Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ubiquiti Networks Breach

mailchi.mp

Post reply on HN
Print view View original

211–220 of 486 posts

Re: Ubiquiti Networks Breach

#211

Post by floatboth »

fivesixzero wrote: post #75
comboy wrote: post #25

Argh, why do I learn about this from HN when they pretty much force me through the cloud login with UDM-Pro. Nothing in the dashboard. Also I think http://unifi/ is crap from a security standpoint. Their threat management also seems to be just some kind of a bad joke.They could for example do a nice hardware based honeypot that you have to untrigger with physical access. They could offer so much more for prosumers pr…

I’ve become a big fan of MikroTik routers and 10G/SFP+ router/switch hardware in the last few years. Their web UI and SSH console are a bit quirky but the performance is pretty great for the price. My primary use case for their gear at home was to have a router that can handle a LACP WAN bond for my fancy cable modem as well as connecting to a 10G Ethernet switch via copper or direct-attached SFP+ to a CRS-305 10G sw…

> connecting to a 10G Ethernet switch via copper or direct-attached SFP+

> RB-4011 was a perfect fit

Huh, isn't RB4011 the one with the very weird "you can't use a DAC in the SFP+ port" limitation?

> haven’t explored their WiFi products yet

They seem extremely underwhelming, especially in terms of software support :(

https://help.mikrotik.com/docs/display/ROS/WifiWave2 — they're finally barely rolling out WPA3, MU-MIMO/beamforming, 802.11w — in an optional beta package for a beta version of the OS, currently on 4 devices, breaking 2.4ghz on one of them, and breaking CAPsMAN (centralized management).

Re: Ubiquiti Networks Breach

#212

Post by ashtonkem »

fullstop wrote: post #99
ashtonkem wrote: post #60

As someone who was planning on buying Ubiquiti hardware for their house, this breach and a lot of the comments here are disconcerting. Are there any other alternatives that are more locally managed that people would recommend?

I use a fair amount of their equipment at home and I don't think that you need to be concerned with this. I run my controller on a server in my basement, and no part of it (besides the WAN port on my ERL) touch the internet. There is no "cloud" requirement. The "dream machine" thing I don't get. I do like their Unifi AP line, though.

Honestly, because I don’t really have any network equipment (not even a real switch yet), so the dream machine pro actually reduces a lot of the purchasing I’d have to do to get everything working. I could cobble together it’s functionality out of other parts ... if I already owned those parts. But by the time I bought a home server and a real switch, I’d be out more than the Dream Machine Pro costs.

Assuming it does everything it says it will on the tin, of course.

Re: Ubiquiti Networks Breach

#213

Post by hendersoon »

frisco wrote: post #210
jaywalk wrote: post #176

Earlier quoted context omitted.

On the landing page after you log in, click Users at the bottom. Then click Add User or Add Admin, and just set the Account Type to Local Access Only.

Oh but this doesn't actually disable remote access on the UDM side, does it? It's just a flag that the cloud host can choose to respect?

You need to go to the settings for the UDM/UDMP itself, not the network controller, and disable remote access there. It's a bit hidden.

Re: Ubiquiti Networks Breach

#214

Post by linsomniac »

Johnny555 wrote: post #148
linsomniac wrote: post #141

Earlier quoted context omitted.

I'm in the process of replacing my home Ubiquiti infrastructure. Here's what I've decided on: Replace the US-24-250W PoE switch with an Aruba Networks S2500-24P (gigabit and PoE, 4x 10gig ports, quiet). Replace the Cloud Key Gen 2 with BlueIris for camera controller. I expect this will be able to connect to the existing Ubiquiti cameras. Possibly add one or more Ruckus R610 APs running in "Unleashed" mode to augment…

The reason most people go with Ubiquiti for home use is the price -- that Aruba switch costs $3500 new. The ubiquiti switch costs about 1/10th that at $399. Can you get free firmware updates from Aruba or do you need a support contract?

I guess I could have pointed it out more clearly: I'm going "used enterprise" as the route for replacement. As you say, yes, this switch was $2500 new (that's what I saw when I looked), but I bought one for under $100 on ebay.

Similarly for the Ruckus R610 AP I mentioned: Those APs were a grand new, but you can get them for a bit over $100 on ebay. Linus Tech Tips did a comparison of it with other consumer units, doing heavy multi-device streaming, and Ruckus was the clear winner.

Yes, Ubiquiti looks like a good value and they make some very interesting products. I've used some of them to great effect over the years. But my experience with the NVR and cameras and switch and Cloud Key has been relatively bumpy. Enough so that I'm ready to ditch the convenience for up-front loading and hopefully day-to-day more realible.

Re: Ubiquiti Networks Breach

#215

Post by ashtonkem »

dustinmoris wrote: post #111
ashtonkem wrote: post #60

As someone who was planning on buying Ubiquiti hardware for their house, this breach and a lot of the comments here are disconcerting. Are there any other alternatives that are more locally managed that people would recommend?

