Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Whistleblower: Ubiquiti Breach “Catastrophic”

krebsonsecurity.com

Post reply on HN
Print view View original

341–350 of 815 posts

Re: Whistleblower: Ubiquiti Breach “Catastrophic”

#341

Post by sofixa »

ryan29 wrote: post #179
yabones wrote: post #7

> “The breach was massive, customer data was at risk, access to customers’ devices deployed in corporations and homes around the world was at risk.” > “They were able to get cryptographic secrets for single sign-on cookies and remote access, full source code control contents, and signing keys exfiltration,” Maybe putting your network control plane in 'the cloud' isn't such a good idea after all... Edit: Just re-read…

It's odd how the big cloud vendors have been able to escape criticism for being completely open by default. Other vendors have been taken to task and have adopted better security practices. For example, SuperMicro IPMI comes with a random password now. It's extremely difficult to lock down an AWS account when there are a bajillion services, IAM policies, roles, etc.. I've been trying for the last few days and it's so…

Uhm.. in the AWS i've used, it's on explicit allow, and all of their docs and tutorials start with IAM and what's needed and why. What more do you want? I can't imagine IAM being simpler while being as granular as it is. You just have to actually take the time to learn about it, like every system. It's still drastically easier to use it securely than doing something on a similar scale and detail manually.

Re: Whistleblower: Ubiquiti Breach “Catastrophic”

#342

Post by [deleted] »

colineartheta wrote: post #306
rsync wrote: post #189

Earlier quoted context omitted.

Now rewrite your entire comment with s/ubiquiti/sonos/g. So much wasted potential ... so much customer goodwill wasted because (apparently) no company is worth running unless it is a publicly traded unicorn.

Just curious (I agree with you), but what are the s/ and /g for? Samsung and Google?

[deleted]

Re: Whistleblower: Ubiquiti Breach “Catastrophic”

#343

Post by IgorPartola »

jiveturkey wrote: post #260
IgorPartola wrote: post #43

Earlier quoted context omitted.

Was shopping for alternatives to my Ubiquiti last night. Seems like there is nothing good out there. Engenius has shit hardware and a cloud controller. Aruba has a cloud controller AND you have to pay for a license. Cisco makes you pay for a license. TP-Link is cloud-based. WTF. Does anyone have a decent WAP where I can use PoE, deploy like 5 of them and have them support roaming between APs, all managed locally? Is…

ubiquiti is fine. you don't have to use the cloud controller. CLI works just fine, at least the products I have used.

The featured article seems to say to me that they are far from fine.

Re: Whistleblower: Ubiquiti Breach “Catastrophic”

#344

Post by gorgoiler »

It seems naive to want to talk to the press under a pseudonym — Adam, in this case.

When looking for leakers internal security auditors don’t need proof you are Adam in order to fire you. They just put enough pressure on the most likely Adams such that they quit.

You will be one of them. If another Adam does so, so be it. Your actions likely flushed the other leaker when you thought you were the only one. You won’t be able to handle the pressure. Neither could she.

Adieu, Adam, et al.

Re: Whistleblower: Ubiquiti Breach “Catastrophic”

#345

Post by hn_throwaway_99 »

noinsight wrote: post #18

> ”Ubiquiti had negligent logging (no access logging on databases) so it was unable to prove or disprove what they accessed” Perversely, this is exactly the logging that you want to have in place in case of a breach. You can then (factually) make the statement that ”we have no evidence any customer data was accessed.”

Better solution: never store unencrypted PII/PCI/PHI/etc. in the database. There are loads of tokenization solutions (Very Good Security got a bunch of buzz a couple years back) that do this, or alternatively all of the big cloud providers have key services (KMS on AWS and Google, Key Vault on Azure) so that you can ensure that every decryption attempt is tracked and logged.

If you need to search on some of this data you should use blind indexes (Google blind index for more info).

Re: Whistleblower: Ubiquiti Breach “Catastrophic”

#346

Post by anticristi »

rectang wrote: post #238
yabones wrote: post #7

> “The breach was massive, customer data was at risk, access to customers’ devices deployed in corporations and homes around the world was at risk.” > “They were able to get cryptographic secrets for single sign-on cookies and remote access, full source code control contents, and signing keys exfiltration,” Maybe putting your network control plane in 'the cloud' isn't such a good idea after all... Edit: Just re-read…

> can we really trust them to clean up all their tokens and fully eradicate all forms of persistence the hackers may have gotten? The state of security in the tech industry is miserable. The only companies we should trust not to leak our data are those that never collected it in the first place.

