23 ms·

I can't help but notice that NordVPN is one of the most heavily advertised VPNs from what I've seen (which raises the question, as one researcher pointed out in

I can't help but notice that NordVPN is one of the most heavily advertised VPNs from what I've seen (which raises the question, as one researcher pointed out in the article - are they not spending enough money on their security and infrastructure to protect their users?). They are claiming that: "no-one could know about an undisclosed remote management system left by the [data center] provider". Apparently the hacker was able to find out - so while it may be unknown, it's not an impossibility to detect it. Beyond whether or not sensitive information was accessed, what will NordVPN do in the future to eliminate or mitigate the possibility that this will occur again?

apecat 7y ago
I find NordVPN's marketing reprehensible. Too many claims and broad strokes about the "anonymity" their service can provide. While I certainly would recommend that US consumers use a VPN router to prevent their ISP from selling data, I think NordVPN really overplays the role of changing IP addresses in the age of browser fingerprinting.
- sushid 7y ago
  They’re also not based in a Nordic country, which I find misleading.
  - jen_h 7y ago
    For awhile, my brain conflated it with [OpenVPN-NL](https://openvpn.fox-it.com/about.html https://openvpn.fox-it.com/about.html), a publicly-available, hardened version of OpenVPN used by the Dutch government. You can't really blame NordVPN for that (I mean, the Netherlands aren't even a Nordic country, my brain is just broken), but it's a data point.
  - krn 7y ago
    > They’re also not based in a Nordic country, which I find misleading. Ironically, Lithuania is a part of Northern Europe, but because of the data retention laws they have to pretend that they are based somewhere else[1]. [1] https://vpnscam.com/wp-content/uploads/2018/08/2018-08-24-09_09_14-Window.png https://vpnscam.com/wp-content/uploads/2018/08/2018-08-24-09...
- dehrmann 7y ago
  > I certainly would recommend that US consumers use a VPN router to prevent their ISP from selling data I wouldn't. Much of the web is moving over to https, VPNs are hit-or-miss on whether they route DNS requests, and having to deal with blocked websites because of abuse isn't worth it. That, and you're trusting the VPN to not sell your data. > browser fingerprinting I mean...your IP address changes on cell networks all the time. Browser fingerprinting is still an arms race, but if you're actually concerned about something, either do whatever Torbrowser does or use the most popular iPhone.
  - apecat 7y ago
    > Much of the web is moving over to https Yes, but US consumer ISPs, to the best of my understanding, still have this nasty habit of tracking and injecting code whenever they feel like it. HTTP is still a thing. Also, if the point is to avoid an ISP snooping on metadata for profiling, HTTPS adoption is good, because it encrypts real session data, but it does not stop data collection. Remember that DNS goes in the clear, until browser and OS vendors decide to turn on DNS over HTTPS by default on consumer devices. The ISP industry, being assholes, have already started to make DoH appear somehow controversial, and they're probably going after google on antitrust grounds. [1] [2] But even with DoH, we're still going to be stuck with SNI, which spells out the target domain of every HTTPS connection in the connection metadata. And whenever encrypted SNI is in place, services on the internet that aren't behind a CDN are still going to have identifiable IP addresses. That's user data perfect for profiling and reselling. So, to really give ISPs the finger, the user must use a VPN. > VPNs are hit-or-miss on whether they route DNS requests Major consumer VPNs, even clowns like NordVPN, have gotten pretty good at ensuring sane confs in their provided clients. I wouldn't rely on their kill switches etc for serious opsec, but it's enough to give the finger to an ISP. On the other hand, the point of a VPN router is precisely to have everything go over a tunnel, including DNS. It's not ideal to tunnel everything, but it's up to US consumers to make that choice. My suggestion would be to campaign to drive up VPN use on consumer broadband connections, just to fuck with the ISPs. > That, and you're trusting the VPN to not sell your data. This is an important point, and also why one would choose a VPN that relies on a reputation of not selling data. > Browser fingerprinting is still an arms race, but if you're actually concerned about something, either do whatever Torbrowser does or use the most popular iPhone. Yes, it's an arms race, and the point is to make life as hard as possible for the tracking industry. Nothing is perfect. Tracking cookies don't go anywhere in a convenient to use browser setup, despite the shoddy claims from clowncar VPN companies. While Tor is great, it's slow and not advisable as a daily driver browser connected to the user's normal online identities. For most users, sane use of Tor Browser would be special purposes, like researching medical concerns you don't want tracking companies to connect to you, and similar. 