NordVPN Hack – Everything You Need to Know

This guide takes a deep dive into the recent NordVPN hack and examines the facts surrounding the situation, with the latest developments.

Recently media outlets have been publishing a barrage of reports concerning a NordVPN hack occurring on a server in Finland. Rumors and allegations have been spreading fast, with NordVPN being one of the largest VPNs on the market.

While the news may be alarming to some, the tangible impact of this issue for NordVPN users is quite limited.

NordVPN hack: summary of facts

First, to put things in perspective, this hack affected one NordVPN server in Finland out of a network of approximately 5,000 servers. Now let’s examine what exactly happened to this server.

In March 2018, someone posted TLS certificates from NordVPN, TorGuard, and VikingVPN on 8chan. While the 2018 post seems to have fallen under the radar, the issue recently erupted on Twitter, which culminated in an article from TechCrunch alleging NordVPN had been “hacked”.

What could a hacker do with an expired TLS key?

When people hear the word “hack” they assume the worst. But let’s dig deeper.

As NordVPN pointed out in their official response,

The intruder did find and acquire a TLS key that has already expired. With this key, an attack could only be performed on the web against a specific target and would require extraordinary access to the victim’s device or network (like an already-compromised device, a malicious network administrator, or a compromised network). Such an attack would be very difficult to pull off. Expired or not, this TLS key could not have been used to decrypt NordVPN traffic in any way. That’s not what it does.

This was an isolated case, and no other servers or datacenter providers we use have been affected.

This leads us to the next question.

Are NordVPN users compromised?

Based on all available evidence, the answer appears to be no. NordVPN users have not been compromised by an attacker gaining access to one expired TLS key for a single server in Finland.

First, the hacker would not have any access to server logs because NordVPN is a no logs VPN provider that does not store anything on its servers. NordVPN passed a third-party audit by PricewaterhouseCoopers verifying its no-logs policy.

Second, NordVPN utilizes perfect forward secrecy, which generates a unique key for every session using ephemeral Diffie-Hellman keys. This means that even with a TLS key there’s little a hacker could even do, since the keys are used for server authentication and not traffic encryption. As NordVPN pointed out above, the hacker would need direct access to the user’s device or network for an effective attack  (extremely unlikely).

Does this hack even affect anyone?

There’s no way to be 100% certain with anything, but the answer appears to be no.

There’s no evidence to suggest traffic or private data from NordVPN users was exploited in this hack. With no data breach, there is no legal obligation for alerting anyone.

How did the hacker get the TLS keys?

The answer to this question does not seem to be clear – at least to me.

NordVPN is blaming the data center in Finland, as they explained in their official response:

The breach was made possible by poor configuration on a third-party datacenter’s part that we were never notified of. Evidence suggests that when the datacenter became aware of the intrusion, they deleted the accounts that had caused the vulnerabilities rather than notify us of their mistake. As soon as we learned of the breach, the server and our contract with the provider were terminated and we began an extensive audit of our service.

Meanwhile, the data center is blaming NordVPN in a piece published in The Register:

“Yes, we can confirm they were our clients,” Viskari continued. “And they had a problem with their security because they did not take care of it themselves.

“All servers we provide have the iLO or iDRAC remote access tool, and as a matter of fact this remote access tool has security problems from time to time, as almost all software in the world. We patched this tool as new firmware was released from HP or Dell.

Finally, there may be a third explanation – a disgruntled employee. The founder of VikingVPN, who is no longer associated with VikingVPN, suggested on reddit that,

this sounds more like a disgruntled employee at Nord or the datacenter leaking the keys rather than a “hacker.”

So here we have three different possibilities for how the hacker could have obtained the expired TLS key of the NordVPN server in Finland. Regardless, as we’ve explained above, the impact for NordVPN users is essentially null.

NordVPN provides a summary of events

Before publishing this article, I asked NordVPN for clarification on a few points. One of their representatives provided me with the following summary:

• There are no signs showing that any of our customers were affected or that their data was accessed by the malicious actor.
• The server itself did not contain any user activity logs. None of our applications send user-created credentials for authentication, so usernames and passwords couldn’t have been intercepted.
• Our service as a whole was not hacked; our code was not hacked; the VPN tunnel was not breached. The NordVPN applications are unaffected. It was an individual instance of unauthorized access to 1 of more than 5000 servers we have.
• The hacker managed to access this server because of the mistakes made by the data center owner, of which we were not aware.
• As soon as we found out about the issue, we ceased our relationship with this particular data center and shredded the server.
• It is not possible to decrypt any ongoing or recorded VPN session even if someone obtained private keys from VPN server. Perfect Forward Secrecy (with Diffie-Hellman key exchange algorithm) is in use. Keys from VPN server are used only to authenticate the server and not for encryption.

Timeline of events from NordVPN:

1. The affected server was brought online on January 31st, 2018.
2. Evidence of the breach appeared in public on March 5th, 2018. *Further evidence suggests that this information only became available soon after the breach actually occurred.
3. The potential for unauthorized access to our server was restricted when the data center deleted the undisclosed management account on March 20th, 2018.
4. The server was shredded on April 13, 2019 – the moment we suspected a possible breach.

NordVPN’s network security upgrades

To further improve security, NordVPN announced the following plans in their response:

Since the discovery, we have taken all the necessary means to enhance our security. We have undergone an application security audit, are working on a second no-logs audit right now, and are preparing a bug bounty program. We will give our all to maximize the security of every aspect of our service, and next year we will launch an independent external audit of all of our infrastructure.

As noted above, NordVPN is already one of the few VPN providers that have undergone a full third-party audit to verify their no-logs claims. This audit was completed in November 2018 and it appears a second audit is currently underway.

Additionally, NordVPN has told me they will reconfigure their server network to run in RAM-disk mode only. This indeed is a more secure setup over traditional hard drives as nothing can be stored on the server. Perfect Privacy runs their network this way and ExpressVPN has also transitioned to running all servers in RAM-disk, which they call the TrustedServer feature.

Closing thoughts on the NordVPN “hack”

NordVPN is probably the most popular VPN provider on the market. Consequently, it has a big target on its back in a viciously competitive sector. This may explain why this “hack” blew up in the first place with media outlets jumping on the clickbait bandwagon, before researching the scope of the issue and how it even affects NordVPN users.

People appear to be somewhat divided on the issue. Some argue this shouldn’t even be called a “hack” as it involved an expired TLS key on a single server in Finland with no access to user data or traffic. Others are following the tune of TechCrunch and denouncing NordVPN.

Despite the recent outcry and barrage of clickbait headlines, there appears to be little, if any, impact on NordVPN users – even those who were using the Finland server in March 2018. As such, I don’t see any reason to sound the alarm and advocate a mass exodus away from NordVPN. Although the current issue is concerning, it’s not catastrophic by any stretch of the imagination.

Hopefully, NordVPN will use this as an opportunity to realign their priorities with more focus on security and improving their VPN.