Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Whistleblower: Ubiquiti Breach “Catastrophic”

krebsonsecurity.com

Post reply on HN
Print view View original

121–130 of 815 posts

Re: Whistleblower: Ubiquiti Breach “Catastrophic”

#121

Post by the8472 »

IgorPartola wrote: post #104
Abishek_Muthian wrote: post #85

Earlier quoted context omitted.

> Does anyone have a decent WAP where I can use PoE There are PoE devices with OpenWRT support[1] and should be possible to enable 802.11r if they have the support. They can be managed locally even with self-signed certificate. [1] https://openwrt.org/toh/views/toh_poe-powered

I use OpenWRT now and would really rather avoid it. I want a central controller, not having every AP have its own UI. Plus firmware updates area always an adventure.

OpenWRT also provides SSH access and CLI tools, so if needed things can be automated the old-fashioned way.

Re: Whistleblower: Ubiquiti Breach “Catastrophic”

#123

Post by mattmcknight »

IgorPartola wrote: post #43
yabones wrote: post #7

> “The breach was massive, customer data was at risk, access to customers’ devices deployed in corporations and homes around the world was at risk.” > “They were able to get cryptographic secrets for single sign-on cookies and remote access, full source code control contents, and signing keys exfiltration,” Maybe putting your network control plane in 'the cloud' isn't such a good idea after all... Edit: Just re-read…

Was shopping for alternatives to my Ubiquiti last night. Seems like there is nothing good out there. Engenius has shit hardware and a cloud controller. Aruba has a cloud controller AND you have to pay for a license. Cisco makes you pay for a license. TP-Link is cloud-based. WTF. Does anyone have a decent WAP where I can use PoE, deploy like 5 of them and have them support roaming between APs, all managed locally? Is…

You are going to end up paying for a license to cover security updates. I use Fortinet, not cheap.

Re: Whistleblower: Ubiquiti Breach “Catastrophic”

#124

Post by jackweirdy »

IgorPartola wrote: post #101
Scramblejams wrote: post #72

Earlier quoted context omitted.

No, TP-Link's Omada controller can be run locally, I do that at home and at my parents' house. It is not cloud-connected unless you turn that on. Runs surprisingly well on a Raspberry Pi 2, actually. I've got a setup similar to what you're asking for. The TP-Link APs (AC1750, AC1350 and AC1200) support PoE, they're in a wireless mesh, support roaming, and all configuration is handled with one interface, no cloud invo…

How is the experience otherwise? Roaming? Throughput? Reliability? I generally like their hardware.

Great without it. The major improvement I noticed with it, is 802.11k & v (faster handoff).

Without those, it takes a little longer for the device to switch APs at the borders of their coverage. Mostly imperceptible, but the longer handoff times can be enough to kill a phone call over iPhone WiFi calling

Re: Whistleblower: Ubiquiti Breach “Catastrophic”

#125

Post by mywittyname »

liaukovv wrote: post #94
ak217 wrote: post #78

Earlier quoted context omitted.

The root account credentials should be used to create a privileged IAM user and then physically locked away in a box after setting up a hardware MFA device (plus a backup MFA) for the root account: https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practi... The privileged IAM user should then be used to administer other IAM users and roles. All IAM users should be required to have hardware security keys like Yubi…

But how fast a determined attacker will be able to utilize acquired physical key? Is something like kidnapping in the threat model for companies like ubiquiti?

> Is something like kidnapping in the threat model for companies like ubiquiti?

I doubt it. That's going to raise some blinking red flags on the radar of organizations you don't want to be on the radar of. Not just three-letter federal organizations, but three-letter news organizations too. The current situation is Yet Another Security Breach that will be forgotten about in 15 minutes. But a kidnapping is interesting! People will be making documentaries and shit about that.

It's so much easier and cheaper to bribe people than it is to kidnap them.

Re: Whistleblower: Ubiquiti Breach “Catastrophic”

#126

Post by Google234 »

vmception wrote: post #12

> Adam wrote in his letter. “Legal overrode the repeated requests to force rotation of all customer credentials, and to revert any device access permission changes within the relevant period.” tsk.

