it, you can't know if other vendors do the same. If you can stop it from happening in the future by implementing additional measures, that means those additional measures could have been used to prevent it the first time. So either you're inherently unsecure, or the issue was preventable.

goshx 7y ago

This is called karma. People have been using their services to run cyberattacks and NordVPN people do NOTHING to stop them. This news brings me joy.

sellingwebsite 7y ago

How feasible is to run and administer your own VPN in cloud ?

therealmarv 7y ago

Any one knows WHICH server provider in Finland caused this? Just following the chain because NordVPN says it was this provider who does not told about their security leak?

willstrafach 7y ago
Oy Creanova Hosting Solutions Ltd.

ga-vu 7y ago

NordVPN blog post, and the source: https://nordvpn.com/blog/official-response-datacenter-breach/ https://nordvpn.com/blog/official-response-datacenter-breach...

john_alan 7y ago

NordVPN subscriber here, I just use DSVPN now. Simple and works.

discordance 7y ago

NordVPN runs a desktop app with escalated local privileges. Surely if they were compromised that would be the attack vector for a bad actor.

kbenson 7y ago

This sounds suspiciously like the Supermicro BMC bug reported here a while back[1], and while it actually can be hard to make sure the IPMI stuff doesn't take over a NIC you don't want it to[2], there are things you can do to prevent that, such as explicitly setting IPMI interface and address information so it won't use "smart" behavior to negate all your security. As to whether "no-one could know", well, I knew after I read that HN submission, and at work we made sure to double check all our configs. This ended up being mostly a known problem, but the extra context helped us find another edge case I believe. It's not great that you have to be aware of the latest security problems and how they may interact in obscure ways with system configs, but that's the nature of security and state of the industry right. Not much to do except buckle down and pay attention. To everything. 1: https://news.ycombinator.com/item?id=20870686 https://news.ycombinator.com/item?id=20870686 2: https://news.ycombinator.com/item?id=20872084 https://news.ycombinator.com/item?id=20872084

catoc 7y ago

Any comments about Encrypt.me as a NordVPN alternative? It looks much more reliable. (from their website; the team's CV's; etc -> i.e.: no hard evidence)

lmaophp 7y ago

Lmao

dlphn___xyz 7y ago

what can a paid vpn service provide that you couldn’t get with free / open source tools?

kebman 7y ago

"It's an older code, but it checks out." :D Sorry, I just couldn't help myself!

knolax 7y ago

Wasn't NordVPN the one that was created by a marketeer? I wouldn't be suprised if this was just cover for them to sell their customer's data indirectly. If anybody finds a dump of the data they sold they could just claim it was from the breach.

badrabbit 7y ago

ProtonVPN uses Nord servers infrastructure right? Were they affected?

protonmail 7y ago
No, that is not true. We run our own infrastructure for ProtonVPN and also own the hardware for our core servers: https://protonvpn.com/support/secure-core-vpn/ https://protonvpn.com/support/secure-core-vpn/ This can be verified by inspecting our VPN endpoints which are all public. We have no connection with Nord or any other VPN. ProtonVPN is however owned and operated by ProtonMail, with some support from the European Union.
- badrabbit 7y ago
  Cheers, glad you cleared that up. I must have gotten bad info. Love all your services!
  - protonmail 7y ago
    No worries. Transparency is important to us so we're always happy to answer questions.

gerdesj 7y ago

There are quite a lot of anti NordVPN and VPN in general experts pontificating here. A quick scroll down through all comments and I note a distinct lack of green handles. This is a 500+ comment article with hardly any near null comment commentards. My analysis is not very rigorous.

jbillow2000 7y ago

Wonder if there will be a class action.

HNLurker2 7y ago

ROFL at the ads

craftoman 7y ago

Could this be another marketing trick to lure more customers? Last time I checked, companies are actually favourable when they "get slightly hacked". They get front page from top tech websites, magazines, forums...

eyegor 7y ago

What this article is missing is that the hackers had root access and had NordVPNs private key for their HTTPS cert for several months in 2018. This went undetected for months and they're only now publically admitting what happened due to press attention. Their public response seems to be "it's not a big deal guys, mitm is hard". > The key wasn't set to expire until October 2018, some seven months after the March 2018 breach https://crt.sh/?id=10031443 https://crt.sh/?id=10031443 And here's a dump of their logs: https://share.dmca.gripe/hZYMaB8oF96FvArZ.txt https://share.dmca.gripe/hZYMaB8oF96FvArZ.txt

stebann 7y ago
Why isn't anybody in journalism publishing this? Really, they're scammers!

samwhiteUK 7y ago

So what does this mean for an every day consumer? I had been debating using the 30-day money back guarantee as I realised I didn't use it as much as I thought I would. I want to stay protected on public Wifi. Added anonymity occasionally would be good too, as well as accessing US Netflix from here in the UK. Now my 30 days is up. What would be the best course of action? Should I email and say that I'm not comfortable being their customer any more, and asked to be reimbursed? Carry on, for my use case? I'd never connected to a Finnish server.

g4d 7y ago
It's so hard to understand what is correct (I'm aware this is a problem with every news story) between the people telling me that they're almost certainly evil, keeping logs and selling data and those that are telling me that it's a smear campaign by the competing VPN providers. My gut tells me that the level of advertising and incredibly low prices is too good to be true... Now with this hack it's the same problem, how bad is it, does it affect me and should i be concerned?

ty7yt 7y ago

nord vpn will sell out. i happen to know this for a fact. same as any other big company. think how many times facebook has said sorry over the past 10 years. just the same with vpn providers. your best bet is tor, and even then just use it for privacy reasons, not illegal ones.

hemant6488 7y ago

can't get hacked if you don't use a VPN. I use sshuttle (https://www.terminalbytes.com/sshuttle-vpn-over-ssh-vpn-alternative/ https://www.terminalbytes.com/sshuttle-vpn-over-ssh-vpn-alte...).

Digg_mov 7y ago

what TechCrunch is hacked????

joezhai 7y ago

I am concerned most about one thing: When can the VPN defeat China's Firewall?

abbadadda 7y ago

Did NordVPN know about this hack when they were offering their deal for something like $88 for 3 years? I went back and looked at their prices from 2017 and it was something like $69 to $83.99 billed annually (https://www.pcworld.com/article/3200777/nordvpn-vpn-review.html https://www.pcworld.com/article/3200777/nordvpn-vpn-review.h...). I've been a NordVPN customer for a while but have been thinking of switching due to some articles touching on nefarious marketing practices and/or questionable data practices. Then I see this deal for $88 for 3 years and it was tempting to re-up. Coincidentally, when the deal ran out the news broke several days later about the hack. I for one will be finding a new VPN provider, but I can't help to think they were trying to rope in as many existing customers as possible before news of the hack broke. Suspect at best.

kjjknnkn 7y ago

okn