5 ms·

The best thing NordVPN can do right now is make a statement that clearly and honestly describes how its users are affected. No bullshit marketing language, no t

The best thing NordVPN can do right now is make a statement that clearly and honestly describes how its users are affected. No bullshit marketing language, no trying to hide facts, just a short and simple explanation of what this means for users and what they should do next.

uniformlyrandom 7y ago
Linked article says: > “The server itself did not contain any user activity logs; none of our applications send user-created credentials for authentication, so usernames and passwords couldn’t have been intercepted either,” said the spokesperson. “On the same note, the only possible way to abuse the website traffic was by performing a personalized and complicated man-in-the-middle attack to intercept a single connection that tried to access NordVPN.” > According to the spokesperson, the expired private key could not have been used to decrypt the VPN traffic on any other server. > NordVPN said it found out about the breach a “few months ago,” but the spokesperson said the breach was not disclosed until today because the company wanted to be “100% sure that each component within our infrastructure is secure.”
- SimeVidas 7y ago
  If I were a NordVPN customer, these quotes would not give me confidence that my traffic wasn’t exposed.
- Snawoot 7y ago
  > According to the spokesperson, the expired private key could not have been used to decrypt the VPN traffic on any other server. It's simply not true. Their CA private key which is used to issue certificates for ALL servers also leaked along with RADIUS key which is used to secure EAP session [1]. They DO hide facts. [1] https://gist.githubusercontent.com/Snawoot/85f77356e229d77aa36f16059a629eea/raw/e4e4af26e4c411d32bbc6bd3ba26301c2ae074bd/nordvpn.txt https://gist.githubusercontent.com/Snawoot/85f77356e229d77aa...
readhn 7y ago
Truth is - if hackers did a MIM attack and collected a bunch user traffic (for how long?) they could have everything.. banking info, emails, logins... at this point if i was a user of that VPN service - i'd be replacing all of my sensitive passwords, secret questions/answers to key accounts.
- lijogdfljk 7y ago
  While I agree with you - I do think it's slightly less bad than you make it out to be. For example, if I connected to my bank over this VPN I would only be as concerned as my HTTPS connection. So my VPN still doesn't know my bank login, assuming my TLS was sound, right? This would hypothetically be as bad as logging into my bank on a public wifi. Am I paranoid enough to not log into my bank on a public wifi? Yes. So I should be concerned here. But, it's at least not immediately insecure.
  - smolder 7y ago
    TLS is probably not sound, judging by history, even if exploits aren't known. But apart from that, there may have been ways to infiltrate a target client from the VPN host and make their TLS moot.
- rocqua 7y ago
  MitM-ing a VPN does not break HTTPS. Hence, any passwords send over HTTPS are still safe. You could speculate that a VPN MitM is a nice way to get an MitM position for a further attack on TLS. But that requires a lot more speculation. What isn't safe is your browsing history. True, any HTTP data isn't safe, but trusting that to be safe is baaaaad anyway. In short. This leaked browser behavior, and could be a single step in getting a MitM possition on users.
  - catalogia 7y ago
    NordVPN's advertising has deliberately downplayed the significance of HTTPS, as part of their fear mongering campaign about public wifi and residential ISP connections, so it's not really surprising to see such misconceptions raise their heads when NordVPN screws the pooch like this.
SparkyMcUnicorn 7y ago
They did already: https://nordvpn.com/blog/official-response-datacenter-breach/ https://nordvpn.com/blog/official-response-datacenter-breach...
- SimeVidas 7y ago
  Regular people who are NordVPN’s customers can’t possibly understand that. A highly technical explanation is not good enough. They need to put out a statement that explains clearly and concisely what this means for their users, something that all people can understand.
  - SparkyMcUnicorn 7y ago
    "To recap, in early 2018, one isolated datacenter in Finland was accessed without authorization. That was done by exploiting a vulnerability of one of our server providers that hadn’t been disclosed to us. No user credentials have been intercepted. No other server on our network has been affected. The affected server does not exist anymore and the contract with the server provider has been terminated." Not sure what you're asking for? If someone doesn't understand that, then they probably aren't using a VPN.
    - SimeVidas 7y ago
      Ok, I’m going to pretend that I’m a NordVPN customer who is 50, works as a plumber, and has installed a VPN on their phone because they were convinced that it’s very good for privacy. Here goes… “What is a datacenter? How was it accessed? Like in that Mission Impossible movie? What are server providers? What role do they play in all this? Credentials? That’s like my passwords? What about my browsing activity? All I want to know is if my traffic was spied on.” How was I?
      - SparkyMcUnicorn 7y ago
        Have you used Nord VPN? These aren't questions users would have. I could be wrong, but I'm confident that a plumber that has used Nord would know what a datacenter is, just from using the app. My tech illiterate Dad (70s) sure does.

