> “The server itself did not contain any user activity logs; none of our applications send user-created credentials for authentication, so usernames and passwords couldn’t have been intercepted either,” said the spokesperson. “On the same note, the only possible way to abuse the website traffic was by performing a personalized and complicated man-in-the-middle attack to intercept a single connection that tried to access NordVPN.”
> According to the spokesperson, the expired private key could not have been used to decrypt the VPN traffic on any other server.
> NordVPN said it found out about the breach a “few months ago,” but the spokesperson said the breach was not disclosed until today because the company wanted to be “100% sure that each component within our infrastructure is secure.”
It's simply not true.
Their CA private key which is used to issue certificates for ALL servers also leaked along with RADIUS key which is used to secure EAP session [1].
They DO hide facts.
[1] https://gist.githubusercontent.com/Snawoot/85f77356e229d77aa...
Not sure what you're asking for? If someone doesn't understand that, then they probably aren't using a VPN.
“What is a datacenter? How was it accessed? Like in that Mission Impossible movie? What are server providers? What role do they play in all this? Credentials? That’s like my passwords? What about my browsing activity? All I want to know is if my traffic was spied on.”
How was I?
You said you wanted them to give a clear explanation, which I believe they did, but you don't. Let's just leave it at that.
These companies are giving all their customers the idea that they have reasonably good anonymity with a public VPN service, which is arguably false depending on how they use it. I feel like that's where you should be targeting this concern. Not an expired key leak.
at this point if i was a user of that VPN service - i'd be replacing all of my sensitive passwords, secret questions/answers to key accounts.
What isn't safe is your browsing history. True, any HTTP data isn't safe, but trusting that to be safe is baaaaad anyway.
In short. This leaked browser behavior, and could be a single step in getting a MitM possition on users.
This would hypothetically be as bad as logging into my bank on a public wifi.
Am I paranoid enough to not log into my bank on a public wifi? Yes. So I should be concerned here. But, it's at least not immediately insecure.
Most people access email over a webmail interface, like gmail, that uses modern TLS encryption. All that's sent unencrypted is the SNI header, e.g. "mail.google.com", and roughly how much traffic total is transferred, e.g. "20 MB of browsing on mail.google.com".
A VPN can't easily defeat TLS. It would require the user to ignore many scary warnings from the browser.
You're still right that a user should change their passwords for any websites that do not use TLS (very few these days), or for any that use old versions of TLS if their threat model includes someone with close to nation-state resources attacking their connections individually.
It also probably doesn't hurt to be paranoid and rotate anyway, but it should be with a proper understanding of the threats, not because of some ridiculous "the sky is falling" incorrect information like this.
Everyone is discounting one thing - State actor possibility behind this attack.
With state actor comes completely different ball game - totally different budget and capabilities to crack things. NOBODY knows what their unpublicized capabilities could be! So it is good practice to stay vigilant!
Banking info, email, etc would all be protected by encryption in transit (HTTPS or TLS), so an MItM attack shouldn't affect them. The attacker would only know what hosts you were communicating with, any unencrypted headers (ex. TLS SNI), but not the actual data itself.