Whistleblower: Ubiquiti Breach “Catastrophic” • Hacker News Board

Re: Whistleblower: Ubiquiti Breach “Catastrophic”

#101

Post by IgorPartola » Tue, Mar 30, 2021, 7:14 PM UTC

Scramblejams wrote: post #72

IgorPartola wrote: post #43

Earlier quoted context omitted.

Was shopping for alternatives to my Ubiquiti last night. Seems like there is nothing good out there. Engenius has shit hardware and a cloud controller. Aruba has a cloud controller AND you have to pay for a license. Cisco makes you pay for a license. TP-Link is cloud-based. WTF. Does anyone have a decent WAP where I can use PoE, deploy like 5 of them and have them support roaming between APs, all managed locally? Is…

No, TP-Link's Omada controller can be run locally, I do that at home and at my parents' house. It is not cloud-connected unless you turn that on. Runs surprisingly well on a Raspberry Pi 2, actually. I've got a setup similar to what you're asking for. The TP-Link APs (AC1750, AC1350 and AC1200) support PoE, they're in a wireless mesh, support roaming, and all configuration is handled with one interface, no cloud invo…

How is the experience otherwise? Roaming? Throughput? Reliability? I generally like their hardware.

Re: Whistleblower: Ubiquiti Breach “Catastrophic”

#102

Post by wnevets » Tue, Mar 30, 2021, 7:15 PM UTC

Is it just me or are you no longer able to avoid the cloud with the latest software updates for unifi?

Re: Whistleblower: Ubiquiti Breach “Catastrophic”

#103

Post by aaomidi » Tue, Mar 30, 2021, 7:15 PM UTC

liaukovv wrote: post #45

meepmorp wrote: post #20

> Adam says the attacker(s) had access to privileged credentials that were previously stored in the LastPass account of a Ubiquiti IT employee, and gained root administrator access to all Ubiquiti AWS accounts, including all S3 data buckets, all application logs, all databases, all user database credentials, and secrets required to forge single sign-on (SSO) cookies. A root user user breach, seemingly on the organiza…

What is the right way store credentials to something like this? Hardware keys?

Hardware keys should be used to store stuff like:

- private keys for ssh, gpg, vpn auth

- 2fa for sudo access, password manager access, etc

Re: Whistleblower: Ubiquiti Breach “Catastrophic”

#104

Post by IgorPartola » Tue, Mar 30, 2021, 7:16 PM UTC

Abishek_Muthian wrote: post #85

IgorPartola wrote: post #43

Earlier quoted context omitted.

Was shopping for alternatives to my Ubiquiti last night. Seems like there is nothing good out there. Engenius has shit hardware and a cloud controller. Aruba has a cloud controller AND you have to pay for a license. Cisco makes you pay for a license. TP-Link is cloud-based. WTF. Does anyone have a decent WAP where I can use PoE, deploy like 5 of them and have them support roaming between APs, all managed locally? Is…

> Does anyone have a decent WAP where I can use PoE There are PoE devices with OpenWRT support[1] and should be possible to enable 802.11r if they have the support. They can be managed locally even with self-signed certificate. [1] https://openwrt.org/toh/views/toh_poe-powered

I use OpenWRT now and would really rather avoid it. I want a central controller, not having every AP have its own UI. Plus firmware updates area always an adventure.

Re: Whistleblower: Ubiquiti Breach “Catastrophic”

#105

Post by modeless » Tue, Mar 30, 2021, 7:16 PM UTC

Should have blown the whistle to the SEC instead. SEC whistleblowers get paid. Up to 30% of eventual penalties paid by the company with no upper limit. Lying about a breach could be securities fraud.

Re: Whistleblower: Ubiquiti Breach “Catastrophic”

#106

Post by cced » Tue, Mar 30, 2021, 7:16 PM UTC

Terretta wrote: post #34

Arrath wrote: post #21

Shit, I had plans to refresh the network infrastructure in my parent's place with a full ubiquiti setup to replace the years of added on junk.

Parent’s place? Go Eero Pro. Your future time management self will thank you.

Does their gear have any cloud offerings?

