Incident: Credential-Stuffing Attack on NordVPN User Accounts in 2018

Published Date: 2019-11-01

Postmortem Analysis
Timeline 1. The software failure incident involving NordVPN occurred in 2018 [90807].
System 1. NordVPN system
Responsible Organization 1. Hackers who conducted credential-stuffing attacks [90807]
Impacted Organization 1. Up to 2,000 users of NordVPN were impacted by the software failure incident [90807].
Software Causes 1. The software failure incident was caused by credential-stuffing attacks that targeted up to 2,000 users of NordVPN, leading to unauthorized access to their accounts [90807].
Non-software Causes 1. Poor password practices by users, such as using simple passwords and reusing them across multiple sites, making them vulnerable to credential stuffing attacks [90807].
Impacts 1. Unauthorized access to up to 2,000 users' NordVPN accounts due to credential-stuffing attacks [90807]. 2. Exposure of users' credentials, including email addresses, plain-text passwords, and expiration dates, on online forums like Pastebin [90807]. 3. Use of stolen credentials from previous leaks and breaches to access NordVPN accounts [90807]. 4. Accounts of several users reportedly accessed by unauthorized individuals [90807]. 5. Need for users to change their passwords and avoid using the same password across multiple sites [90807].
Preventions To prevent the software failure incident where NordVPN users were targeted in credential-stuffing attacks, the following measures could have been taken: 1. Implementing Multi-Factor Authentication (MFA) for user accounts to add an extra layer of security beyond passwords [90807]. 2. Encouraging users to use unique and complex passwords for each online account to prevent credential stuffing attacks [90807]. 3. Regularly monitoring and auditing user credentials to detect any suspicious activities or unauthorized access attempts [90807]. 4. Educating users on the importance of cybersecurity best practices, such as avoiding password reuse and regularly changing passwords [90807].
Fixes To fix the software failure incident where NordVPN users were targeted in credential-stuffing attacks due to leaked credentials, the following actions could be taken: 1. Implement Multi-Factor Authentication (MFA) to add an extra layer of security beyond passwords [90807]. 2. Encourage users to use unique and strong passwords for each online account to prevent credential stuffing attacks [90807]. 3. Regularly monitor and audit user credentials to detect any unauthorized access or unusual login patterns [90807]. 4. Educate users on the importance of cybersecurity practices, such as using password managers and avoiding password reuse [90807]. 5. Conduct regular security assessments and penetration testing to identify and address vulnerabilities in the system [unknown].
References 1. Ars Technica [90807]