uniformlyrandom 7y ago

Linked article says: > “The server itself did not contain any user activity logs; none of our applications send user-created credentials for authentication, so usernames and passwords couldn’t have been intercepted either,” said the spokesperson. “On the same note, the only possible way to abuse the website traffic was by performing a personalized and complicated man-in-the-middle attack to intercept a single connection that tried to access NordVPN.” > According to the spokesperson, the expired private key could not have been used to decrypt the VPN traffic on any other server. > NordVPN said it found out about the breach a “few months ago,” but the spokesperson said the breach was not disclosed until today because the company wanted to be “100% sure that each component within our infrastructure is secure.”

SimeVidas 7y ago
If I were a NordVPN customer, these quotes would not give me confidence that my traffic wasn’t exposed.
Snawoot 7y ago
> According to the spokesperson, the expired private key could not have been used to decrypt the VPN traffic on any other server. It's simply not true. Their CA private key which is used to issue certificates for ALL servers also leaked along with RADIUS key which is used to secure EAP session [1]. They DO hide facts. [1] https://gist.githubusercontent.com/Snawoot/85f77356e229d77aa36f16059a629eea/raw/e4e4af26e4c411d32bbc6bd3ba26301c2ae074bd/nordvpn.txt https://gist.githubusercontent.com/Snawoot/85f77356e229d77aa...

readhn 7y ago

Truth is - if hackers did a MIM attack and collected a bunch user traffic (for how long?) they could have everything.. banking info, emails, logins... at this point if i was a user of that VPN service - i'd be replacing all of my sensitive passwords, secret questions/answers to key accounts.

lijogdfljk 7y ago
While I agree with you - I do think it's slightly less bad than you make it out to be. For example, if I connected to my bank over this VPN I would only be as concerned as my HTTPS connection. So my VPN still doesn't know my bank login, assuming my TLS was sound, right? This would hypothetically be as bad as logging into my bank on a public wifi. Am I paranoid enough to not log into my bank on a public wifi? Yes. So I should be concerned here. But, it's at least not immediately insecure.
- smolder 7y ago
  TLS is probably not sound, judging by history, even if exploits aren't known. But apart from that, there may have been ways to infiltrate a target client from the VPN host and make their TLS moot.
rocqua 7y ago
MitM-ing a VPN does not break HTTPS. Hence, any passwords send over HTTPS are still safe. You could speculate that a VPN MitM is a nice way to get an MitM position for a further attack on TLS. But that requires a lot more speculation. What isn't safe is your browsing history. True, any HTTP data isn't safe, but trusting that to be safe is baaaaad anyway. In short. This leaked browser behavior, and could be a single step in getting a MitM possition on users.
- catalogia 7y ago
  NordVPN's advertising has deliberately downplayed the significance of HTTPS, as part of their fear mongering campaign about public wifi and residential ISP connections, so it's not really surprising to see such misconceptions raise their heads when NordVPN screws the pooch like this.

SparkyMcUnicorn 7y ago

They did already: https://nordvpn.com/blog/official-response-datacenter-breach/ https://nordvpn.com/blog/official-response-datacenter-breach...

SimeVidas 7y ago
Regular people who are NordVPN’s customers can’t possibly understand that. A highly technical explanation is not good enough. They need to put out a statement that explains clearly and concisely what this means for their users, something that all people can understand.
- SparkyMcUnicorn 7y ago
  "To recap, in early 2018, one isolated datacenter in Finland was accessed without authorization. That was done by exploiting a vulnerability of one of our server providers that hadn’t been disclosed to us. No user credentials have been intercepted. No other server on our network has been affected. The affected server does not exist anymore and the contract with the server provider has been terminated." Not sure what you're asking for? If someone doesn't understand that, then they probably aren't using a VPN.
  - SimeVidas 7y ago
    Ok, I’m going to pretend that I’m a NordVPN customer who is 50, works as a plumber, and has installed a VPN on their phone because they were convinced that it’s very good for privacy. Here goes… “What is a datacenter? How was it accessed? Like in that Mission Impossible movie? What are server providers? What role do they play in all this? Credentials? That’s like my passwords? What about my browsing activity? All I want to know is if my traffic was spied on.” How was I?
    - SparkyMcUnicorn 7y ago
      Have you used Nord VPN? These aren't questions users would have. I could be wrong, but I'm confident that a plumber that has used Nord would know what a datacenter is, just from using the app. My tech illiterate Dad (70s) sure does.