Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Whistleblower: Ubiquiti Breach “Catastrophic”

krebsonsecurity.com

Post reply on HN
Print view View original

651–660 of 815 posts

Re: Whistleblower: Ubiquiti Breach “Catastrophic”

#651

Post by benjaminwai »

cutemonster wrote: post #290
jniedrauer wrote: post #234

> the attacker(s) had access to privileged credentials that were previously stored in the LastPass account of a Ubiquiti IT employee The interesting part of this story is how the employee's LastPass got popped. My guess is their local workstation was compromised, and their LastPass was either not logged out in a browser plugin, or they didn't have 2 factor auth required for each login and a keylogger got the password…

> My guess is their local workstation was compromised You mean someone was physically at the laptop/desktop and could access the OS and apps? Maybe if the employee was working remote (covid?) from, say, a cafe and left the laptop unattended when refilling coffee? Or something else? ... Hmm, could also have been eg a browser zero day that gave someone remote access to the computer? Or a dev tools supply chain attack?

Or keylogger?

Re: Whistleblower: Ubiquiti Breach “Catastrophic”

#652

Post by TwoBit »

boonware wrote: post #649
yabones wrote: post #7

> “The breach was massive, customer data was at risk, access to customers’ devices deployed in corporations and homes around the world was at risk.” > “They were able to get cryptographic secrets for single sign-on cookies and remote access, full source code control contents, and signing keys exfiltration,” Maybe putting your network control plane in 'the cloud' isn't such a good idea after all... Edit: Just re-read…

Complete failure of security here. No single credentials should be able to grant that much privileged access.

At my last company, signing keys were physically stored in a safe with limited access. No network security breach could possibly get them.

Re: Whistleblower: Ubiquiti Breach “Catastrophic”

#653

Post by d1str0 »

boonware wrote: post #649
yabones wrote: post #7

> “The breach was massive, customer data was at risk, access to customers’ devices deployed in corporations and homes around the world was at risk.” > “They were able to get cryptographic secrets for single sign-on cookies and remote access, full source code control contents, and signing keys exfiltration,” Maybe putting your network control plane in 'the cloud' isn't such a good idea after all... Edit: Just re-read…

Complete failure of security here. No single credentials should be able to grant that much privileged access.

This isn't really true. If you have an AWS, you need a global god admin. That's the root user. As an IT guy, I have to store those creds somewhere. So I make the password super long and random, store it in lastpass, add 2fa, and add alerting for all logins. It's never used except in the super rare case we have to do something that requires the megagod level privs of the root account (like changing billing to a master account etc)

Re: Whistleblower: Ubiquiti Breach “Catastrophic”

#654

Post by amarshall »

MAGZine wrote: post #646
Xavdidtheshadow wrote: post #119

Earlier quoted context omitted.

> this completely invalidates the 2FA of TOTP if your password manager get broken into I think that's the big "if". If you assume the password manager is secure (which something clearly wasn't in this case, but that seems like an outlier), TOTP secret in the password manager still secures the account. Is such a setup as protective as a separate storage method? No, but it's leagues more convenient. A cloud-based PW ma…

You know what's also convenient? 1FA. Which, incidentally, when you store you TOTP secrets with your passwords, is what you have.

I mean, if the password manager’s store is compromised, then sure, okay. But if only the application password is compromised then it’s still 2FA since the attacker cannot authenticate with just the password.

Re: Whistleblower: Ubiquiti Breach “Catastrophic”

#655

Post by beachy »

chillfox wrote: post #478
toyg wrote: post #28

Earlier quoted context omitted.

Aka plausibile deniability

I have never ever seen "plausible deniability" keep someone out of trouble. I have seen attempts at applying it several times, but never successfully. As an excuse for why to not do the right thing I really hate "plausible deniability".

You're joking right?

I don't live in the US but I've watched as plausible deniability had been deployed there at the very highest levels, with great success, for 4 years.

Re: Whistleblower: Ubiquiti Breach “Catastrophic”

#656

Post by Jnr »

betterunix2 wrote: post #349
Jnr wrote: post #271

Earlier quoted context omitted.