1 - https://arstechnica.com/tech-policy/2019/09/isps-worry-a-new-chrome-feature-will-stop-them-from-spying-on-you/ https://arstechnica.com/tech-policy/2019/09/isps-worry-a-new... 2 - https://crsreports.congress.gov/product/pdf/IN/IN11182 https://crsreports.congress.gov/product/pdf/IN/IN11182
- kevindong 7y ago
  > I find NordVPN's marketing reprehensible. A claim that really, really bothered me was something along the lines of "use us and no one will be able to read your email!" Every mainstream email provider (Google, Yahoo, Microsoft, Apple) now require HTTPS for emails. No one was ever going to be able to read your emails.
  - nprateem 7y ago
    Apparently not [1] (paywall) / [2] (Google referrer to avoid paywall). There's a scam where email invoices are modified: > Somewhere along the line the email was intercepted and altered. I didn’t know then, but I know now, that I should have transferred a small amount first to see if it went through, or just phoned the builder to check his details [1] https://www.ft.com/content/edc2061a-78b2-11e9-be7d-6d846537acab https://www.ft.com/content/edc2061a-78b2-11e9-be7d-6d846537a... [2] https://lmgtfy.com/?q=I+was+duped+out+of+%C2%A34%2C300+in+an+online+scam+ft.com&s=g https://lmgtfy.com/?q=I+was+duped+out+of+%C2%A34%2C300+in+an...
  - slivanes 7y ago
    I want to read my own email.
  - rosybox 7y ago
    > No one was ever going to be able to read your emails. Except for Google, Yahoo, Microsoft, and Apple of course, and whoever they have to answer to depending on where you live.
    - UncleMeat 7y ago
      A VPN won't change that
  - apecat 7y ago
    I normally don’t mind YouTube ads all that much, and I don’t see them on desktop browsers anyway. However, I was bombarded with ads for NordVPN and their crap made me so angry it pretty much sold me a paid YouTube membership. Hard to relax with some totally not weird ASMR when my blood pressure is through the roof because some chirpy ad agency dude wants to show me how much a VPN is like an umbrella or whatever.
seppin 7y ago
> I can't help but notice that NordVPN is one of the most heavily advertised VPNs from what I've seen Which already means it's the least valuable.
colechristensen 7y ago
"no one could know" is ridiculous. A proper security team vets all of its vendors and ultimately writes security issues like this into contracts.
- SlowRobotAhead 7y ago
  That supplier may be in violation of their contract. If Nord put in that there are to be no undisclosed methods to access the supplier system they're renting, and there are, this doesn't change any facts about the incident here. If I was a Nord user, I wouldn't care that the supplier will refund Nord their service charges. I don't think "no one could know" is ridiculous on it's own. Think about the level of access you have to ensure AWS or Azure is truly secure... none.
  - colechristensen 7y ago
    AWS has external auditors verify their policies, procedures, and actual methods meet a wide variety of compliance requirements from many different agencies. The level of access those auditors and other verification methods have to AWS is not none but very significant. https://aws.amazon.com/compliance/programs/ https://aws.amazon.com/compliance/programs/
    - SlowRobotAhead 7y ago
      Yea, but my example wasn't access that auditors have, it's you, as a client. Now on topic... You could argue that Nord perhaps was a bigger client than you or I am to AWS, and maybe they should have had better access, but the fact of the matter here is that it's absolutely possible that Nord is being accurate when they say "[we] could not have known". Contract violation or not, you should never have full 100% confidence in someone else's system. If I was Nord and renting cloud I would absolutely assume there were undisclosed accesses, as I bet they are viewing everything now.
      - colechristensen 7y ago