I have a TP-Link Mesh network in my house. I have high speed WiFi even in my garden. 50+ devices connected. Took me 30min to install everything. Didn’t have a single issue in 3 years yet. Saved lots of money in comparison to Ubiquiti. But what do I know, I only use internet for normal activities like smart home stuff, streaming, working and so on...

Running copper is a hard requirement for me for other reasons, so at that point I might as well go with a non-mesh setup as well.

If I was renting again, I’d consider using tp-links gear.

Re: Ubiquiti Networks Breach

#216

Post by varenc »

ahepp wrote: post #91
fivesixzero wrote: post #75

Earlier quoted context omitted.

I’ve become a big fan of MikroTik routers and 10G/SFP+ router/switch hardware in the last few years. Their web UI and SSH console are a bit quirky but the performance is pretty great for the price. My primary use case for their gear at home was to have a router that can handle a LACP WAN bond for my fancy cable modem as well as connecting to a 10G Ethernet switch via copper or direct-attached SFP+ to a CRS-305 10G sw…

Do you know how ubiquiti's "edge" line compares to mikrotik?

Ubiquiti has a polished interface that's relatively simple to use for something with enterprise-ish level features. They also have some pretty good docs. For example, their article on the harms of Broadcast/Multicast packet storms [0] is useful even if you're not using their products. Same goes for the RF Antenna patterns docs [1].

That said, my next router/gateway won't be from Ubiquiti. Though I'll keep using UI access points for now.

[0] https://help.ui.com/hc/en-us/articles/115001529267-UniFi-Man...

[1] https://help.ui.com/hc/en-us/articles/115012664088-UniFi-Int...

Re: Ubiquiti Networks Breach

#217

Post by floatboth »

pimeys wrote: post #138
centimeter wrote: post #122

Earlier quoted context omitted.

FWIW, I tried using OpenWRT on a box with similar specs to yours and it was a nightmare. Ended up using FreeBSD instead and it was a vastly better experience. I think OpenWRT might only be worth it on very low-spec hardware.

Hey! Could you please share what you think didn't work so well with OpenWRT? I'm currently running a Turris Omnia with their custom OpenWRT that I know how to use and it's been working quite well. What's missing is a better CPU to run Wireguard encryption full speed through our fast internet connection. I'm seriously thinking about pfSense or Opnsense, but FreeBSD still misses native Wireguard support, leaving the en…

Wireguard has been merged into upstream FreeBSD almost a couple months ago.

Re: Ubiquiti Networks Breach

#218

Post by fivesixzero »

floatboth wrote: post #211
fivesixzero wrote: post #75

Earlier quoted context omitted.

I’ve become a big fan of MikroTik routers and 10G/SFP+ router/switch hardware in the last few years. Their web UI and SSH console are a bit quirky but the performance is pretty great for the price. My primary use case for their gear at home was to have a router that can handle a LACP WAN bond for my fancy cable modem as well as connecting to a 10G Ethernet switch via copper or direct-attached SFP+ to a CRS-305 10G sw…

> connecting to a 10G Ethernet switch via copper or direct-attached SFP+ > RB-4011 was a perfect fit Huh, isn't RB4011 the one with the very weird "you can't use a DAC in the SFP+ port" limitation? > haven’t explored their WiFi products yet They seem extremely underwhelming, especially in terms of software support :( https://help.mikrotik.com/docs/display/ROS/WifiWave2 — they're finally barely rolling out WPA3, MU-MI…

I had to get an active DAC cable (S+AO0005) for the RB-4011 because of the quirk you mentioned. Works great with the active cable, which was about $50 I think. I was glad I read the manual beforehand. :)

Thanks for the update on the WiFi side of things. Seems likely that I’ll be looking to another vendor for APs, but that’s fine.

Re: Ubiquiti Networks Breach

#219

Post by Spooky23 »

comboy wrote: post #25

Argh, why do I learn about this from HN when they pretty much force me through the cloud login with UDM-Pro. Nothing in the dashboard. Also I think http://unifi/ is crap from a security standpoint. Their threat management also seems to be just some kind of a bad joke.They could for example do a nice hardware based honeypot that you have to untrigger with physical access. They could offer so much more for prosumers pr…

Aruba is a few notches up. But any of the cheaper companies use merchant silicon, open source services, etc.

Honestly, unifi is great for what it is. What kind of IPS do you expect for $100?

If you want less risk, you need to move up the $ ladder.

Re: Ubiquiti Networks Breach

#220

Post by floatboth »

imposterr wrote: post #184
comboy wrote: post #107

Earlier quoted context omitted.

Not USG but UDM-PRO. It was the first device from them that required me to make an ubiquiti account to set it up.

Well this is a disappointing development. I'm currently using EdgeRouter hardware, but was considering moving to their Unifi line for my next upgrade. Guess that's off the table till I can use these without cloud access.

Other comment seems to imply that only Unifi Protect really requires an account, not any of the networking functionality

https://news.ycombinator.com/item?id=25737660

Post reply on HN