NordVPN's Server Hacked and TLS Private Keys Stolen

NordVPN recently disclosed that one of their servers was compromised by attackers and claimed that no credentials were stolen, no logs were present, and the scope of the attack was very small. NordVPN places the blame for their compromise on their hosting provider and largely underplayed the severity of the attack. Notably, the CEO of their hosting company refuted NordVPN's claims and told the public that NordVPN is very lax on security, especially compared to other VPN providers that they host. Furthermore, it was revealed that the attack was much more serious than stated -- NordVPN's private TLS keys were leaked and valid from March through October 2018.

Recommendations

Monitor social network chatter regarding further NordVPN security issues.
Consider creating your own VPN or hosting a VPN provider on infrastructure that you own.
Use VPN software and providers with a good track record of security and privacy.

Details

NordVPN has reported a third party breach in their network. Apparently, this network breach happened in March of 2018 and NordVPN was only made aware of the incident a few months ago. One of NordVPN’s servers in a data center in Finland was accessed without authorization. The attacker obtained access by using a remote management software that was left behind by the data center operatives. NordVPN responded that the compromised server did not contain user activity logs, that none of their applications send user-created credentials, and no other servers were affected.

The severity of the attack is greater than NordVPN stated, however. There is evidence that the TLS keys for the compromised server were stolen in May of 2018. According to DarkDotFail, there was evidence that NordVPN was hacked and their TLS certificates compromised on 8chan. Additionally, their hosting provider responded to the allegations by NordVPN that they had left remote management software on their servers and claimed that NordVPN doesn’t take security seriously and they are trying to pin the blame onto their server provider (Figure 1).

Figure 1. Response from the CEO of the server provider.

In Figure 2, the supposed hacker advises against using NordVPN and links to some dropped text files from the hacker’s session showing compromised NordVPN boxes, .bash_history, and private keys of the NordVPN servers. The attacker appears to have full control over the containers and the data going into and out of the containers. At the time of the attack, due to forward secrecy of the TLS certificates, only the past hour of traffic could be decrypted with the stolen keys. However, future traffic masquerading as the legitimate NordVPN would be possible which could lead to further compromising of all future messages.

Figure 2. 8chan post showing compromised NordVPN TLS private keys.

However, it seems that the expired private TLS keys were leaked, meaning anyone can setup a server with their expired credentials. One Twitter user hexdefined showed how to create a server with the expired credentials that appears to come from nordvpn.com.

To demonstrate the potential issue, the user hexdefined set up a fraudulent version of the NordVPN site using the leaked private keys of the server. Figure 3 shows a localhost version of the NordVPN site using the leaked keys. Figure 4 shows a user visiting the fake site with compromised credentials and an example misconfiguration message that would be visible to a user if they accessed the site. The message warns of an expired key and a potentially misconfigured end-user clock. If the user wants to know more information about the potential attack, they will be greeted with another warning dialog (Figure 5) that goes into further details about a potentially misconfigured end-user system time. Also accompanying the warning is the admonition that if the configuration error is not on the end-user’s system, then there is nothing that the user can do. Finally, when the user accepts the risk of visiting the site, they are greeted with a message “this is not NordVPN” (Figure 6), while showing a properly authenticated TLS session in the URL bar.

Figure 3. Running the server with the expired NordVPN credentials.

Figure 4. A user visiting the fraudulent server and being confronted with a server misconfigured error. Due to the expired credentials, the user is asked to check if their computer’s clock is misconfigured.

Figure 5. A user examining the severity of the expired certificate error, which expired over a year ago.

Figure 6. A user accepting the risks of the fraudulent server and proceeding to the site.

Because NordVPN did not realize they had been compromised between March and early October, 2018, their users remained vulnerable to man-in-the-middle attacks that could have been launched with valid TLS certificates, for this entire period. NordVPN has largely not taken responsibility for the errors they made and have constantly downplayed the severity of the incident. The use of valid TLS certificates makes it highly unlikely that a victim would even realize that they were under attack. At this time it is unclear if the attack had been used in the wild while the certificates were valid. Despite the attack happening on only 1 of their 3000 servers, it is clear that a motivated attacker could have easily launched compromised TLS sessions.