        As a client I can ask for policies, records, 4th party audit reports, etc and choose your vendor based on their ability to answer and the quality of answers. It's not about contract violations if something like that happens you don't know about, it would have to be willful deception and incompetence of several organizations. "we could not have known" is an answer you get when what you really mean is "we didn't think to look". If something like this happened and you had done the right things the message would be "vendor X violated their policy, our contracts, and auditors A, B, and C failed due diligence requirements here and here" "We could not have known" as a response means no one should trust NordVPN because clearly they think they're helpless which means they aren't clever enough to trust my data with. > you should never have full 100% confidence in someone else's system Of course.
onlyrealcuzzo 7y ago
If someone hacks a VPN, what are the implications for the users? As long as you're using HTTPS, you don't have to worry about your passwords or session tokens being stolen, right? Is it just your DNS records and unencrypted HTTP traffic?
- badger_bravo 7y ago
  It depends on what you mean by 'hacking' a VPN. One assertion in this breach is that the NordVPN certificate private key was leaked, allowing anybody to spin up a NordVPN server that would pass HTTPS certificate validation (the cert is expired, it's currently unknown if the cert was valid for a period of time after it was compromised). This kind of an attack would let an attacker convince most users to download viruses, input credentials, etc. Nord says that the above issue was caused by a data center breach. Depending on the company this may mean a leak of user info (account details, emails, etc) and password data (generally secure hashes, but often insecure/near-plaintext passwords). There's a lot that can go wrong here even before considering the MITM vector. As far as that goes, you can generally trust that well-secured sites (Google, Facebook, etc) won't allow someone to steal your session tokens/passwords. There is a high likelihood that a malicious VPN would achieve script execution on your machine in a short period of time.
  - Bnshsysjab 7y ago
    Let’s not forget that if they’ve got to a point where they can breach a private key they’re at a point where they’ve probably dumped hashed user creds and contact details, and probably gained persistence on breached hosts, too.
    - Dylan16807 7y ago
      > probably dumped hashed user creds and contact details Not if the hacker only got access to relay servers.
- lmm 7y ago
  If you're a user of a VPN service, if you're not worried because you were using HTTPS then why would you be bothering to use a VPN in the first place?
ehsankia 7y ago
Honestly, I don't think it's exclusive to NordVPN, I've found that all VPN advertising has increased significantly in the last year or two. Noticeably, ExpressVPN is also everywhere. Almost every podcast or youtube video has some VPN ads in it. It seems like with the recent focus on privacy, they are really these two companies and others are really trying to make a run for it.
- flavmartins 7y ago
  Is VPN advertising increasing due to content restrictions from online streaming services? If you travel overseas, you can't access Netflix, AmazonPrime Video, etc. so a VPN service allows you to still use your service while you're away from home. And then sports streaming. You can sign up for a yearly subscription to watch sports, but not the teams closest to your physical location due to local blackouts. Utah is in a terrible place too. No NFL, MLB, or NHL team. But the closest teams are all blacked out from streaming services.
  - Buge 7y ago
    I've found that using a VPN reduces my streaming ability. Using Private Internet Access in the past I was forbidden from watching anything on Netflix. Also I was forbidden from editing Wikipedia even on an old account with positive editing history.
    - natoliniak 7y ago
      Netflix (et al) are blacklisting some common VPN's IP ranges. If that fails, they use some DNS tricks to route the requests to your nearest geographical API and if there is a discrepancy between your IP's location and endpoint's location, they block the requests too. It is possible to overcome, but with some work.
      - ehsankia 7y ago
        Yeah tried to fool Disney+ and most things failed. Even routing through my own private VPS didn't work. They're definitely getting much better at it.
ljm 7y ago
The fact that NordVPN advertise so heavily, and get so many youtubers to sell it, is exactly why I will never use the service. It is way too on the nose. They heavily sponsor PayMoneyWubby who also does a great job at de-anonymising a group of youtubers. The last VPN you ever want to use is the one that is heavily on the market.
- itake 7y ago
  while I don't disagree with you, I am wondering why you would think that? I don't understand what "way too on the nose" means. Are you saying that because they are big makes them a bigger target? If anything, I would think the larger the provider the more resources they would have to provide a stable and secure service.

