Forest Global Training Partners

Cyber Risks · Krebs on Security

Avast, NordVPN Breaches Tied to Phantom User Accounts

Summary: Avast and NordVPN each disclosed months-long network intrusions that shared a common cause: forgotten or unknown user accounts granting remote access to internal systems with little more than a password. Avast said its breach ran from May to October 2019 and appeared to target CCleaner users, entering through stolen credentials for a temporary VPN profile that had erroneously been kept enabled and did not require 2FA; NordVPN said its March 2018 intrusion at a Finland datacenter exploited an insecure remote management system left by the datacenter provider.

Bottom line: Avast serves over 435 million users, and its prior CCleaner compromise led to some 2.27 million downloads of a corrupt version - a reminder that a single password-only remote access path into a security vendor reaches everyone downstream. NordVPN's exposed key sat on one of more than 3,000 servers, and the company says it did not disclose the exploit immediately because it could not quickly confirm no other infrastructure was prone to similar issues.

Read the original at Krebs on Security ↗

Topics
Data Breaches
Related