Whistleblower: Ubiquiti Breach “Catastrophic” • Hacker News Board

Re: Whistleblower: Ubiquiti Breach “Catastrophic”

#171

Post by xvf22 » Tue, Mar 30, 2021, 7:38 PM UTC

Grazester wrote: post #116

yabones wrote: post #7

> “The breach was massive, customer data was at risk, access to customers’ devices deployed in corporations and homes around the world was at risk.” > “They were able to get cryptographic secrets for single sign-on cookies and remote access, full source code control contents, and signing keys exfiltration,” Maybe putting your network control plane in 'the cloud' isn't such a good idea after all... Edit: Just re-read…

There is Fortinet(which acquired Meru 5 years ago). Meru was pretty OK. I helped manage a setup of 2500 + access points on a campus. I left that job 6 months after Meru was acquired so I cant say how they are now.

Got 3 no brainer CVEs against them. We're an enterprise customer who is now moving away because after Fortinet acquired them support dropped off a cliff. They had some good people but it bacame rather apparent that there was a bit of a toxic culture there.

Re: Whistleblower: Ubiquiti Breach “Catastrophic”

#172

Post by bedhead » Tue, Mar 30, 2021, 7:39 PM UTC

tw04 wrote: post #157

bedhead wrote: post #56

Ubiquiti is another one of these companies where if you did nothing but read about them on HN, Reddit, et al, you would think they're filing for bankruptcy tomorrow, set orphanages on fire, kill puppies, etc. The negative hyperbole around this company is something else, hack or not. And yet, all they do is thrive...

It's a long-tail if I had to guess. In my "circle" of coworkers almost every last one has ubiquiti today, and every last one is planning to replace it with something else when they make the jump to WiFi-6. Maybe we're the anomaly, but I have a feeling 2 years from now if they continue down the path they're on, their earnings will not be quite so rosy.

My point is partly, let's check in a year from now. I'd wager not one of your coworkers switched. Zero.

Re: Whistleblower: Ubiquiti Breach “Catastrophic”

#173

Post by _pplp » Tue, Mar 30, 2021, 7:39 PM UTC

yabones wrote: post #7

> “The breach was massive, customer data was at risk, access to customers’ devices deployed in corporations and homes around the world was at risk.” > “They were able to get cryptographic secrets for single sign-on cookies and remote access, full source code control contents, and signing keys exfiltration,” Maybe putting your network control plane in 'the cloud' isn't such a good idea after all... Edit: Just re-read…

> can we really trust them

absolutely not

Re: Whistleblower: Ubiquiti Breach “Catastrophic”

#174

Post by ex_ubiquiti » Tue, Mar 30, 2021, 7:40 PM UTC

_pplp wrote: post #91

I am 100% not surprised. I spent a year working for Ubiquiti, running the Network Controller team. Trust me, this whistle-blower "Adam" (I have a few suspicions of who it actually is), toned it down. The reality is much much worse.

I worked at Ubiquiti while you were there. I can confirm that the company was going downhill fast.

The US offices were starting to feel empty because so many people were leaving the company. Only place I've ever worked where engineers would quit before they got another job.

Saddest part was all the wasted potential. There were good engineers making good products at Ubiquiti only a few years ago. Once UniFi exploded in popularity the CEO started trying to micromanage everything and it all started falling apart.

Re: Whistleblower: Ubiquiti Breach “Catastrophic”

#175

Post by oblio » Tue, Mar 30, 2021, 7:40 PM UTC

the8472 wrote: post #121

IgorPartola wrote: post #104

Earlier quoted context omitted.

I use OpenWRT now and would really rather avoid it. I want a central controller, not having every AP have its own UI. Plus firmware updates area always an adventure.

OpenWRT also provides SSH access and CLI tools, so if needed things can be automated the old-fashioned way.

I don't know about you, but I "automate the old-fashioned way" at my day job, I want the damned thing to just work without me bothering with "SSH access and CLI tools" at home.

Re: Whistleblower: Ubiquiti Breach “Catastrophic”

#176

Post by antattack » Tue, Mar 30, 2021, 7:40 PM UTC

IgorPartola wrote: post #43

yabones wrote: post #7

> “The breach was massive, customer data was at risk, access to customers’ devices deployed in corporations and homes around the world was at risk.” > “They were able to get cryptographic secrets for single sign-on cookies and remote access, full source code control contents, and signing keys exfiltration,” Maybe putting your network control plane in 'the cloud' isn't such a good idea after all... Edit: Just re-read…

Was shopping for alternatives to my Ubiquiti last night. Seems like there is nothing good out there. Engenius has shit hardware and a cloud controller. Aruba has a cloud controller AND you have to pay for a license. Cisco makes you pay for a license. TP-Link is cloud-based. WTF. Does anyone have a decent WAP where I can use PoE, deploy like 5 of them and have them support roaming between APs, all managed locally? Is…

Omada EAP245. You can use appliance and/or software controller that you can run locally, to manage your APs no cloud needed.

https://www.tp-link.com/us/business-networking/ceiling-mount...