apecat 7y ago

I find NordVPN's marketing reprehensible. Too many claims and broad strokes about the "anonymity" their service can provide. While I certainly would recommend that US consumers use a VPN router to prevent their ISP from selling data, I think NordVPN really overplays the role of changing IP addresses in the age of browser fingerprinting.

sushid 7y ago
They’re also not based in a Nordic country, which I find misleading.
- jen_h 7y ago
  For awhile, my brain conflated it with [OpenVPN-NL](https://openvpn.fox-it.com/about.html https://openvpn.fox-it.com/about.html), a publicly-available, hardened version of OpenVPN used by the Dutch government. You can't really blame NordVPN for that (I mean, the Netherlands aren't even a Nordic country, my brain is just broken), but it's a data point.
- krn 7y ago
  > They’re also not based in a Nordic country, which I find misleading. Ironically, Lithuania is a part of Northern Europe, but because of the data retention laws they have to pretend that they are based somewhere else[1]. [1] https://vpnscam.com/wp-content/uploads/2018/08/2018-08-24-09_09_14-Window.png https://vpnscam.com/wp-content/uploads/2018/08/2018-08-24-09...
dehrmann 7y ago
> I certainly would recommend that US consumers use a VPN router to prevent their ISP from selling data I wouldn't. Much of the web is moving over to https, VPNs are hit-or-miss on whether they route DNS requests, and having to deal with blocked websites because of abuse isn't worth it. That, and you're trusting the VPN to not sell your data. > browser fingerprinting I mean...your IP address changes on cell networks all the time. Browser fingerprinting is still an arms race, but if you're actually concerned about something, either do whatever Torbrowser does or use the most popular iPhone.
- apecat 7y ago
  > Much of the web is moving over to https Yes, but US consumer ISPs, to the best of my understanding, still have this nasty habit of tracking and injecting code whenever they feel like it. HTTP is still a thing. Also, if the point is to avoid an ISP snooping on metadata for profiling, HTTPS adoption is good, because it encrypts real session data, but it does not stop data collection. Remember that DNS goes in the clear, until browser and OS vendors decide to turn on DNS over HTTPS by default on consumer devices. The ISP industry, being assholes, have already started to make DoH appear somehow controversial, and they're probably going after google on antitrust grounds. [1] [2] But even with DoH, we're still going to be stuck with SNI, which spells out the target domain of every HTTPS connection in the connection metadata. And whenever encrypted SNI is in place, services on the internet that aren't behind a CDN are still going to have identifiable IP addresses. That's user data perfect for profiling and reselling. So, to really give ISPs the finger, the user must use a VPN. > VPNs are hit-or-miss on whether they route DNS requests Major consumer VPNs, even clowns like NordVPN, have gotten pretty good at ensuring sane confs in their provided clients. I wouldn't rely on their kill switches etc for serious opsec, but it's enough to give the finger to an ISP. On the other hand, the point of a VPN router is precisely to have everything go over a tunnel, including DNS. It's not ideal to tunnel everything, but it's up to US consumers to make that choice. My suggestion would be to campaign to drive up VPN use on consumer broadband connections, just to fuck with the ISPs. > That, and you're trusting the VPN to not sell your data. This is an important point, and also why one would choose a VPN that relies on a reputation of not selling data. > Browser fingerprinting is still an arms race, but if you're actually concerned about something, either do whatever Torbrowser does or use the most popular iPhone. Yes, it's an arms race, and the point is to make life as hard as possible for the tracking industry. Nothing is perfect. Tracking cookies don't go anywhere in a convenient to use browser setup, despite the shoddy claims from clowncar VPN companies. While Tor is great, it's slow and not advisable as a daily driver browser connected to the user's normal online identities. For most users, sane use of Tor Browser would be special purposes, like researching medical concerns you don't want tracking companies to connect to you, and similar. 1 - https://arstechnica.com/tech-policy/2019/09/isps-worry-a-new-chrome-feature-will-stop-them-from-spying-on-you/ https://arstechnica.com/tech-policy/2019/09/isps-worry-a-new... 2 - https://crsreports.congress.gov/product/pdf/IN/IN11182 https://crsreports.congress.gov/product/pdf/IN/IN11182
kevindong 7y ago
> I find NordVPN's marketing reprehensible. A claim that really, really bothered me was something along the lines of "use us and no one will be able to read your email!" Every mainstream email provider (Google, Yahoo, Microsoft, Apple) now require HTTPS for emails. No one was ever going to be able to read your emails.
- nprateem 7y ago
  Apparently not [1] (paywall) / [2] (Google referrer to avoid paywall). There's a scam where email invoices are modified: > Somewhere along the line the email was intercepted and altered. I didn’t know then, but I know now, that I should have transferred a small amount first to see if it went through, or just phoned the builder to check his details [1] https://www.ft.com/content/edc2061a-78b2-11e9-be7d-6d846537acab https://www.ft.com/content/edc2061a-78b2-11e9-be7d-6d846537a... [2] https://lmgtfy.com/?q=I+was+duped+out+of+%C2%A34%2C300+in+an+online+scam+ft.com&s=g https://lmgtfy.com/?q=I+was+duped+out+of+%C2%A34%2C300+in+an...
- slivanes 7y ago
  I want to read my own email.
- rosybox 7y ago
  > No one was ever going to be able to read your emails. Except for Google, Yahoo, Microsoft, and Apple of course, and whoever they have to answer to depending on where you live.
  - UncleMeat 7y ago
    A VPN won't change that
- apecat 7y ago
  I normally don’t mind YouTube ads all that much, and I don’t see them on desktop browsers anyway. However, I was bombarded with ads for NordVPN and their crap made me so angry it pretty much sold me a paid YouTube membership. Hard to relax with some totally not weird ASMR when my blood pressure is through the roof because some chirpy ad agency dude wants to show me how much a VPN is like an umbrella or whatever.

