Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Whistleblower: Ubiquiti Breach “Catastrophic”

krebsonsecurity.com

Post reply on HN
Print view View original

81–90 of 815 posts

Re: Whistleblower: Ubiquiti Breach “Catastrophic”

#81

Post by bilbo0s »

bombcar wrote: post #42
toyg wrote: post #35

Earlier quoted context omitted.

If i were you I’d take heart in the knowledge that the others aren’t any better, it’s just a matter of “when” they’ll get cracked in the same way

Not every network hardware provider ties everything to a "Cloud" for reasons. They may have breaches but they won't be this widespread.

Wasn't really a "cloud" hack so much as a hack of a root user. How they accessed that root user's credentials is not detailed. Phishing? Hardware hack? Dumb root user and it was possible to guess his/her credentials? Could even be, that particular root user was in on it with them for all we know?

In any case, this sort of a hack of any other company's root users would result in the same spectacularly catastrophic pwnage. That your root users have root access on your own machines won't help you.

What they need is to structure their security properly. I'm not sure why this user needed root access to everything globally for instance? That seems wrong to me at first blush, but it could be a matter of me not understanding their business model.

Re: Whistleblower: Ubiquiti Breach “Catastrophic”

#82

Post by surfsvammel »

ptomato wrote: post #65
IgorPartola wrote: post #43

Earlier quoted context omitted.

Was shopping for alternatives to my Ubiquiti last night. Seems like there is nothing good out there. Engenius has shit hardware and a cloud controller. Aruba has a cloud controller AND you have to pay for a license. Cisco makes you pay for a license. TP-Link is cloud-based. WTF. Does anyone have a decent WAP where I can use PoE, deploy like 5 of them and have them support roaming between APs, all managed locally? Is…

Ruckus Unleashed is what you're looking for.

They are triple the cost of the UniFi stuff. So not really a drop in replacement.

Re: Whistleblower: Ubiquiti Breach “Catastrophic”

#83

Post by blablabla123 »

bedhead wrote: post #56

Ubiquiti is another one of these companies where if you did nothing but read about them on HN, Reddit, et al, you would think they're filing for bankruptcy tomorrow, set orphanages on fire, kill puppies, etc. The negative hyperbole around this company is something else, hack or not. And yet, all they do is thrive...

The hardware is very cheap and the market for their products is thriving. In fact it's possible to put custom software on it actually without using their cloud.

> if you did nothing but read about them on HN, Reddit, et al, you would think they're filing for bankruptcy tomorrow, set orphanages on fire, kill puppies, etc.

I need to check these posts ;)

Re: Whistleblower: Ubiquiti Breach “Catastrophic”

#85

Post by Abishek_Muthian »

IgorPartola wrote: post #43
yabones wrote: post #7

> “The breach was massive, customer data was at risk, access to customers’ devices deployed in corporations and homes around the world was at risk.” > “They were able to get cryptographic secrets for single sign-on cookies and remote access, full source code control contents, and signing keys exfiltration,” Maybe putting your network control plane in 'the cloud' isn't such a good idea after all... Edit: Just re-read…

Was shopping for alternatives to my Ubiquiti last night. Seems like there is nothing good out there. Engenius has shit hardware and a cloud controller. Aruba has a cloud controller AND you have to pay for a license. Cisco makes you pay for a license. TP-Link is cloud-based. WTF. Does anyone have a decent WAP where I can use PoE, deploy like 5 of them and have them support roaming between APs, all managed locally? Is…

> Does anyone have a decent WAP where I can use PoE

There are PoE devices with OpenWRT support[1] and should be possible to enable 802.11r if they have the support. They can be managed locally even with self-signed certificate.

[1] https://openwrt.org/toh/views/toh_poe-powered

Re: Whistleblower: Ubiquiti Breach “Catastrophic”

#86

Post by daniellarusso »

jsmith99 wrote: post #54
IgorPartola wrote: post #43

Earlier quoted context omitted.

Was shopping for alternatives to my Ubiquiti last night. Seems like there is nothing good out there. Engenius has shit hardware and a cloud controller. Aruba has a cloud controller AND you have to pay for a license. Cisco makes you pay for a license. TP-Link is cloud-based. WTF. Does anyone have a decent WAP where I can use PoE, deploy like 5 of them and have them support roaming between APs, all managed locally? Is…

Technically, Ubiquiti does have a local option. You can run the controller locally and disable cloud login.

It still checks for firmware updates, right?

Re: Whistleblower: Ubiquiti Breach “Catastrophic”

#87

Post by jrudolph »

liaukovv wrote: post #45
meepmorp wrote: post #20

> Adam says the attacker(s) had access to privileged credentials that were previously stored in the LastPass account of a Ubiquiti IT employee, and gained root administrator access to all Ubiquiti AWS accounts, including all S3 data buckets, all application logs, all databases, all user database credentials, and secrets required to forge single sign-on (SSO) cookies. A root user user breach, seemingly on the organiza…

What is the right way store credentials to something like this? Hardware keys?

AWS root user accounts are kind of an achillis heel in every enterprise setup using AWS. What you typically do is MFA (bare minimum) + sharded secrets. This means you need multiple people to use the root user account. You can also hook in additional audit controls eg by automating cloud watch and sending notifications about any root user login. Alternative is that you throw away the password and vow to never use it, or set up an account recovery process (all of this may not be a great idea as it can fail when you need it most).

The situation is somewhat more relaxed with GCP Billing Accounts and Azure EA Accounts, though they have better separation of concerns than AWS (billing vs. workload access). Nonetheless, never give these passwords to finance department lest they store it in an excel sheet on a SharePoint. Access to these credentials allows anyone to suspend billing for an entire enterprise... not sure what controls the providers have in place to verify any of this before initiating automated shutdown of all workloads.

Re: Whistleblower: Ubiquiti Breach “Catastrophic”

#88

Post by dmlittle »

NovemberWhiskey wrote: post #66
liaukovv wrote: post #45

Earlier quoted context omitted.

What is the right way store credentials to something like this? Hardware keys?

For AWS root account? Generate a long random password, print it out and then lock it in a safe without allowing anyone to see it. Turn on 2FA and then lock the second factor in a different safe. There’s virtually never a need for the root account and it’s impossible to attenuate (by design).

This is a lot harder to do if you have lots of AWS accounts and create new ones over time on-demand (e.g. AWS account per team).

Re: Whistleblower: Ubiquiti Breach “Catastrophic”

#89

Post by nitrogen »

tgsovlerkhgsel wrote: post #9
speeder wrote: post #5

I wonder why their legal department would PREVENT them from saving their users. What legal reason would exist for that? I thought legal would instead force them to save their users, since otherwise they would risk getting sued by all of them by all the damages caused or something.

Successfully sweeping it under the carpet means you don't get sued for the mistakes you made. Legal isn't there to make sure the company complies with the laws. Legal is there to advise on and minimize legal risk.

Legal isn't there to make sure the company complies with the laws. Legal is there to advise on and minimize legal risk.

"It's not like we're building bridges or something." -- any legal department when faced with engineers' ethical duty to report a hack.

Re: Whistleblower: Ubiquiti Breach “Catastrophic”

#90

Post by [deleted] »

bedhead wrote: post #56

Ubiquiti is another one of these companies where if you did nothing but read about them on HN, Reddit, et al, you would think they're filing for bankruptcy tomorrow, set orphanages on fire, kill puppies, etc. The negative hyperbole around this company is something else, hack or not. And yet, all they do is thrive...

[deleted]
Post reply on HN