<story><title>NordVPN confirms it was hacked</title><url>https://techcrunch.com/2019/10/21/nordvpn-confirms-it-was-hacked/</url></story><parent_chain><item><author>LennyWhiteJr</author><text>&amp;gt; &lt;i&gt;The attacker gained access to the server — which had been active for about a month — by exploiting an insecure remote management system left by the datacenter provider, which NordVPN said it was unaware that such a system existed.&lt;/i&gt;&lt;p&gt;This screams for clarification and I&amp;#x27;d love for someone more knowledgeable in the area to elaborate on it. Is this common practice for data-center providers? Do I now not only have to worry about my own infrastructure security but also worry that my IaaS provider hasn&amp;#x27;t installed some backdoor to my servers?</text></item></parent_chain><comment><author>zeta0134</author><text>I work for a web hosting company in the US and at least in our case, it&amp;#x27;s quite common for remote management to be enabled on pretty much all of our dedicated hardware. However, because of the inherent dangers in opening this up to the public internet, unless explicitly requested by the customer (or Managed Colocation), the NIC used for Dell iDRAC or HP iLO is on an isolated network unique to the physical datacenter. Remote access for our techs is managed through a secured bridge that requires all sorts of security hoops on our company intranet, and remote access for general internet traffic is not available due to the firewall restrictions. While it&amp;#x27;s &lt;i&gt;plausible&lt;/i&gt; for remote access to be gained this way, it is extremely unlikely and would require several exploits at different points along the path.&lt;p&gt;I cannot speak for the industry as a whole, but remote management systems like this are bound to be common; any large enough physical datacenter is going to need a more efficient way to access a misbehaving system than sending a tech physically running to the box to plug in a keyboard and mouse. It &lt;i&gt;should&lt;/i&gt; be extremely uncommon to have these management interfaces open to the public though, and I&amp;#x27;ll bet that&amp;#x27;s what NordVPN is surprised by. Generally these systems should be private and isolated due to the power that an attacker can wield through them.</text></comment>
<story><title>NordVPN confirms it was hacked</title><url>https://techcrunch.com/2019/10/21/nordvpn-confirms-it-was-hacked/</url></story><parent_chain><item><author>LennyWhiteJr</author><text>&amp;gt; &lt;i&gt;The attacker gained access to the server — which had been active for about a month — by exploiting an insecure remote management system left by the datacenter provider, which NordVPN said it was unaware that such a system existed.&lt;/i&gt;&lt;p&gt;This screams for clarification and I&amp;#x27;d love for someone more knowledgeable in the area to elaborate on it. Is this common practice for data-center providers? Do I now not only have to worry about my own infrastructure security but also worry that my IaaS provider hasn&amp;#x27;t installed some backdoor to my servers?</text></item></parent_chain><comment><author>CiPHPerCoder</author><text>Sounds like an iDRAC exploit (assuming Dell servers).&lt;p&gt;But, yes, remote management is pretty common in datacenters. The fact that NordVPN wasn&amp;#x27;t aware of them just shows incompetence.</text></comment>