Whistleblower: Ubiquiti Breach “Catastrophic” • Hacker News Board

Re: Whistleblower: Ubiquiti Breach “Catastrophic”

#471

Post by aspaceman » Tue, Mar 30, 2021, 11:44 PM UTC

Loughla wrote: post #278

ex_ubiquiti wrote: post #223

Earlier quoted context omitted.

The early days at Ubiquiti were good. I worked with a lot of good engineers and we shipped good work. The decline is a recent problem. > How the brand hasn't become toxic already is a mystery to me, yet look at the stock price tracker. It's been trending up for years and it has well over doubled in the past six months alone. This is your answer. No incentive to change. All of the bad engineering decisions have been r…

>I heard rumors that the CEO was making two separate teams work [. . .] separately, competing against each other. I don't work in tech, so maybe I'm dumb to this, but why would you ever do this?

There’s an infamous anecdote with Jobs doing this. Tharanos had the same “two teams” story.

A lot of CEOs who think they’re the next Steve Jobs, don’t understand their own tech, and presume the solution to their technical problems is a lack of “motivation”.

Creating a skilled skunk works team to handle a critical problem is a great idea. Making two? And putting them in conflict? It’s like throwing your a steak to your dogs to have them fight over dinner. Idiocy.

Re: Whistleblower: Ubiquiti Breach “Catastrophic”

#472

Post by r1ch » Tue, Mar 30, 2021, 11:47 PM UTC

IgorPartola wrote: post #43

yabones wrote: post #7

> “The breach was massive, customer data was at risk, access to customers’ devices deployed in corporations and homes around the world was at risk.” > “They were able to get cryptographic secrets for single sign-on cookies and remote access, full source code control contents, and signing keys exfiltration,” Maybe putting your network control plane in 'the cloud' isn't such a good idea after all... Edit: Just re-read…

Was shopping for alternatives to my Ubiquiti last night. Seems like there is nothing good out there. Engenius has shit hardware and a cloud controller. Aruba has a cloud controller AND you have to pay for a license. Cisco makes you pay for a license. TP-Link is cloud-based. WTF. Does anyone have a decent WAP where I can use PoE, deploy like 5 of them and have them support roaming between APs, all managed locally? Is…

I'm a big fan of flashing OpenWRT on supported APs. You lose central management and setup takes time, but I'm very happy with the stability and no worries about cloud services or vendor lock-in etc.

Re: Whistleblower: Ubiquiti Breach “Catastrophic”

#473

Post by lstodd » Tue, Mar 30, 2021, 11:49 PM UTC

kazen44 wrote: post #170

dolni wrote: post #110

Earlier quoted context omitted.

So the question for becomes: is there just not a good enthusiast market for this stuff? I have met a number of people who are "network nerds", so I'm inclined to think the market does exist. With any of the plethora of consumer devices (Linksys, Netgear, D-Link) it's a dice roll whether your gear is complete garbage or not. A lot of the time, you're coming up snake eyes. I've got some Ubiquiti gear I bought a couple…

? So the question for becomes: is there just not a good enthusiast market for this stuff? I have met a number of people who are "network nerds", so I'm inclined to think the market does exist. my experience as a professional "network nerd" is that most other people in the networking field run cheap/second hand enterprise gear fetched from their employer at a major discount and simply seem to care less about wifi in g…

IDK, Mikrotik works for me. The 'second-hand enterprise gear' is either too unwieldy, requires too much power, or most frequently, both.

EDIT: it's when you get into supply contracts in the thousands .. then it gets tricky

Re: Whistleblower: Ubiquiti Breach “Catastrophic”

#474

Post by lostlogin » Tue, Mar 30, 2021, 11:49 PM UTC

red_phone wrote: post #430

judge2020 wrote: post #414

Earlier quoted context omitted.

> having a trustworthy and secured backend. Ubiquiti had a secured backend - their screw-up was not doing MFA on their admin accounts. I would still like if there was an option for a local-only control panel.

For their UniFi line, at least, you don't have to use their cloud controller. You can self-host.

Is that true on the UDM-Pro?

I couldn’t see an option on setup.

I might try block it from internet and see what happens.

Re: Whistleblower: Ubiquiti Breach “Catastrophic”

#475

Post by mrslave » Tue, Mar 30, 2021, 11:49 PM UTC

bogwog wrote: post #467

mrslave wrote: post #454

What is good cheap consumer gear for putting OpenWRT on? Similar to WRT54G was, back in the day.

