Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Whistleblower: Ubiquiti Breach “Catastrophic”

krebsonsecurity.com

Post reply on HN
Print view View original

371–380 of 815 posts

Re: Whistleblower: Ubiquiti Breach “Catastrophic”

#371

Post by genmud »

Quarrelsome wrote: post #303
genmud wrote: post #284

Earlier quoted context omitted.

I don't think that it is a solvable problem if the economics stay the same. SolarWinds is actually trading almost $2/share more than it did 1 year ago today ($15.67 v $17.23). Sure, it is down from its 52 week high ($24.34). I would argue that SolarWinds should not be allowed to be in business in its current form, considering what a threat they have been to themselves and others in their mis-handling their software p…

I feel like we have to regulate this at a governmental level to get anywhere. We keep automating more and more of our society and its clear we're unable to protect it but the casuals don't get that and keep charging ahead and we enable them. The amount of power we gift to a given attacker seems to just grow and grow. But how do we achieve political intervention when technologists and politics appear to be completely…

It is certainly a difficult problem and as such, like most difficult problems, it will likely not be fixed in any meaningful manner. We will likely be talking about this exact issue in 5 years, 10 years, and 20 years from now.

Cyberspace Solarium Commission [1] created a robust and well documented roadmap for the Biden transition team to address some of these fundamental problems. IMHO, it is one of the better policy documents and has a number of really good recommendations that I believe would be extremely helpful. The #1 thing I think we could do is address accountability, who is responsible for the security of devices/software and what legal recourse should people have if the vendor doesn't adequately secure or support their products.

I think that there are a bunch of issues and one of the biggest ones is that what we say vs what we do are 2 different things. We also have issues where many of the core business practices that are commonly accepted are incompatible with building a secure and resilient infrastructure.

[1] https://www.solarium.gov/public-communications/transition-bo...

Re: Whistleblower: Ubiquiti Breach “Catastrophic”

#372

Post by fullstop »

azernik wrote: post #362
IgorPartola wrote: post #43

Earlier quoted context omitted.

Was shopping for alternatives to my Ubiquiti last night. Seems like there is nothing good out there. Engenius has shit hardware and a cloud controller. Aruba has a cloud controller AND you have to pay for a license. Cisco makes you pay for a license. TP-Link is cloud-based. WTF. Does anyone have a decent WAP where I can use PoE, deploy like 5 of them and have them support roaming between APs, all managed locally? Is…

Disclaimer: worked for Meraki (now Cisco Meraki) for several years. Generally, halfway decent wireless APs are all targeted at the enterprise market. Consumer hardware is a brutal race to the bottom, as lay consumers aren't qualified to compare options based on anything but price and UI. Ubiquiti was an outlier in trying to bring enterprise features to the consumer market The problem for enthusiasts and small busines…

Surely 802.11r has a purpose, yes?

Re: Whistleblower: Ubiquiti Breach “Catastrophic”

#373

Post by api »

ryan29 wrote: post #151
dolni wrote: post #110

Earlier quoted context omitted.

So the question for becomes: is there just not a good enthusiast market for this stuff? I have met a number of people who are "network nerds", so I'm inclined to think the market does exist. With any of the plethora of consumer devices (Linksys, Netgear, D-Link) it's a dice roll whether your gear is complete garbage or not. A lot of the time, you're coming up snake eyes. I've got some Ubiquiti gear I bought a couple…

> So the question for becomes: is there just not a good enthusiast market for this stuff? No. They just don't want to serve the low end. I'm from SK, Canada and the vast majority of all businesses are small businesses. This site [1] says 98%. The problem is they only account for about 25% of the GDP, so vendors don't consider them worth serving. Everyone wants to sell to the 2% of the businesses that make up 75% of t…

I've thought for a while that the neglect of consumer, prosumer, and small business computing is a side effect of concentration of wealth. A small percentage of businesses have all the money.

Re: Whistleblower: Ubiquiti Breach “Catastrophic”

#374

Post by halefx »

spockz wrote: post #291
mixologic wrote: post #210

Earlier quoted context omitted.

I bought one of their security cameras to act as a nursery cam last year, which I could later convert into a home security camera. The 'in house' software, unifi-video, was discontinued 3 months after I got it set up. All of the apps I use to connect to the system have been pulled from the app store, and you now have to use their camera controller for the one camera, vs the software Im running on my linux box. Their…

I now use the camera in direct rtsp mode. This way it can be used by any rtsp tool including video recording and the lot. For the nursery camera I just use IPCams on iOS on an iPad.

Yep, I also use their cameras as baby monitors. RTSP mode to VLC on an old chromebook as an always-on monitor.

The Protect app works pretty well now assuming you have a controller to connect to, but the time between the Video app shutting down and Protect actually working properly was very frustrating. I would never trust the Protect app to stay connected while I'm asleep, though. It's definitely not stable enough for that.