I wonder what is reasonable WiFi throughput for you? With my 5 year old Mikrotik hAP AC I am able to get up to 500 Mbit/s on lan. And my old phone now shows 250 Mbit/s on speedtest.net both directions. How much more are we talking about? Have I missed some big hardware upgrade recently?

Using 80Mhz channels I found the default configuration never exceeded 200Mbit/s using iperf. For me "reasonable" is closer to 800Mbit/s, which is roughly the theoretical limit for 80Mhz with 2 spatial streams. I run my tests with my devices sitting 1 meter from the AP. This is on a hAP AC, and like I said, I get much better performance (close to the theoretical max) running OpenWRT on the same unit. I have had simila…

Yeah, that sounds a bit slow. I suggest checking if faspath and fasttrack is working.

I remember that when I had hAP AC using firewall rules inside lan, it also did not go much faster. Good indication was CPU usage. If it used 100% CPU at ~200Mbit/s then it was firewall slowing things down.

Re: Whistleblower: Ubiquiti Breach “Catastrophic”

#657

Post by darkr »

Quiark wrote: post #551
uniformlyrandom wrote: post #512

Earlier quoted context omitted.

Except if it is awscli creds, then of course there is no MFA.

Exactly, no workflow for terraform or CLI if you have U2F (Yubikey) 2FA.

If you use federated auth, then you can do whatever you want; 10 UDF keys and a video of a special dance if you so desire

Re: Whistleblower: Ubiquiti Breach “Catastrophic”

#658

Post by benjaminwai »

jodrellblank wrote: post #611
neuronic wrote: post #112

Earlier quoted context omitted.

It's people not getting it and being plain annoyed by the second factor. YubiKey or Authenticator app on a different device... it's too inconvenient and people often only do it if forced (e.g. banks do this afaik).

Every day I sit at the same desk, at the same computer, logging into the same websites, using 2FA over and over and over and over while sites time out "for my protection". It's a plague. Write a damn desktop app I can run locally, I didn't ask for people from Turkmenistan to be able to login as me, so you could sell me a halfassed web version of something. Joseph Heller predicted 2FA in Catch 22 when he wrote: " Almo…

> Write a damn desktop app I can run locally, I didn't ask for people from Turkmenistan to be able to login as me, so you could sell me a halfassed web version of something.

Authy Desktop?

Re: Whistleblower: Ubiquiti Breach “Catastrophic”

#659

Post by tumblewit »

emmelaich wrote: post #588
azernik wrote: post #362

Earlier quoted context omitted.

Disclaimer: worked for Meraki (now Cisco Meraki) for several years. Generally, halfway decent wireless APs are all targeted at the enterprise market. Consumer hardware is a brutal race to the bottom, as lay consumers aren't qualified to compare options based on anything but price and UI. Ubiquiti was an outlier in trying to bring enterprise features to the consumer market The problem for enthusiasts and small busines…

Worth noting that Meraki have a small business option now: https://www.meraki-go.com/

Wow this is great and seems like a direct competitor to UniFi. Few years back when I was researching meraki I found it way too pricey for small business over UniFi but this makes much more sense now.

Re: Whistleblower: Ubiquiti Breach “Catastrophic”

#660

Post by ergo14 »

IgorPartola wrote: post #43
yabones wrote: post #7

> “The breach was massive, customer data was at risk, access to customers’ devices deployed in corporations and homes around the world was at risk.” > “They were able to get cryptographic secrets for single sign-on cookies and remote access, full source code control contents, and signing keys exfiltration,” Maybe putting your network control plane in 'the cloud' isn't such a good idea after all... Edit: Just re-read…

Was shopping for alternatives to my Ubiquiti last night. Seems like there is nothing good out there. Engenius has shit hardware and a cloud controller. Aruba has a cloud controller AND you have to pay for a license. Cisco makes you pay for a license. TP-Link is cloud-based. WTF. Does anyone have a decent WAP where I can use PoE, deploy like 5 of them and have them support roaming between APs, all managed locally? Is…

TP-Link is not cloud based - you can run the controller locally. https://www.tp-link.com/pl/support/download/omada-software-c... - Downloadable here.
Post reply on HN