7 ms·
>NordVPN said it found out about the breach a “few months ago,” but the spokesperson said the breach was not disclosed until today because the company wanted to
by fauigerzigerk 7y ago
>NordVPN said it found out about the breach a “few months ago,” but the spokesperson said the breach was not disclosed until today because the company wanted to be “100% sure that each component within our infrastructure is secure.”
So instead of allowing their customers to do their own damage limitation, they left their customers in the dark and continued to expose them to a breach they weren't sure they had fully contained.
I wonder when that sort of thing will become a criminal offence.
- entropicdrifter 7y agoYeah, that sounds like flagrant incompetence
- protonimitate 7y agoCalling it incompetence lets them off the hook I think. This was a deliberate choice to keep customers in the dark, which is worse IMO.
- astine 7y agoYeah, the word for this is 'negligence'. Sounds like someone should get sued at the very least.
- digitalengineer 7y agoWithin 72 hours According to GDPR I thought? “ The GDPR introduces a duty on all organisations to report certain types of personal data breach to the relevant supervisory authority. You must do this within 72 hours of becoming aware of the breach, where feasible.” https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/personal-data-breaches/ https://ico.org.uk/for-organisations/guide-to-data-protectio...
- tyfon 7y ago> I wonder when that sort of thing will become a criminal offence. If they have EU customers then article 33 of GDPR should see to that. "In the case of a personal data breach, the controller shall without undue delay and, where feasible, not later than 72 hours after having become aware of it, notify the personal data breach to the supervisory authority competent in accordance with Article 55, unless the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons. Where the notification to the supervisory authority is not made within 72 hours, it shall be accompanied by reasons for the delay." Unless the authorities in EU accept the explanation they are in trouble, but I think you shall report even if you think there has been a breach.
- vianneychevalie 7y agoThey could argue that they don't have proof that the exposed private key led to a personal data breach.
- tyfon 7y agoYeah, I think that's their only option actually.
- slantedview 7y agoExposing a private key is basically a breach.
- phamilton 7y ago"breach" usually has a legal definition, which varies by jurisdiction
- SahAssar 7y agoThey would have to be sure that no private data leaked though, right?
- Faark 7y ago> to the supervisory authority Does this always/necessarily lead to customers/the public being informed? But yeah, better than nothing.
- deleted 7y ago[deleted]
- rasengan 7y agoI think that is pretty criminal already. Basically: 1- Nord falsely blames its server provider. 2- Nord hides it from their users. 3- Nord claims all will be well with an “audit” (again, since they were already “audited”) This is either criminal negligence, “security theater”, or both.
- metalliqaz 7y ago> Nord falsely blames its server provider. I don't see anything in the article about those claims being false. Where did you get that?
- CorruptedArc 7y agoFrom the article: "“One of the data centers in Finland we are renting our servers from was accessed with no authorization,” said NordVPN spokesperson Laura Tyrell." I believe that would be the section they're referencing.
- biddlesby 7y agoHow does this quote demonstrate that the service provider was not at fault?
- rasengan 7y ago“We failed by contracting an unreliable server provider...” They are casting blame on the provider. Providing remote access tools is not a fault. Failure by NordVPN to disable said access is the issue, yet they passed the blame on.
- metalliqaz 7y agoOkay that makes sense. I read differently, like they had fabricated the story about the service provider's management console.
- Phillipharryt 7y agoIn Australia under the Consumer Data Right it would be an offence to wait before disclosing this. Unfortunately it doesn't cover all industries yet.
- Snawoot 7y agoSorry for posting under top comment, but I think it is very important. Official response hides fact OpenVPN CA keys also leaked, so attacker could impersonate any other NordVPN server: https://gist.githubusercontent.com/Snawoot/85f77356e229d77aa36f16059a629eea/raw/e4e4af26e4c411d32bbc6bd3ba26301c2ae074bd/nordvpn.txt https://gist.githubusercontent.com/Snawoot/85f77356e229d77aa... RADIUS secret key also leaked, so propably it is possible to break into EAP session which infers session secret key for StrongSwan.
- panarky 7y agoAlso allowing historical sessions to be decrypted.
- rasengan 7y agoAlso looks like NordVPN has been misleading customers about the number of servers they have (or didn't make clear they were VM/containers).
- dx034 7y agoI don't think they ever wrote anywhere that they have 6,000+ physical servers. Calling a VM (like an EC2 instance) a server is not unusual. For the customers it was important that the resources, bandwidth and different IPs were available. For that it doesn't matter if it's a physical server.
- kzrdude 7y agoWho has logs of full historical sessions, and the tools to decrypt them? NSA?
- Forbo 7y agoYeah, as far as I understand that's pretty much the purpose of the Utah datacenter.
- deleted 7y ago[deleted]
- ganoushoreilly 7y agoThe tinfoil hat would argue maybe this was a leak that happened, but it was shared by design. It’s an HK company with questionable relationships and owners.
- krn 7y ago> It’s an HK company with questionable relationships and owners. That seems to be ExpressVPN[1], the main competitor of NordVPN. [1] https://vpnscam.com/expressvpn-really-based-in-hong-kong/ https://vpnscam.com/expressvpn-really-based-in-hong-kong/
- agumonkey 7y agoMaybe they only disclosed it publicly but notified customers out of the public eye ?
- iaresee 7y agoI was a NordVPN customer 4 months ago and got no notification. I’m hearing about this now via this post on HN. Dropped them around July.
- agumonkey 7y agoAight then i'm sorry for their lack of accountability.
- HYDRA_HACKER 7y agook
- dpau 7y agoi find it surprising that none of the threads in this topic mention the very serious threat this breach might have for users in countries like china. the fact that nordvpn neglected to tell its users for months after the breach quite possibly endangered people's lives. unforgivable.
- TaylorAlexander 7y agoDystopian and true.