NordVPN俾人hack咗

同佢講唔只tls certificate 喎
https://web.archive.org/web/20180504001844/https://ghostbin.com/paste/azk4r

佢條private key會expire
呢個機制係一度保障/防線
唔明你地咁驚做咩

佢個網private key俾人偷咋
唔撚係個server
On9?

1同2係關公災難但係唔關比人hack事
3話我哋等緊工程師嘅報告收到之後會馬上發出公眾聲明講解今次俾人攞到條Key嘅事

https://web.archive.org/web/20180504001844/https://ghostbin.com/paste/azk4r

有4部VPN server嘅root access

Diffie-Hellman用public key加密溝通用既secret key
再用secret key加密溝通
假如黑客知道條private key
佢要再知道條secret key係咩
先可以破解到d traffic
不過key pair同secret都會有時限
會expire
其實好安全
我理解係咁

咁痴線?

有冇Lihkg仔因為裝左vpn上deep web?

跟著一隊FBI上門捉人？

推

NordVPN 食人血饅頭架
一出蒙面法
佢當日，即刻係咁搵kol sell,
Nord VPN話因為蒙面法，
所以想搵佢地賣廣告，有優惠

根本係食死人錢

朋友同我講的

在商言商
邊個唔想發國難財?

係
佢爆個部VM 入面有4部VPN server 喺container
fr30 - fr33
我應該要加埋
唔知佢爆嘅呢部server 係咪production server 嚟
不過有root access
過期tls 已經好少問題
問題係究竟有無server 係有vulnerability 而未patch

有冇師兄去customer service 小佢地?
俾咁多錢用佢服務
D server未harden好咁hihi

如果佢全部都同一set野deploy
可能全部compromise哂

身為IT9
我只可以講
有好多未為人知嘅vulnerability
你永遠都唔會知你有無問題

但係
如果個vulnerability 係已經有patch
而真係無patch 到server
呢件事係抵屌

Anyway 可以聽咗解釋先

係
可能同一時期deploy 嘅server 都有事

要聽下佢解釋先

頭先live chat 左CS,佢地既臨時reply 係咁，應該個個問佢都係咁答

hello, *********!
TLS certificate was used only to access the website, the only way to abuse it is to perform a complicated and personalized MiTM attack. It can not be used to decrypt any of past web sessions due to Diffie-Hellman keys and is in no way related with VPN traffic.
We will release a public comment today to explain what happened, however there are no signs indicating that any of our user data have been at risk.

有冇IT 巴幫手研究下個reply?

屌咩