1RUG931VDLGWKDWWKHDWWDFNHUZDVDEOHWRQDEWKH7UDQVSRUW/D\HU
6HFXULW\NH\XVHGWRYHULI\DVLWHLVDFWXDOO\UXQE\1RUG9317RU*XDUG
VDLGWKDWLWPDQDJHVLWVFHUWL¿FDWHDXWKRULW\NH\VLQVXFKDZD\WKDWWKH
NH\VDUHQRWVWRUHGGLUHFWO\RQWKHVHUYHU%RWKFRPSDQLHVVLGWKDWWKH\
ZHUHSUHYLRXVO\DZDUHRIWKHLQWUXVLRQRQWKHLUVHUYHUVDQGKDGDOUHDG\
WDNHQVWHSVWRPLWLJDWHIXWXUHDWWDFNV7RU*XDUG931GLVFORVHGWKH
DWWDFNVKRUWO\DIWHULWZDVPDGHDZDUHRILW1RUG931GLGQRWSXEOLFO\
GLVFORVHWKHLVVXHXQWLO2FWREHUVW
,¶OOQRWHWKDW,KDYHEHHQPDGHDZDUHRIDQRQJRLQJOHJDOFDVHEHWZHHQ
1RUG931DQG7RU*XDUG931WKDWLVFRQQHFWHGWRWKHVHEUHDFKHV:H
JHQHUDOO\GRQRWORRNDWSULYDWHOHJDOFRPSODLQWVDVSDUWRIRXUUHYLHZV
DQGWKDWLVWKHFDVHKHUH
,W¶VFOHDUWKHDWWDFNHUKDGSULYLOHJHGDFFHVVWKDWVKRXOGQRWKDYHEHHQ
DYDLODEOHWRDQ\RQH7KHLQIRUPDWLRQWKDWZDVREWDLQHGLQWKHDWWDFNLV
YHU\YDOXDEOHEXWERWK1RUG931DQG7RU*XDUGVDLGWKDWWKH
LQIRUPDWLRQZRXOGKDYHEHHQGL̇FXOWWRXVHLQSUDFWLFH
+HUH¶VKRZ3&0DJUHSRUWHU0LFKDHO.DQFKDUDFWHUL]HGDSRWHQWLDO
DWWDFN
“Stealing [NordVPN’s] TLS key did open the door for what’s called
DμPDQLQWKHPLGGOHDWWDFN¶ZKLFKFDQH[SRVH\RXUWUDI¿F
unencrypted, to the hacker. But pulling off such a scheme wouldn’t
be easy. It would require the creation of a dummy NordVPN client,
and then tricking a user into installing it, which ultimately would
have only victimized one computer.”
,QDQHPDLOWRPH1RUG931GRZQSOD\HGWKHSRWHQWLDOIRUDWWDFNVWKLV
ZD\
“Essentially, the attack would require quite extraordinary access to
the user’s network or device for it to be possible. Such an attack, in
theory, could be performed by a malicious or compromised ISP, a
malicious Wi-Fi network, an intrusive Wi-Fi network admin (like a
XQLYHUVLW\RURI¿FHQHWZRUN RUDKDFNHUZKRDOUHDG\KDVDFFHVVWR
your device.”
M
a
x
E
d
d
y
