Earlier quoted context omitted.
Easy to imagine they just got a spiked chrome binary installed
How could an attacker make that happen?
Hack the admin machine
Whistleblower: Ubiquiti Breach “Catastrophic”
671–680 of 815 posts
Re: Whistleblower: Ubiquiti Breach “Catastrophic”
#672Earlier quoted context omitted.
> Note, however, that roaming between APs is a feature of the 802.11 standard; In theory yes, but man do a lot of devices have terrible roaming heuristics. "I can still see beacons so id better stay here even though i havent received a packet in the last minute. Wouldnt want to pay the time cost of associating with that other BSS that has 5X the signal"
Do people _really_ need wifi roaming in their homes? I have multiple cheap APs setup in my house using the same SSID and it's fine. As long as I'm not holding a realtime conversation and moving around between APs I never have any problems. And since I almost never hold a Skype call while walking through my house I almost never have any issues.
It's not about walking and talking, it's about sticky associations.
Re: Whistleblower: Ubiquiti Breach “Catastrophic”
#673Earlier quoted context omitted.
Was shopping for alternatives to my Ubiquiti last night. Seems like there is nothing good out there. Engenius has shit hardware and a cloud controller. Aruba has a cloud controller AND you have to pay for a license. Cisco makes you pay for a license. TP-Link is cloud-based. WTF. Does anyone have a decent WAP where I can use PoE, deploy like 5 of them and have them support roaming between APs, all managed locally? Is…
I have a Turris Omnia for my main router. It's a solid piece of kit. The OS, TurrisOS, is based on OpenWRT and for a while they were having trouble keeping up-to-date but that's been sorted in recent releases. There are great features like auto-updates and BTRFS snapshots and the ability to rollback to previous known good if you screw up a config. I also run LXC containers on it for things like PiHole (not on the int…
These guys burned me so hard. Something on my Omnia burned out. I offered to pay to have it shipped and fixed and shipped back. They stopped emailing me back. It was a horrible, horrible support experience.
Re: Whistleblower: Ubiquiti Breach “Catastrophic”
#674Earlier quoted context omitted.
Was shopping for alternatives to my Ubiquiti last night. Seems like there is nothing good out there. Engenius has shit hardware and a cloud controller. Aruba has a cloud controller AND you have to pay for a license. Cisco makes you pay for a license. TP-Link is cloud-based. WTF. Does anyone have a decent WAP where I can use PoE, deploy like 5 of them and have them support roaming between APs, all managed locally? Is…
Disclaimer: worked for Meraki (now Cisco Meraki) for several years. Generally, halfway decent wireless APs are all targeted at the enterprise market. Consumer hardware is a brutal race to the bottom, as lay consumers aren't qualified to compare options based on anything but price and UI. Ubiquiti was an outlier in trying to bring enterprise features to the consumer market The problem for enthusiasts and small busines…
Yeah, it's incredible how pathetically bad the home-networking market is. I've been through every consumer router and wound up with a Ubiquiti EdgeRouter and AP. Ubiquiti's software and support are absolute dogshit. And I did NOT set up a "controller," which is not (and should not be) necessary in your HOUSE. This seems to confound Ubiquiti and other users, which in itself is rather pathetic.
Stop putting your shit in "the cloud," where it's subject to the whims and failures of a third party. When will people learn?
Re: Whistleblower: Ubiquiti Breach “Catastrophic”
#675Earlier quoted context omitted.
> My guess is their local workstation was compromised Honestly I don't think it was even that complicated, considering when I needed to spend money on some SaaS product the "chief accountant" (because there was no CFO) straight up sent me a photo of the corporate credit card and said "delete that when you're done".
Sure, but to be fair, credit cards really aren't that dangerous of a credential to wave around. You can cancel your card at anytime, and even dispute the charges. Its like instant key rotation, with a way to also roll back time.
And they can have monthly spending limits too
Re: Whistleblower: Ubiquiti Breach “Catastrophic”
#676Earlier quoted context omitted.
