Solved Weird NordVPN windows APP Update links to bizzarre url?

[Wallace_n_Gromit]

After I got a pop up notice that a new windows version of the Nordvpn app was available and OK'ed the download it required me to relogin to my account.

It opened up a browser session:

https://auth.zwyr157wwiu6eior.com/?preferred_flow=login&state=08662420232f48cc27b147110073b159&scope=openid%20offline%20email%20sessions.single%3Awrite&response_type=code&approval_prompt=auto&redirect_uri=https%3A%2F%2Fzwyr157wwiu6eior.com%2Fv1%2Fusers%2Foauth%2Fcallback&client_id=nordvpn

which then changed to:

https://nordaccount.com/login/identifier?challenge=34d13765d13141d9a9a8c0a319e9edb4

Who or what is [https://auth.zwyr157wwiu6eior.com]?

 

[L&LD]

And did you install it?

That first part of the URL is already suspicious enough for me to not have proceeded at all.

 

[Wallace_n_Gromit]

And did you install it?

That first part of the URL is already suspicious enough for me to not have proceeded at all.

No, I did not. As a result can't use my Nordvpn client app since it's been "updated" and won't allow me to go any further without "logging in". I was hoping that that site was a temporary one set up by Nordvpn like a CDN for this "update"

NOTE:

I first noticed this issue on a Widows 10 desktop that I've been troubleshooting today--It wouldn't do certain windows updates anymore. The pop up update showed up and I became wary when I saw that weird Url.

So I went to my primary desktop and went to nordvpn.com to find and download the windows app installer there. Strangely that app installer behaved the same way. So maybe it's legit?

With all this recent activity about supply chain hacks, you just don't know anymore.

 

[L&LD]

Uninstall it. Reboot the computer. Check the Program Files directories (both of them) for NordVPN installations and completely remove them. Do a full system scan with your AV.

Repeat the full system scan with an online AV scanner that you trust.

Reboot the computer after it is done.

Scan again with a different online AV scanner.

Reboot again and download the official NordVPN program for your computer.

I still would not install until I verified from the NordVPN website that the file you downloaded is from them, and is the latest too.

 

[ColinTaylor]

If you Google that domain name you'll see it's been discussed occasionally for a few years now. From what I can make out it looks to be legit (I see it when my NordVPN client starts up). I think it's used when the client verifies your account details.

 

[Wallace_n_Gromit]

Uninstall it. Reboot the computer. Check the Program Files directories (both of them) for NordVPN installations and completely remove them. Do a full system scan with your AV.

Repeat the full system scan with an online AV scanner that you trust.

Reboot the computer after it is done.

Scan again with a different online AV scanner.

Reboot again and download the official NordVPN program for your computer.

I still would not install until I verified from the NordVPN website that the file you downloaded is from them, and is the latest too.

Wow, very thorough. Concerning your last point: I'm trying to get a phone number for nordvpn/ start a chat session to see what they know about this. I think I'm pretty careful about my security but something like this happens and my hackles go up.

 

[Wallace_n_Gromit]

If you Google that domain name you'll see it's been discussed occasionally for a few years now. From what I can make out it looks to be legit (I see it when my NordVPN client starts up). I think it's used when the client verifies your account details.

Hey ColinTaylor, I was hoping you would chime in. I know you use Nordvpn from your prior posts.

The whole update GUI had changed and had never required logging into a Web session on a browser. Have other Nordvpn users, updating recently seen this?

Note: It is a bit enlightening what I'm reading about "https://auth.zwyr157wwiu6eior.com" after a duckduckgo search.

 

[ColinTaylor]

Hey ColinTaylor, I was hoping you would chime in. I know you use Nordvpn from your prior posts.

The whole update GUI had changed and had never required logging into a Web session on a browser. Have other Nordvpn users, updating recently seen this?

Note: It is a bit enlightening what I'm reading about "https://auth.zwyr157wwiu6eior.com" after a duckduckgo search.

Just checked for updates on my client and it says this:

What's new:
• Fixed: Anti-proxy. Logging in to the NordVPN app will work smoothly even if you're using a browser proxy extension. We can all get along.
More about NordVPN 6.34:
We took up a challenge of telling you what's new in 40 seconds. Go!
• New: From now on, you'll be logging in with your Nord Account – we'll take you to your browser to log in and then take you back to the app. If you ever decide to expand your protection beyond VPN, your Nord Account will work like magic when getting on board with other Nord Security products.
• Better: In addition to Windows 8.1 and Windows 10, split tunneling is now available on Windows 7 too.
• Fixed: Anti-splitter. This bug no longer gets in your way when using split tunneling.
• Fixed: The internet thief. Sometimes, it would stealthily do the mischievous work under the hood to leave you without an internet connection. Well, no more.
• Fixed: Fencer. This bug no longer prevents apps from accessing the IP address 127.0.0.1 with VPN disabled through split tunneling.
40 seconds. Nailed it.

 

[Nebulaz]

I can also confirm, that my nord client pushed me to "zwyr157wwiu6eior.com". And Yes searching the site has brought up some interesting reads.

 

[Wallace_n_Gromit]

I can also confirm, that my nord client pushed me to "zwyr157wwiu6eior.com". And Yes searching the site has brought up some interesting reads.

I typically ignored the window that popped up (like I do with EULA's) when Nordvpn was announcing new updates (with explanations of updated features/fixes) and merely clicked on the "update" button on my first two Desktops.

On my 3rd desktop (which I just booted up recently and was offered the NordVPN update), I carefully read what the update consisted of and confirm what ColinTaylor and you yourself discovered.