NordVPN confirms it was hacked

guest · Oct 21, 2019

NordVPN confirms it was hacked
October 21, 2019
https://techcrunch.com/2019/10/21/nordvpn-confirms-it-was-hacked/

NordVPN, a virtual private network provider that promises to “protect your privacy online,” has confirmed it was hacked.
The admission comes following rumors that the company had been breached. It first emerged that NordVPN had an expired internal private keys exposed, potentially allowing anyone to spin out their own servers imitating NordVPN.

NordVPN told TechCrunch that one of its datacenters was accessed in March 2018. “One of the datacenters in Finland we are renting our servers from was accessed with no authorization,” said NordVPN spokesperson Laura Tyrell.

“The server itself did not contain any user activity logs; none of our applications send user-created credentials for authentication, so usernames and passwords couldn’t have been intercepted either,” said the spokesperson.
According to the spokesperson, the expired private key could not have been used to decrypt the VPN traffic on any other server.
Click to expand...

A senior security researcher we spoke to who reviewed the statement and other published evidence, but asked not to be named as they work for a company that requires authorization to speak to the press, called these findings “troubling.”

“While this is unconfirmed and we await further forensic evidence, this is an indication of a full remote compromise of this provider’s systems,” the security researcher said. “That should be deeply concerning to anyone who uses or promotes these particular services.”

It’s also believed several other VPN providers may have been breached around the same time. Similar records posted online — and seen by TechCrunch — suggest that TorGuard and VikingVPN may have also been compromised, but spokespeople did not return a request for comment.
Click to expand...

guest · Oct 21, 2019

TorGuard, NordVPN Respond to Breach Reports
October 21, 2019
https://www.securityweek.com/torguard-nordvpn-respond-breach-reports

In their official response, NordVPN confirmed that hackers accessed one of their servers and stole the TLS key, but said they could only use it to perform “a personalized and complicated MiTM attack to intercept a single connection that tried to access nordvpn.com.”
The company also noted that this was an isolated incident and that only one of their datacentre providers was impacted.

What’s more, TorGuard too was using the server provider and was hit, yet it was the only VPN service provider of the three to be practicing secure PKI management.

“TorGuard VPN or proxy traffic was not compromised during this isolated breach of a single VPN server and no sensitive information was compromised during this incident. Even though no security risk past or present was found, TorGuard has reissued all certs earlier this year per our security protocol,” the company said in a blog post.
Click to expand...

NordVPN: Why the NordVPN network is safe after a third-party provider breach
TorGuard: Why TorGuard’s Network is Secure After an Isolated 2017 Server Breach

mirimir · Oct 22, 2019

There's an informative HN discussion: https://news.ycombinator.com/item?id=21312609

From https://techcrunch.com/2019/10/21/nordvpn-confirms-it-was-hacked/

The attacker gained access to the server — which had been active for about a month — by exploiting an insecure remote management system left by the data center provider; NordVPN said it was unaware that such a system existed.
Click to expand...

I'm not entirely surprised that a PR flack wasn't aware of remote maintenance stuff.

But I am surprised that their engineers didn't get it locked down. I mean, I do -- and I'm just an amateur/hobbyist.

guest · Oct 29, 2019

NordVPN Plans Security and Privacy Upgrades After Hack
October 29, 2019
https://www.bleepingcomputer.com/ne...ans-security-and-privacy-upgrades-after-hack/

NordVPN has announced that they are instituting new measures to better enhance security and to proactively detect security issues in their infrastructure after one of their server was hacked.

NordVPN was one of the VPN providers who had a server hacked and while they stated that the server did not contain any logs, user names and passwords were not accessed, and that data could not be decrypted, the attacker did have full access to this server.
New security measures being introduced
In a statement sent to BleepingComputer, NordVPN outlines how they plan on instituting five new security measures in order to better protect their infrastructure.

To start, NordVPN is hiring cybersecurity consulting firm VerSprite to perform penetration testing on NordVPN's infrastructure in order to discover weaknesses and resolve any discovered vulnerabilities.
They are also introducing a bug bounty program so that independent security researchers can discover vulnerabilities and report them to NordVPN for a bug bounty reward.
[...] The fifth, and final, security measure is to upgrade their entire infrastructure of 5,100 servers to RAM servers. According to NordVPN, this will allow them to deploy servers where nothing is stored locally, including the operating system.
Click to expand...

This does not quite make sense as even servers hosted entirely in RAM can still be hacked.
We have reached out to NordVPN for more information about the RAM servers.
Click to expand...

liba · Oct 29, 2019

Sorry I dont trust NordVpn.