Re: Whistleblower: Ubiquiti Breach “Catastrophic”

#107

Post by akkartik » Tue, Mar 30, 2021, 7:16 PM UTC

bedhead wrote: post #96

blablabla123 wrote: post #83

Earlier quoted context omitted.

The hardware is very cheap and the market for their products is thriving. In fact it's possible to put custom software on it actually without using their cloud. > if you did nothing but read about them on HN, Reddit, et al, you would think they're filing for bankruptcy tomorrow, set orphanages on fire, kill puppies, etc. I need to check these posts ;)

Seriously I'm just tired of it. Do you know how many tech geeks over the last few years have proudly proclaimed online that the company is "going downhill" and they'll never buy any more Ubiquiti products? 50 billion, that's how many. How many follow through? Evidently zero. It's comical. The hack obviously not good, but GMAFB.

Can you elaborate on what break this is that you desire? What would you like to have happen?

Re: Whistleblower: Ubiquiti Breach “Catastrophic”

#108

Post by neartheplain » Tue, Mar 30, 2021, 7:17 PM UTC

Don’t have time to dig into this right now, but I have a Ubiquiti WiFi AP at my home behind a NAT; does this breach mean my home network is vulnerable/effectively exposed to the Internet? Do I need to log off HN and deal with this now, or can it wait?

Re: Whistleblower: Ubiquiti Breach “Catastrophic”

#109

Post by TedDoesntTalk » Tue, Mar 30, 2021, 7:17 PM UTC

Scramblejams wrote: post #72

IgorPartola wrote: post #43

Earlier quoted context omitted.

Was shopping for alternatives to my Ubiquiti last night. Seems like there is nothing good out there. Engenius has shit hardware and a cloud controller. Aruba has a cloud controller AND you have to pay for a license. Cisco makes you pay for a license. TP-Link is cloud-based. WTF. Does anyone have a decent WAP where I can use PoE, deploy like 5 of them and have them support roaming between APs, all managed locally? Is…

No, TP-Link's Omada controller can be run locally, I do that at home and at my parents' house. It is not cloud-connected unless you turn that on. Runs surprisingly well on a Raspberry Pi 2, actually. I've got a setup similar to what you're asking for. The TP-Link APs (AC1750, AC1350 and AC1200) support PoE, they're in a wireless mesh, support roaming, and all configuration is handled with one interface, no cloud invo…

Are you concerned that TP-Link is a Chinese company? Could your data be exfiltrated back to China?

Re: Whistleblower: Ubiquiti Breach “Catastrophic”

#110

Post by dolni » Tue, Mar 30, 2021, 7:17 PM UTC

IgorPartola wrote: post #43

yabones wrote: post #7

> “The breach was massive, customer data was at risk, access to customers’ devices deployed in corporations and homes around the world was at risk.” > “They were able to get cryptographic secrets for single sign-on cookies and remote access, full source code control contents, and signing keys exfiltration,” Maybe putting your network control plane in 'the cloud' isn't such a good idea after all... Edit: Just re-read…

Was shopping for alternatives to my Ubiquiti last night. Seems like there is nothing good out there. Engenius has shit hardware and a cloud controller. Aruba has a cloud controller AND you have to pay for a license. Cisco makes you pay for a license. TP-Link is cloud-based. WTF. Does anyone have a decent WAP where I can use PoE, deploy like 5 of them and have them support roaming between APs, all managed locally? Is…

So the question for becomes: is there just not a good enthusiast market for this stuff? I have met a number of people who are "network nerds", so I'm inclined to think the market does exist. With any of the plethora of consumer devices (Linksys, Netgear, D-Link) it's a dice roll whether your gear is complete garbage or not. A lot of the time, you're coming up snake eyes.

I've got some Ubiquiti gear I bought a couple years ago. Like you, I want good quality gear that I can manage myself. I don't need a bunch of fancy corporate garbage, like link aggregation or cloud management. Give me solid, hardware accelerated routing and switching, flexibility over my local DNS, and maybe some VLANing.

I was running Linux on a small x86 box as my last network router. Maybe it's time to get back to that. That or go back to banging rocks together. Haven't decided which, yet.