This actually seems like criminal advice.

Re: Whistleblower: Ubiquiti Breach “Catastrophic”

#127

Post by pseudalopex »

zerkten wrote: post #100
dec0dedab0de wrote: post #36

Cloud managed anything has a giant red target painted on it. Especially infrastructure equipment. I'm still surprised anyone think's it's ok to use their ISP provided router and wifi, let alone having it be managed remotely by the manufacturer.

The problem is that on-prem isn't much better in many cases. Only the largest organizations have the capability to operate deep defenses against these threats whether it's the cloud, or the on-prem. If you and your team have the skills you can operate fairly effectively on a small scale, but that's a pretty luxurious situation. Most home users can't tell the difference between a router and cable modem hence it's in t…

The problem isn't Ubiquiti using AWS. It's Ubquiti forcing customers to use cloud authentication.

Re: Whistleblower: Ubiquiti Breach “Catastrophic”

#128

Post by neuronic »

toomuchtodo wrote: post #25
650REDHAIR wrote: post #13

Earlier quoted context omitted.

What a shockingly large breech. Wow.

The breaches are common, the reporting/discovery of them is not. Security just isn’t a priority for a lot of Orgs, as the consequences are minimal (see: Equifax) due to a lack of regulatory or financial penalty pain when a breach occurs. “Help yourself to a free year of identify theft insurance” and all that jazz.

This is correct. Worked for a fairly large corp with lots of customer data and while I haven't witnessed breaches of said data it's pretty much a matter of time.

Me and my colleagues always pushed for more secure setups and configs but the common rebuttal was "no need there's a keycloak running several layers above and you need to use a VPN and need access to AWS first, go implement features instead."

I hope for them that no rogue employee decides to play around a bit or that no one stores their credentials in some cloud LastPass account with a '123456qwerty' master password.

Re: Whistleblower: Ubiquiti Breach “Catastrophic”

#129

Post by jmuguy »

Ueland wrote: post #114
imiric wrote: post #64

Earlier quoted context omitted.

Wow, that's awful. I have a few Ubiquiti devices I haven't updated in months, that don't use any cloud accounts, and I used to run their controller software in a container that I only started when I needed to administer something. But now I guess I'm never updating and will be looking to get rid of all their equipment. What an incredibly consumer hostile and incompetent company. Shame, because the hardware pretty muc…

Im a bit confused by this. I run a UniFi Controller in a docker container, have a few APs and a router, and everything works fine. No cloud stuff going on here. Am i just lucky or something that i havent been forced to the cloud yet, or is it something i am missing here?

I think its just the cloud key. I have a unifi controller install as well and use a local account with no issues.

Re: Whistleblower: Ubiquiti Breach “Catastrophic”

#130

Post by agurk »

IgorPartola wrote: post #101
Scramblejams wrote: post #72

Earlier quoted context omitted.

No, TP-Link's Omada controller can be run locally, I do that at home and at my parents' house. It is not cloud-connected unless you turn that on. Runs surprisingly well on a Raspberry Pi 2, actually. I've got a setup similar to what you're asking for. The TP-Link APs (AC1750, AC1350 and AC1200) support PoE, they're in a wireless mesh, support roaming, and all configuration is handled with one interface, no cloud invo…

How is the experience otherwise? Roaming? Throughput? Reliability? I generally like their hardware.

I run a similar setup with a bunch of EAP-225 APs controlled by a local instance of their Omada software (running on x64 rather that on ARM).

I've been very happy with roaming/throughput/reliability generally. The EAP-225 is 2x2, which they don't readily announce. Their newer and more expensive units are available as 4x4. That being said they're so cheap, I've been happy just to throw more onto the network.

For the software to manage them it uses some kind of multicast identification scheme to find new APs. If you're on a different subnet then it won't be able to automatically see them. They have a tool to connect to the AP and give it the management server IP, but that's Windows only.

The other option (that I went for) is just to create a management VLAN (good practice anyway) that the controller and APs live on. This is specifically supported by the APs.

Post reply on HN