seppin 7y ago

> I can't help but notice that NordVPN is one of the most heavily advertised VPNs from what I've seen Which already means it's the least valuable.

colechristensen 7y ago

"no one could know" is ridiculous. A proper security team vets all of its vendors and ultimately writes security issues like this into contracts.

SlowRobotAhead 7y ago
That supplier may be in violation of their contract. If Nord put in that there are to be no undisclosed methods to access the supplier system they're renting, and there are, this doesn't change any facts about the incident here. If I was a Nord user, I wouldn't care that the supplier will refund Nord their service charges. I don't think "no one could know" is ridiculous on it's own. Think about the level of access you have to ensure AWS or Azure is truly secure... none.
- colechristensen 7y ago
  AWS has external auditors verify their policies, procedures, and actual methods meet a wide variety of compliance requirements from many different agencies. The level of access those auditors and other verification methods have to AWS is not none but very significant. https://aws.amazon.com/compliance/programs/ https://aws.amazon.com/compliance/programs/
  - SlowRobotAhead 7y ago
    Yea, but my example wasn't access that auditors have, it's you, as a client. Now on topic... You could argue that Nord perhaps was a bigger client than you or I am to AWS, and maybe they should have had better access, but the fact of the matter here is that it's absolutely possible that Nord is being accurate when they say "[we] could not have known". Contract violation or not, you should never have full 100% confidence in someone else's system. If I was Nord and renting cloud I would absolutely assume there were undisclosed accesses, as I bet they are viewing everything now.
    - colechristensen 7y ago
      As a client I can ask for policies, records, 4th party audit reports, etc and choose your vendor based on their ability to answer and the quality of answers. It's not about contract violations if something like that happens you don't know about, it would have to be willful deception and incompetence of several organizations. "we could not have known" is an answer you get when what you really mean is "we didn't think to look". If something like this happened and you had done the right things the message would be "vendor X violated their policy, our contracts, and auditors A, B, and C failed due diligence requirements here and here" "We could not have known" as a response means no one should trust NordVPN because clearly they think they're helpless which means they aren't clever enough to trust my data with. > you should never have full 100% confidence in someone else's system Of course.