Software Taxonomy of Faults

Category Option Rationale
Recurring one_organization, multiple_organization (a) The software failure incident related to NordVPN's data breach in 2018 was not indicative of a breach on the network's servers but rather stemmed from credential stuffing, where credentials from previous leaks and breaches were used to access NordVPN accounts [90807]. This incident highlights the importance of users choosing strong, unique passwords and not reusing them across multiple sites to prevent unauthorized access to their accounts. NordVPN urged its customers to change their passwords and recommended checking Have I Been Pwned to see if their email addresses were listed in leaked credentials [90807]. (b) The incident involving NordVPN and credential stuffing is not unique to NordVPN but is a common issue across various online services. The credentials used to access NordVPN accounts were stolen from previous leaks and breaches that were unrelated to NordVPN, such as breaches from companies like Canva, Evite, 500px, LinkedIn, Dropbox, and MyHeritage [90807]. This highlights the broader problem of users using the same passwords across multiple accounts, making them vulnerable to credential stuffing attacks across different platforms.
Phase (Design/Operation) operation (a) The software failure incident related to the design phase: The incident involving NordVPN's data breach and unauthorized access to user accounts was not indicative of a breach on the network's servers. Instead, it was attributed to users choosing simple passwords and reusing them across multiple sites. The breach occurred due to credential stuffing, where credentials stolen from previous leaks and breaches were used to access NordVPN accounts [90807]. (b) The software failure incident related to the operation phase: The unauthorized access to NordVPN user accounts was a result of users' accounts being accessed by unauthorized individuals. This unauthorized access was facilitated by the use of stolen credentials from previous breaches, highlighting the importance of users changing their passwords to prevent such incidents [90807].
Boundary (Internal/External) outside_system From the provided article [90807], the software failure incident related to NordVPN's data breach can be analyzed as follows: (a) within_system: The incident of unauthorized access to NordVPN user accounts through credential stuffing was primarily due to users' credentials being stolen from previous leaks, breaches, and hacks that were not directly related to NordVPN. The company representative mentioned that the credentials used to access NordVPN accounts were from breaches of other companies like Canva, Evite, 500px, LinkedIn, Dropbox, and MyHeritage. This indicates that the failure originated from external breaches and leaks, not directly from within NordVPN's system. (b) outside_system: The software failure incident can also be attributed to factors outside the system, such as users choosing simple passwords and reusing them across multiple sites. This practice of using the same username and password combination across different platforms made it easier for attackers to gain unauthorized access to NordVPN accounts. The breach was not indicative of a breach on NordVPN's servers but rather stemmed from users' password management practices, which are external to the system itself.
Nature (Human/Non-human) non-human_actions (a) The software failure incident in the NordVPN data breach was primarily due to non-human actions. The incident involved credential-stuffing attacks where unauthorized access to user accounts was granted using credentials stolen from previous leaks and breaches unrelated to NordVPN [90807]. This type of attack does not involve direct human actions but rather exploits vulnerabilities in password reuse across multiple accounts.
Dimension (Hardware/Software) software (a) The software failure incident related to hardware: The incident reported in the article about NordVPN being the victim of a data breach in 2018 does not indicate any hardware-related failure. The focus of the incident was on credential-stuffing attacks and unauthorized access to user accounts due to leaked credentials, rather than any hardware issues [90807]. (b) The software failure incident related to software: The software failure incident reported in the article about NordVPN being targeted by credential-stuffing attacks and unauthorized access to user accounts was primarily due to software-related factors. The incident involved the misuse of credentials, password security issues, and vulnerabilities in the authentication system, indicating a failure originating in software aspects rather than hardware [90807].
Objective (Malicious/Non-malicious) malicious (a) The software failure incident related to NordVPN was malicious in nature. The incident involved credential-stuffing attacks where unauthorized access was granted to user accounts using stolen credentials from previous leaks and breaches. The attackers targeted up to 2,000 users of NordVPN, and the credentials used were obtained from breaches of other companies like Canva, Evite, 500px, LinkedIn, Dropbox, and MyHeritage [90807].
Intent (Poor/Accidental Decisions) accidental_decisions (a) The software failure incident related to NordVPN was not due to poor decisions but rather stemmed from users' poor password practices and the reuse of passwords across multiple accounts. The incident was a result of credential stuffing, where attackers used credentials from previous leaks and breaches to gain unauthorized access to NordVPN accounts [90807].
Capability (Incompetence/Accidental) accidental (a) The software failure incident related to development incompetence is not explicitly mentioned in the provided article [90807]. (b) The software failure incident related to accidental factors is evident in the article. The incident of unauthorized access to NordVPN accounts was a result of credential-stuffing attacks that granted unauthorized access to user accounts. The credentials used in the attack were stolen from previous leaks and breaches unrelated to NordVPN, such as breaches from companies like Canva, Evite, 500px, LinkedIn, Dropbox, and MyHeritage. This incident highlights the risk posed by users choosing simple passwords and reusing them across multiple sites, leading to unauthorized access [90807].
Duration temporary The software failure incident reported in Article 90807 regarding NordVPN's data breach can be categorized as a temporary failure. The incident was temporary because it was caused by specific circumstances, such as the unauthorized access due to credential-stuffing attacks that exploited leaked credentials from other breaches. The breach did not indicate a failure in NordVPN's network servers but rather stemmed from users' behavior of using simple passwords across multiple sites, leading to unauthorized access to their accounts [90807].
Behaviour value, other (a) crash: The article does not mention a crash as the cause of the software failure incident. (b) omission: The software failure incident in this case is not due to the system omitting to perform its intended functions at an instance(s). (c) timing: The software failure incident is not related to the system performing its intended functions correctly, but too late or too early. (d) value: The software failure incident is related to the system performing its intended functions incorrectly. Users' credentials, including email addresses, plain-text passwords, and expiration dates, were accessed by unauthorized individuals, leading to unauthorized account access [90807]. (e) byzantine: The software failure incident is not related to the system behaving erroneously with inconsistent responses and interactions. (f) other: The behavior of the software failure incident in this case is related to unauthorized access to user accounts due to stolen credentials from previous leaks and breaches, leading to the incorrect performance of the system's intended functions [90807].

IoT System Layer

Layer Option Rationale
Perception None None
Communication None None
Application None None

Other Details

Category Option Rationale
Consequence property, theoretical_consequence (d) property: People's material goods, money, or data was impacted due to the software failure. The software failure incident involving NordVPN resulted in unauthorized access to users' accounts due to credential-stuffing attacks. Users' credentials, including email addresses, plain-text passwords, and expiration dates, were posted on online forums, leading to accounts being accessed by unauthorized individuals. This breach exposed users' personal data and potentially put their privacy at risk [90807].
Domain information (a) The software failure incident involving NordVPN was related to the information industry. The incident involved a data breach where users' credentials, including email addresses and passwords, were compromised, leading to unauthorized access to their accounts [90807]. The incident highlighted the importance of using strong, unique passwords and avoiding password reuse across multiple accounts to enhance security in the information industry.

Sources

Back to List