T-mobile sold a bunch of rebranded asus routers a couple of years back that are still excellent today and can be had for pretty cheap. Comes with some shitty tmobile spyware I think, but you can flash openwrt on it. Speed tests are pretty unreliable, but the peak unobstructed wifi speeds I've gotten from that have been better than what I get from my Unifi 6 lite, which supports wifi 6, even on wifi 6 devices. (couple…

Thanks for the tip. This is a rebranded Asus RT-AC68U and in the $200 sweet spot. Unfortunately it's a Broadcom-based device which means OpenWRT support is limited, but apparently DD-WRT has better support[0]:

> DD-WRT has a license agreement and NDA in place with Broadcom that allow usage of better, proprietary, closed source wireless drivers (binary blobs) which they are not allowed to redistribute freely.

[0] https://openwrt.org/toh/asus/rt-ac68u

Re: Whistleblower: Ubiquiti Breach “Catastrophic”

#476

Post by [deleted] » Tue, Mar 30, 2021, 11:50 PM UTC

williamsmj wrote: post #360

noinsight wrote: post #18

> ”Ubiquiti had negligent logging (no access logging on databases) so it was unable to prove or disprove what they accessed” Perversely, this is exactly the logging that you want to have in place in case of a breach. You can then (factually) make the statement that ”we have no evidence any customer data was accessed.”

Reminds me a little bit of Adverse Event Reporting in pharma. If a drug manufacturer finds out about an adverse event (i.e. a bad reaction) to a drug, it kicks off all sorts of obligations that have the potential to be time-consuming and expensive. So pharma is the one sector you won't see with a "social media listening/analysis" department in marketing. They actively avoid tracking or learning about discussion of th…

[deleted]

Re: Whistleblower: Ubiquiti Breach “Catastrophic”

#477

Post by dijit » Tue, Mar 30, 2021, 11:52 PM UTC

cle wrote: post #463

red_phone wrote: post #430

Earlier quoted context omitted.

For their UniFi line, at least, you don't have to use their cloud controller. You can self-host.

This is what I do. I host a controller in AWS on an EC2 instance in my account. It works great.

Out of interest, why wouldn't you host it on something like a raspberry pi?

Having your local network depend on an external network makes my old school sysadmin bones tingle for some reason.

Re: Whistleblower: Ubiquiti Breach “Catastrophic”

#478

Post by chillfox » Tue, Mar 30, 2021, 11:56 PM UTC

toyg wrote: post #28

noinsight wrote: post #18

> ”Ubiquiti had negligent logging (no access logging on databases) so it was unable to prove or disprove what they accessed” Perversely, this is exactly the logging that you want to have in place in case of a breach. You can then (factually) make the statement that ”we have no evidence any customer data was accessed.”

Aka plausibile deniability

I have never ever seen "plausible deniability" keep someone out of trouble. I have seen attempts at applying it several times, but never successfully.

As an excuse for why to not do the right thing I really hate "plausible deniability".

Re: Whistleblower: Ubiquiti Breach “Catastrophic”

#479

Post by closeparen » Tue, Mar 30, 2021, 11:56 PM UTC

TheGuyWhoCodes wrote: post #301

closeparen wrote: post #120

Earlier quoted context omitted.

He could have had 2fa on his console account but saved an access key for CLI access. Many large organizations have an infrastructure where you exchange your corporate authentication (including 2FA) for a short lived AWS access key, but AFAIK this isn’t out of the box.

You can force 2fa even for cli access as far as I remember but It's not on by default.

This seems incredibly clunky and most people are probably not doing something that involves typing the ARN of their MFA device on a day to day basis. To be tenable on a daily basis you need something like “aws login” with username, password, and code that sets up your credentials file correctly. Expect people to copy and paste values around, and you’ve already lost.

Not to mention legacy code that only knows about access key ID and secret, and doesn’t have a place to even put a token.

https://aws.amazon.com/premiumsupport/knowledge-center/authe...

Re: Whistleblower: Ubiquiti Breach “Catastrophic”

#480

Post by serf » Tue, Mar 30, 2021, 11:56 PM UTC

old-gregg wrote: post #376

briangerman wrote: post #287

Earlier quoted context omitted.

I just ordered a mikrotik 10gb https://mikrotik.com/product/crs305_1g_4s_in . The guys at work recommended it so hoping for the best!

HN community is in an endless loop of switching vendors: https://news.ycombinator.com/item?id=18200119 IMO using what we have intelligently is easier. Uniquiti hardware has the Edge line of routers and switches that are not cloud-controlled, not listen on any ports, and not establish any connections on your behalf.

>IMO using what we have intelligently is easier.

many people switch not simply for the security/security-theatre, but because they no longer want to support a company with such poor security strategy after it is revealed that they have internal issues.