Security Experts Concerned About Weird NordVPN Traffic

guest · Apr 27, 2019

Security Experts Concerned About Weird NordVPN Traffic
April 27, 2019
https://www.technadu.com/security-experts-concerned-weird-nordvpn-traffic/65987/

An increasing number of security experts warn that there’s a specific type of traffic deriving from the NordVPN product that looks alarmingly suspicious. What the people who have investigated this to up to a point claim is that the application is contacting three domains that are seemingly “garbage”, owned by no one (until recently), and generally doing what botnet machines that communicate with C&C servers do.

NordVPN had thanked the first person to disclose this issue to them, Ryan Niemes, giving him three years of free subscription, and acknowledging that this behavior is odd and shouldn’t be there in the first place.
When reached again by “TheRegister”, NordVPN gave the same explanation about this being a workaround system for people who reside in countries with heavy internet restrictions.

However, in Niemes’ blog post, the traffic that is sent via NordVPN looks quite sensitive, and in addition to that, there’s a clear indication that the client is about to receive a gzip file that could potentially be a malicious file. Whatever this file may be in reality, users should not receive such data as part of the operation of anti-censorship mechanisms.
He says they have seen at least 188 cases regarding this matter last year, and NordVPN is not the only VPN product to do this.
Click to expand...

TheRegister
"The POST I'm seeing is concerning because there's a field called renewtoken which appears to be unique," he told The Register. As well as the user-agent string, the inbound requests also disclosed app version, host operating system build and the user's IPv4 address.
Click to expand...

imdb · Apr 27, 2019

https://www.wilderssecurity.com/threads/nordvpn-app-sends-sensitive-data-to-various-trackers.412396/

summerheat said: ↑

The German security researcher Mike Kuketz examined the NordVPN app for Android. He found that the app doesn't only contain several wide-spread trackers (which is confirmed by Exodus) but also sends your email address plus several identification tokens (like the Google Advertising ID) to the third party Iterable Inc. during the registration process.

This data transfer is not mentioned at all in the NordVPN Privacy Policy.

When Kuketz contacted NordVPN about his findings he got the following answer:

"Hello there! We use these tools to monitor aggregated data to improve UI/UX and determine the efficiency of our marketing campaigns. They are not related to the user’s activity when using our VPN service. In case you have further questions, do not hesitate to drop us a DM!"

Kuketz rightly wonders how this answer fits with sending the customer's email address to a third party.
...
Click to expand...

mirimir · Apr 28, 2019

Wow, that is disgusting.

guest · Apr 28, 2019

If true it is not surprising, Nord is spamming medias and spreading FUD to get customers, they offers hundreds of alleged bare-metal servers, money must come from somewhere...

Log in or Sign up

Security Experts Concerned About Weird NordVPN Traffic

guest Guest

imdb Registered Member

mirimir Registered Member

guest Guest

Log in or Sign up

Security Experts Concerned About Weird NordVPN Traffic

guest Guest

imdb Registered Member

mirimir Registered Member

guest Guest

Useful Searches