Re: Whistleblower: Ubiquiti Breach “Catastrophic”

#375

Post by api »

IgorPartola wrote: post #43
yabones wrote: post #7

> “The breach was massive, customer data was at risk, access to customers’ devices deployed in corporations and homes around the world was at risk.” > “They were able to get cryptographic secrets for single sign-on cookies and remote access, full source code control contents, and signing keys exfiltration,” Maybe putting your network control plane in 'the cloud' isn't such a good idea after all... Edit: Just re-read…

Was shopping for alternatives to my Ubiquiti last night. Seems like there is nothing good out there. Engenius has shit hardware and a cloud controller. Aruba has a cloud controller AND you have to pay for a license. Cisco makes you pay for a license. TP-Link is cloud-based. WTF. Does anyone have a decent WAP where I can use PoE, deploy like 5 of them and have them support roaming between APs, all managed locally? Is…

Get Linux boards and USB-3 WiFi dongles with well-supported chipsets and roll your own?

The other alternative is to go way up-market and buy industrial gear. Consumer gear is shit due to a race to the bottom mentality. 90% of consumers buy the cheapest. This is also what turned every TV and appliance into a feature-encrusted shitbox full of spyware.

Re: Whistleblower: Ubiquiti Breach “Catastrophic”

#376

Post by old-gregg »

briangerman wrote: post #287
heavyset_go wrote: post #261

Earlier quoted context omitted.

Look into Mikrotik hardware and OpenWRT. Of the Mikrotik-based hardware I'm familiar with, they support PoE. OpenWRT supports roaming and mesh networks, and is a local solution, as opposed to a cloud-based one. There are no licenses you need to pay for, either.

I just ordered a mikrotik 10gb https://mikrotik.com/product/crs305_1g_4s_in . The guys at work recommended it so hoping for the best!

HN community is in an endless loop of switching vendors: https://news.ycombinator.com/item?id=18200119

IMO using what we have intelligently is easier. Uniquiti hardware has the Edge line of routers and switches that are not cloud-controlled, not listen on any ports, and not establish any connections on your behalf.

Re: Whistleblower: Ubiquiti Breach “Catastrophic”

#377

Post by betterunix2 »

fullstop wrote: post #372
azernik wrote: post #362

Earlier quoted context omitted.

Disclaimer: worked for Meraki (now Cisco Meraki) for several years. Generally, halfway decent wireless APs are all targeted at the enterprise market. Consumer hardware is a brutal race to the bottom, as lay consumers aren't qualified to compare options based on anything but price and UI. Ubiquiti was an outlier in trying to bring enterprise features to the consumer market The problem for enthusiasts and small busines…

Surely 802.11r has a purpose, yes?

Faster handoffs between APs.

Re: Whistleblower: Ubiquiti Breach “Catastrophic”

#378

Post by [deleted] »

yabones wrote: post #7

> “The breach was massive, customer data was at risk, access to customers’ devices deployed in corporations and homes around the world was at risk.” > “They were able to get cryptographic secrets for single sign-on cookies and remote access, full source code control contents, and signing keys exfiltration,” Maybe putting your network control plane in 'the cloud' isn't such a good idea after all... Edit: Just re-read…

[deleted]

Re: Whistleblower: Ubiquiti Breach “Catastrophic”

#379

Post by sylens »

floatingatoll wrote: post #369
dolni wrote: post #110

Earlier quoted context omitted.

So the question for becomes: is there just not a good enthusiast market for this stuff? I have met a number of people who are "network nerds", so I'm inclined to think the market does exist. With any of the plethora of consumer devices (Linksys, Netgear, D-Link) it's a dice roll whether your gear is complete garbage or not. A lot of the time, you're coming up snake eyes. I've got some Ubiquiti gear I bought a couple…

As a former enthusiast in this area, I need the time for other more pressing interests and have reverted my home network to Eeros pinned to an IQrouter. All of them require some central service to operate, and I rarely if ever have to pay any attention to them. They also provide better coverage and less radio interference than the prior gold standard, Apple Airport devices. The IQ runs some sort of ssh *nix variant a…

Do they make an Eero yet with more than two Ethernet ports? I love the product, I just want to plug 4-5 devices in as well as use the WiFi.

Re: Whistleblower: Ubiquiti Breach “Catastrophic”

#380

Post by tgsovlerkhgsel »

cheph wrote: post #29
tgsovlerkhgsel wrote: post #9

Earlier quoted context omitted.

Successfully sweeping it under the carpet means you don't get sued for the mistakes you made. Legal isn't there to make sure the company complies with the laws. Legal is there to advise on and minimize legal risk.

> Legal isn't there to make sure the company complies with the laws. Legal is there to advise on and minimize legal risk. Breaking laws is one sure way to increase legal liability.

Yes, but if you've broken one law already, breaking another one by sweeping it under the carpet may sound very attractive.
Post reply on HN