Re: Whistleblower: Ubiquiti Breach “Catastrophic”

#177

Post by stock_toaster » Tue, Mar 30, 2021, 7:40 PM UTC

bpye wrote: post #76

benjohnson wrote: post #57

Earlier quoted context omitted.

It's a shame that Mikrotik doesn't have a easy to use global GUI. It's the right hardware, and great firmware and wonderful flexibility - but it needs an easy to use GUI controller to make the simple stuff easy to take over from Ubiquiti.

These recent posts about Ubiquiti have made me look again at MikroTik. Their hardware is more affordable than I had remembered. Is there any good intro to their hardware - there are certainly a lot more options than you get with Ubiquiti. Even before now there are some limitations with UniFi that have annoyed me. Setting up more complex DNS and firewall rules requires editing the JSON config. IPv6 tunnelling isn’t we…

I use the edgerouter line for firewalls, and unifi (running on a local "cloud key", with cloud login turned off) for only access-points and some switches.

This news (covering up, legal overriding good security practices) is super concerning though, and I'm definitely going to start looking around as well.

Re: Whistleblower: Ubiquiti Breach “Catastrophic”

#178

Post by nwmcsween » Tue, Mar 30, 2021, 7:41 PM UTC

IgorPartola wrote: post #104

Abishek_Muthian wrote: post #85

Earlier quoted context omitted.

> Does anyone have a decent WAP where I can use PoE There are PoE devices with OpenWRT support[1] and should be possible to enable 802.11r if they have the support. They can be managed locally even with self-signed certificate. [1] https://openwrt.org/toh/views/toh_poe-powered

I use OpenWRT now and would really rather avoid it. I want a central controller, not having every AP have its own UI. Plus firmware updates area always an adventure.

I'll let you in on a little secret, Ubiquity runs openwrt as can be seen by sshing into any uaps

Re: Whistleblower: Ubiquiti Breach “Catastrophic”

#179

Post by ryan29 » Tue, Mar 30, 2021, 7:42 PM UTC

yabones wrote: post #7

> “The breach was massive, customer data was at risk, access to customers’ devices deployed in corporations and homes around the world was at risk.” > “They were able to get cryptographic secrets for single sign-on cookies and remote access, full source code control contents, and signing keys exfiltration,” Maybe putting your network control plane in 'the cloud' isn't such a good idea after all... Edit: Just re-read…

It's odd how the big cloud vendors have been able to escape criticism for being completely open by default. Other vendors have been taken to task and have adopted better security practices. For example, SuperMicro IPMI comes with a random password now.

It's extremely difficult to lock down an AWS account when there are a bajillion services, IAM policies, roles, etc.. I've been trying for the last few days and it's so difficult that I can understand things like this. I don't think it's acceptable, but I can see how it happens.

I think the expectation for AWS, Azure, GCP, etc. needs to change. Accounts should allow nothing by default and part of the tutorial / learning process should be understanding the permissions needed for each service and how to limit access to those services. As a bonus, they should show you how to configure Budget Actions to catch anomalies and runaway services. For example, I'm trying to set up my account so SMTP access to SES gets revoked for SMTP users if the message count exceeds a certain threshold. It's really, really hard because there's not a single document / guide that shows the process from start to finish.

Re: Whistleblower: Ubiquiti Breach “Catastrophic”

#180

Post by taldo » Tue, Mar 30, 2021, 7:42 PM UTC

coder543 wrote: post #146

IgorPartola wrote: post #77

Earlier quoted context omitted.

No, a local controller that you run on a machine inside your LAN.

That's basically what MikroTik CAPsMAN is, depending on your needs. I think it's specific to Access Points, so not a general purpose centralized controller for MikroTik equipment, but... centralizing access point management seems to be the main thing under discussion here.

CAPsMAN is a royal PITA to set up. You have to manually add all the wifi channels, map each AP to the channels it'll use, and a lot of busywork. Once it's set up, though, it works fine, and lets you upgrade all devices from the manager, etc.