onlyrealcuzzo 7y ago

If someone hacks a VPN, what are the implications for the users? As long as you're using HTTPS, you don't have to worry about your passwords or session tokens being stolen, right? Is it just your DNS records and unencrypted HTTP traffic?

badger_bravo 7y ago
It depends on what you mean by 'hacking' a VPN. One assertion in this breach is that the NordVPN certificate private key was leaked, allowing anybody to spin up a NordVPN server that would pass HTTPS certificate validation (the cert is expired, it's currently unknown if the cert was valid for a period of time after it was compromised). This kind of an attack would let an attacker convince most users to download viruses, input credentials, etc. Nord says that the above issue was caused by a data center breach. Depending on the company this may mean a leak of user info (account details, emails, etc) and password data (generally secure hashes, but often insecure/near-plaintext passwords). There's a lot that can go wrong here even before considering the MITM vector. As far as that goes, you can generally trust that well-secured sites (Google, Facebook, etc) won't allow someone to steal your session tokens/passwords. There is a high likelihood that a malicious VPN would achieve script execution on your machine in a short period of time.
- Bnshsysjab 7y ago
  Let’s not forget that if they’ve got to a point where they can breach a private key they’re at a point where they’ve probably dumped hashed user creds and contact details, and probably gained persistence on breached hosts, too.
  - Dylan16807 7y ago
    > probably dumped hashed user creds and contact details Not if the hacker only got access to relay servers.
lmm 7y ago
If you're a user of a VPN service, if you're not worried because you were using HTTPS then why would you be bothering to use a VPN in the first place?

ehsankia 7y ago

Honestly, I don't think it's exclusive to NordVPN, I've found that all VPN advertising has increased significantly in the last year or two. Noticeably, ExpressVPN is also everywhere. Almost every podcast or youtube video has some VPN ads in it. It seems like with the recent focus on privacy, they are really these two companies and others are really trying to make a run for it.

flavmartins 7y ago
Is VPN advertising increasing due to content restrictions from online streaming services? If you travel overseas, you can't access Netflix, AmazonPrime Video, etc. so a VPN service allows you to still use your service while you're away from home. And then sports streaming. You can sign up for a yearly subscription to watch sports, but not the teams closest to your physical location due to local blackouts. Utah is in a terrible place too. No NFL, MLB, or NHL team. But the closest teams are all blacked out from streaming services.
- Buge 7y ago
  I've found that using a VPN reduces my streaming ability. Using Private Internet Access in the past I was forbidden from watching anything on Netflix. Also I was forbidden from editing Wikipedia even on an old account with positive editing history.
  - natoliniak 7y ago
    Netflix (et al) are blacklisting some common VPN's IP ranges. If that fails, they use some DNS tricks to route the requests to your nearest geographical API and if there is a discrepancy between your IP's location and endpoint's location, they block the requests too. It is possible to overcome, but with some work.
    - ehsankia 7y ago
      Yeah tried to fool Disney+ and most things failed. Even routing through my own private VPS didn't work. They're definitely getting much better at it.

ljm 7y ago

The fact that NordVPN advertise so heavily, and get so many youtubers to sell it, is exactly why I will never use the service. It is way too on the nose. They heavily sponsor PayMoneyWubby who also does a great job at de-anonymising a group of youtubers. The last VPN you ever want to use is the one that is heavily on the market.

itake 7y ago
while I don't disagree with you, I am wondering why you would think that? I don't understand what "way too on the nose" means. Are you saying that because they are big makes them a bigger target? If anything, I would think the larger the provider the more resources they would have to provide a stable and secure service.