We are certainly not having this conversation enough. I regularly chat with a risk office and she keeps telling me: Data minimization is your first line of defense.

Re: Whistleblower: Ubiquiti Breach “Catastrophic”

#347

Post by kazen44 »

rectang wrote: post #238
yabones wrote: post #7

> “The breach was massive, customer data was at risk, access to customers’ devices deployed in corporations and homes around the world was at risk.” > “They were able to get cryptographic secrets for single sign-on cookies and remote access, full source code control contents, and signing keys exfiltration,” Maybe putting your network control plane in 'the cloud' isn't such a good idea after all... Edit: Just re-read…

> can we really trust them to clean up all their tokens and fully eradicate all forms of persistence the hackers may have gotten? The state of security in the tech industry is miserable. The only companies we should trust not to leak our data are those that never collected it in the first place.

Heck, most operating systems are leaky by default. Even openBSD, which has a stellar trackrecord in terms of security and "goes against the grain" on many decisions for the sake of secure by default (for instance, disabling hyperthreading altogether to prevent any kind of SPECTRE vulnerability) is under constant scrutiny for not being secure enough.

Maybe connecting everything to a network and making it a high value target by collecting everyone's data is just a terrible idea in the long run.

Re: Whistleblower: Ubiquiti Breach “Catastrophic”

#348

Post by sigstoat »

briangerman wrote: post #287
heavyset_go wrote: post #261

Earlier quoted context omitted.

Look into Mikrotik hardware and OpenWRT. Of the Mikrotik-based hardware I'm familiar with, they support PoE. OpenWRT supports roaming and mesh networks, and is a local solution, as opposed to a cloud-based one. There are no licenses you need to pay for, either.

I just ordered a mikrotik 10gb https://mikrotik.com/product/crs305_1g_4s_in . The guys at work recommended it so hoping for the best!

i've got one of those, and another mikrotik 10gb switch. whatever the 16 port one is.

they've been working nicely. i have good luck with fiber SFP+ modules, but it seems picky about 1G copper SFP modules, fwiw.

Re: Whistleblower: Ubiquiti Breach “Catastrophic”

#349

Post by betterunix2 »

Jnr wrote: post #271
betterunix2 wrote: post #98

Earlier quoted context omitted.

Mikrotik, but unfortunately getting reasonable throughput for wireless clients is a serious challenge (I always have better results with openwrt on the same hardware). Still, nice to have local control and not have to rely on some cloud service just to use the hardware I bought.

I wonder what is reasonable WiFi throughput for you? With my 5 year old Mikrotik hAP AC I am able to get up to 500 Mbit/s on lan. And my old phone now shows 250 Mbit/s on speedtest.net both directions. How much more are we talking about? Have I missed some big hardware upgrade recently?

Using 80Mhz channels I found the default configuration never exceeded 200Mbit/s using iperf. For me "reasonable" is closer to 800Mbit/s, which is roughly the theoretical limit for 80Mhz with 2 spatial streams. I run my tests with my devices sitting 1 meter from the AP. This is on a hAP AC, and like I said, I get much better performance (close to the theoretical max) running OpenWRT on the same unit. I have had similar issues with the RB4011 and cAP AC, and in both the NYC area and suburban Virginia (so it is not just an issue of spectrum crowding in the city).

Re: Whistleblower: Ubiquiti Breach “Catastrophic”

#350

Post by fangorn »

IgorPartola wrote: post #101
Scramblejams wrote: post #72

Earlier quoted context omitted.

No, TP-Link's Omada controller can be run locally, I do that at home and at my parents' house. It is not cloud-connected unless you turn that on. Runs surprisingly well on a Raspberry Pi 2, actually. I've got a setup similar to what you're asking for. The TP-Link APs (AC1750, AC1350 and AC1200) support PoE, they're in a wireless mesh, support roaming, and all configuration is handled with one interface, no cloud invo…

How is the experience otherwise? Roaming? Throughput? Reliability? I generally like their hardware.

I bought 3 EAP330s and TP-Link deprecated them after a year or so. No more firmware upgrades for their (then) top "enterprise" access points. Rumour says they weren't happy with the chipset, so decided to abandon them altogether (just this model, cheaper ones were on different chipsets and support was available for longer). Last time I checked there was no OpenWRT support of any kind. They did hang when I had port aggregation enabled and seemed to run rather hot. But feature-wise and non-trunked-networking-wise they were fine, supported what I was looking for, no cloud, I didn't even use the controller, you can just manage them "the old school" way. But don't count on years of support.
Post reply on HN