Security Holes Discovered in 2 Popular VPN Services
VPN services work by passing traffic through an encrypted tunnel, which providers say can help preserve your privacy and security online. However, two of the most popular VPNs were, at least for a time, exposing users to a serious security flaw could let attackers run arbitrary code on an affected computer.
According to a post from Cisco Talos security researchers, both NordVPN and ProtonVPN suffered from vulnerabilities in the way their desktop clients accessed VPN services. The bugs, known as CVE-2018-3952 and CVE-2018-4010, opened the door to so-called privilege escalation attack. The attacker could, in theory, run any code they wanted as a regular user with administrator privileges.
The vulnerabilities might never have been discovered if not for a separate exploit that both providers patched several months ago. Following the CVE-2018-10169 in April, security researchers from Talos started looking for similar exploits. They found it was still possible to force the NordVPN and ProtonVPN clients to run arbitrary code via the newly detailed methods.
According to Talos, the Windows clients for both VPN services execute OpenVPN binaries per the permission of a logged-in user. For example, you could use the NordVPN or ProtonVPN client to activate a VPN connection with a server in a particular location. The client executed the necessary binary on your system to make the connection. The original CVE-2018-10169 allowed attackers to substitute a malicious OpenVPN file that could hijack a connection.
Both services deployed a fix for CVE-2018-10169 in April, but Talos discovered a coding mistake in the patch. As a result, it was still possible to run arbitrary code when the user clicked “connect.” For both exploits, the attacker needed to have access to the victim’s PC prior to exploiting the VPN services. Talos alerted both VPN providers earlier this year and withheld disclosure until new patches were pushed out to users.
ProtonVPN solved the problem by moving the OpenVPN configuration files into the installation directory where non-administrator users can’t modify them. NordVPN implemented an XML model to generate OpenVPN configuration files, and non-administrator users cannot edit the XML template.
If you use either of these VPN services, make sure you update your client to the latest build. Both NordVPN and ProtonVPN are keen to point out there is no evidence of the vulnerabilities being exploited in the wild. Still, better safe than sorry.
Continue reading
Asteroid Bennu Might Be Hollow and Doomed to Crumble
A new analysis from the University of Colorado Boulder’s OSIRIS-REx team suggests the Bennu is much less stable than expected. In fact, it could completely go to pieces in the coming eons.
Beyond Zoom: Virtual Gathering Spaces for the Holidays and Beyond
Software is not yet available for a complete metaverse experience, but there are some promising new communication platforms that might provide an intermediate step between Zoom and a full-blown metaverse.
Astronomers Find Oldest Supermassive Black Hole in the Universe
This recently spotted object is the oldest known quasar in the universe, with a supermassive black hole more than 13 billion years old. In fact, it's so old and huge that scientists don't know exactly how it could have formed.
The First Black Hole Ever Discovered Might Be Even Larger
Scientists have been looking for black holes ever since general relativity predicted such an object could exist. Cygnus X-1 made history in 1964 as the first likely candidate black hole. Astronomers have revisited Cygnus over the years, and a new analysis suggests the first black hole spotted by humanity might be larger and farther away than believed.