Was shopping for alternatives to my Ubiquiti last night. Seems like there is nothing good out there. Engenius has shit hardware and a cloud controller. Aruba has a cloud controller AND you have to pay for a license. Cisco makes you pay for a license. TP-Link is cloud-based. WTF. Does anyone have a decent WAP where I can use PoE, deploy like 5 of them and have them support roaming between APs, all managed locally? Is…
Disclaimer: worked for Meraki (now Cisco Meraki) for several years. Generally, halfway decent wireless APs are all targeted at the enterprise market. Consumer hardware is a brutal race to the bottom, as lay consumers aren't qualified to compare options based on anything but price and UI. Ubiquiti was an outlier in trying to bring enterprise features to the consumer market The problem for enthusiasts and small busines…
I still remember the first Meraki device. It was so good. I used it a lot.
Re: Whistleblower: Ubiquiti Breach “Catastrophic”
#677Earlier quoted context omitted.
Disclaimer: worked for Meraki (now Cisco Meraki) for several years. Generally, halfway decent wireless APs are all targeted at the enterprise market. Consumer hardware is a brutal race to the bottom, as lay consumers aren't qualified to compare options based on anything but price and UI. Ubiquiti was an outlier in trying to bring enterprise features to the consumer market The problem for enthusiasts and small busines…
> having a trustworthy and secured backend. Ubiquiti had a secured backend - their screw-up was not doing MFA on their admin accounts. I would still like if there was an option for a local-only control panel.
I never onboard anybody without MFA. Turning it off is a firing offense.
Re: Whistleblower: Ubiquiti Breach “Catastrophic”
#678Earlier quoted context omitted.
If admin login is using weak credentials, it is by definition not a secure backend. Password/credential management and mandatory MFA are ALWAYS part of security due diligence for suppliers.
Except if it is awscli creds, then of course there is no MFA.
There are way to limit the scope of those. One set of credentials per environment for example. You can also limit the use of the these credentials by policy.
https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_p...
Re: Whistleblower: Ubiquiti Breach “Catastrophic”
#679Earlier quoted context omitted.
Heck, most operating systems are leaky by default. Even openBSD, which has a stellar trackrecord in terms of security and "goes against the grain" on many decisions for the sake of secure by default (for instance, disabling hyperthreading altogether to prevent any kind of SPECTRE vulnerability) is under constant scrutiny for not being secure enough. Maybe connecting everything to a network and making it a high value…
> constant scrutiny for not being secure enough. Do you have a source for this? I follow OpenBSD quite closely and this is news to me..
I haven't got much sources for you but what I've picked up over the years: a lot of OpenBSD's security is just old fashioned manual code review and audits, and there are not enough eyeballs. Someone like Ilja van Sprundel can go in the source code and find a bunch of issues without too much trouble [1]. I don't see any concentrated efforts to improve the status quo (where's formal methods, where's automated fuzzing, where are initiatives to employ more safe programming languages, static analysis, etc.). And while OpenBSD pride themselves on their mitigations, they aren't exactly state of the art and some of the more recent stuff (like trying to eliminate ROP gadgets) seems just futile. The biggest thing OpenBSD did with mitigations was enabling them by default for the base system and ports. What does anyone remember OpenBSD for in 2010-2020? Pledge, probably. That's a nice thing but more for containing the damage than actually making stuff secure in the first place.
https://www.csoonline.com/article/3250653/is-the-bsd-os-dyin...
My concern (and the concern of many others, I think) is that if OpenBSD suddenly got enough attention from the wider security community, including people who actively look for holes that can be exploited, there'd be plenty of important stuff found. Until then, these issues sit quietly waiting for a malicious party to discover them. There's quite some fanfare for OpenBSD, but how many of you are actively auditing the code? I'm subscribed to cvs@ and tech@ and I read them daily and I just don't see much contribution at all from outsiders. And when I do see it, it's mostly stuff like fixing typos or amending man pages. All the commits that change code with security implications tend to come from the core developers, and are reviewed by a handful of people at best. And I have seen some obviously broken stuff slip through.
Re: Whistleblower: Ubiquiti Breach “Catastrophic”
#680Earlier quoted context omitted.
Except if it is awscli creds, then of course there is no MFA.
Exactly, no workflow for terraform or CLI if you have U2F (Yubikey) 2FA.
That's not true. You can use AWS SSO with the CLI/SDKs (therefore including stuff like Terraform) with webauthn.
It briefly pops you out to a browser to authenticate and caches a short lived token locally