BoerenkoolMetWorst · Oct 29, 2019

I don't either, and didn't before this happened.

imdb · Oct 29, 2019

https://www.wilderssecurity.com/threads/nordvpn-app-sends-sensitive-data-to-various-trackers.412396/

https://www.wilderssecurity.com/thr...nd-secure-vpn-connection.419285/#post-2844102

https://www.wilderssecurity.com/thr...-between-nord-and-mulvad.411515/#post-2799913

guest · Nov 1, 2019

NordVPN users’ passwords exposed in mass credential-stuffing attacks
Many of the dumps have been pulled off public Web pages, but at least one remains
November 1, 2019
https://arstechnica.com/information...-exposed-in-mass-credential-stuffing-attacks/

As many as 2,000 users of NordVPN, the virtual private network service that recently disclosed a server hack that leaked crypto keys, have fallen victim to credential-stuffing attacks that allow unauthorized access to their accounts.

In recent weeks, credentials for NordVPN users have circulated on Pastebin and other online forums. They contain the email addresses, plain-text passwords, and expiration dates associated with NordVPN user accounts.
I received a list of 753 credentials on Thursday and polled a small sample of users. The passwords listed for all but one were still in use.

Over the past week, breach notification service Have I Been Pwned has reported at least 10 lists of NordVPN credentials similar to the one I obtained.
While it’s likely that some accounts are listed in multiple lists, the number of user accounts easily tops 2,000.
Click to expand...

Shared responsibility
It’s important for readers to know these lists don’t signal a breach on any NordVPN servers. The lists also don’t indicate that the breach disclosed 11 days ago was worse than the company said it was.
I’d argue that NordVPN shares the bulk of responsibility for the high incidence of compromised accounts on its site.

NordVPN can take other measures to prevent malicious parties from logging in with users’ poorly chosen passwords. Chief among them would be rate limiting and algorithms that detect and block unauthorized logins.
Click to expand...

guest · Mar 8, 2020

NordVPN Fixed Two Critical Flaws That Could Have Exposed Client Data
March 7, 2020
https://www.technadu.com/nordvpn-fixed-two-critical-flaws-that-could-have-exposed-client-data/94727/

NordVPN fixed two critical vulnerabilities last month, which were discovered in the “HackerOne” bug bounty hunters platform. According to what was made known, anyone could send an HTTP POST request to “join.nordvpn.com” to essentially read the email addresses and payment method of other users without having to go through any authentication.

Other details exposed in this way are the currencies used, the payment URL, the amount, and which product they bought. This vulnerability doesn’t have to do anything with the user password and how strong it may be, as this is overridden entirely.

NordVPN’s Jody Myers has made the following statement about the above flaws on The Register:

“Such reports are one of the reasons why we have launched the bug bounty program. We are extremely happy with its results and encourage even more researchers to analyze our product. This is an isolated case that potentially affected only a handful of users, due to the implemented rate-limiting. Theoretically, only email addresses could have been seen by a third party.”
Click to expand...

mirimir · Mar 8, 2020

Damn, that is a crazy bug

Yet another reason to sign up via Tor, use well-mixed Bitcoin, and throwaway email addresses.

guest · Oct 12, 2020

One year after server hackers left NordVPN red-faced, firm's first colocated setup is online
NordVPN has hit the go-live button for the first of its colocated server setups
October 12, 2020
https://www.theregister.com/2020/10/12/roundup_week_oct9/

The move means the VPN provider can take tighter control over the service as it now only rents space for its own custom servers, rather than renting a server in a data centre. The difference being that NordVPN gets to control all the hardware and settings.

This dates back to October 2019, when NordVPN was embarrassed by hackers who managed to get into a rented server that was being used to host the VPN service. One of the company's planned security improvements was to move to colocated facilities.
The first of the colocated setups has gone live in Finland, with data centres in other parts of the world planned.
Click to expand...

Log in or Sign up

NordVPN confirms it was hacked

guest Guest

guest Guest

mirimir Registered Member

guest Guest

liba Registered Member

BoerenkoolMetWorst Registered Member

imdb Registered Member

guest Guest

guest Guest

mirimir Registered Member

guest Guest

Log in or Sign up

NordVPN confirms it was hacked

guest Guest

guest Guest

mirimir Registered Member

guest Guest

liba Registered Member

BoerenkoolMetWorst Registered Member

imdb Registered Member

guest Guest

guest Guest

mirimir Registered Member

guest Guest

Useful Searches