Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Whistleblower: Ubiquiti Breach “Catastrophic”

krebsonsecurity.com

Post reply on HN
Print view View original

681–690 of 815 posts

Re: Whistleblower: Ubiquiti Breach “Catastrophic”

#681

Post by cheschire »

AndyMcConachie wrote: post #669
admax88q wrote: post #515

Earlier quoted context omitted.

> Note, however, that roaming between APs is a feature of the 802.11 standard; In theory yes, but man do a lot of devices have terrible roaming heuristics. "I can still see beacons so id better stay here even though i havent received a packet in the last minute. Wouldnt want to pay the time cost of associating with that other BSS that has 5X the signal"

Do people _really_ need wifi roaming in their homes? I have multiple cheap APs setup in my house using the same SSID and it's fine. As long as I'm not holding a realtime conversation and moving around between APs I never have any problems. And since I almost never hold a Skype call while walking through my house I almost never have any issues.

If you've ever lived in a country where the houses are made primarily of stone, you'd definitely understand the need for it.

Re: Whistleblower: Ubiquiti Breach “Catastrophic”

#682

Post by krageon »

yabones wrote: post #7

> “The breach was massive, customer data was at risk, access to customers’ devices deployed in corporations and homes around the world was at risk.” > “They were able to get cryptographic secrets for single sign-on cookies and remote access, full source code control contents, and signing keys exfiltration,” Maybe putting your network control plane in 'the cloud' isn't such a good idea after all... Edit: Just re-read…

> can we really trust them to

Yes, if they destroy all of their backups, all of their hardware and every one of their current AWS accounts. Then start entirely from scratch. Any measure falling short of that (and let's be reasonable, it definitely will) means that they're entirely untrustworthy from now on.

Of course having your home network controlled from the cloud should already have been entirely untrustworthy, so in practice it won't be an issue for their sales.

Re: Whistleblower: Ubiquiti Breach “Catastrophic”

#683

Post by KozmoNau7 »

jhugo wrote: post #540
admax88q wrote: post #515

Earlier quoted context omitted.

> Note, however, that roaming between APs is a feature of the 802.11 standard; In theory yes, but man do a lot of devices have terrible roaming heuristics. "I can still see beacons so id better stay here even though i havent received a packet in the last minute. Wouldnt want to pay the time cost of associating with that other BSS that has 5X the signal"

You can fix this on the AP side with minimum RSSI or data rate control. But that would probably push you over to either Ubiquiti (and the similar “cloud based” options) or the enterprise market to get those features, unfortunately.

On Mikrotik you can set the minimum allowed data rate, at least. That should kick clients with marginal connections to a hopefully better AP.

Re: Whistleblower: Ubiquiti Breach “Catastrophic”

#684

Post by krageon »

judge2020 wrote: post #414
azernik wrote: post #362

Earlier quoted context omitted.

Disclaimer: worked for Meraki (now Cisco Meraki) for several years. Generally, halfway decent wireless APs are all targeted at the enterprise market. Consumer hardware is a brutal race to the bottom, as lay consumers aren't qualified to compare options based on anything but price and UI. Ubiquiti was an outlier in trying to bring enterprise features to the consumer market The problem for enthusiasts and small busines…

> having a trustworthy and secured backend. Ubiquiti had a secured backend - their screw-up was not doing MFA on their admin accounts. I would still like if there was an option for a local-only control panel.

> their screw-up was not doing MFA

So you're saying it was both not trustworthy and not adequately secured?

Re: Whistleblower: Ubiquiti Breach “Catastrophic”

#685

Post by l33tman »

admax88q wrote: post #515
azernik wrote: post #362

Earlier quoted context omitted.

Disclaimer: worked for Meraki (now Cisco Meraki) for several years. Generally, halfway decent wireless APs are all targeted at the enterprise market. Consumer hardware is a brutal race to the bottom, as lay consumers aren't qualified to compare options based on anything but price and UI. Ubiquiti was an outlier in trying to bring enterprise features to the consumer market The problem for enthusiasts and small busines…

> Note, however, that roaming between APs is a feature of the 802.11 standard; In theory yes, but man do a lot of devices have terrible roaming heuristics. "I can still see beacons so id better stay here even though i havent received a packet in the last minute. Wouldnt want to pay the time cost of associating with that other BSS that has 5X the signal"

I went through this when setting up wlan in a new office some years ago, looked at roaming APs etc.. finally I just bought 4 consumer Asus routers on the same SSID, worked fine for all our purposes at least.

Re: Whistleblower: Ubiquiti Breach “Catastrophic”

#686

Post by ruph123 »

g_p wrote: post #518
ruph123 wrote: post #181

Earlier quoted context omitted.

Right. I would never have any device like a camera be directly connected to the internet and instead cut off that device from the internet in my router software and only access it from outside via a VPN. Not that this whole screw-up should be excused in any way or downplayed.

I guess the concern here is if your VPN was provided by Ubiquiti then you might have an issue. My approach has been an isolated (read basically no internet) LAN, bridged by a small PC running hardened and locked down Linux. There's no egress from the LAN. VPN access to this LAN goes via the PC under my control, which itself has access to the wider internet via its second interface. This approach is nice as I don't ha…

I mean if I don’t trust their devices I will surely not trust their VPN server.

Settings one up is easy, blocking internet for a network device on the router level is trivial. No need for complicated setups IMHO.

Re: Whistleblower: Ubiquiti Breach “Catastrophic”

#687

Post by robotmay »

cheschire wrote: post #681
AndyMcConachie wrote: post #669

Earlier quoted context omitted.

Do people _really_ need wifi roaming in their homes? I have multiple cheap APs setup in my house using the same SSID and it's fine. As long as I'm not holding a realtime conversation and moving around between APs I never have any problems. And since I almost never hold a Skype call while walking through my house I almost never have any issues.

If you've ever lived in a country where the houses are made primarily of stone, you'd definitely understand the need for it.

Yeah I have a 2' thick stone wall in the centre of my house (old exterior wall). I have an AP on either side of it as they penetrate the ceilings/floors above fine, but nothing is getting through that wall and maintaing good signal.

Re: Whistleblower: Ubiquiti Breach “Catastrophic”

#689

Post by TriNetra »

yabones wrote: post #7

> “The breach was massive, customer data was at risk, access to customers’ devices deployed in corporations and homes around the world was at risk.” > “They were able to get cryptographic secrets for single sign-on cookies and remote access, full source code control contents, and signing keys exfiltration,” Maybe putting your network control plane in 'the cloud' isn't such a good idea after all... Edit: Just re-read…

When you're operating such massive services, at minimum you should protect the admin accounts not just with 2FA, but also with IP firewall. Looks like both were missing from here ...

Re: Whistleblower: Ubiquiti Breach “Catastrophic”

#690

Post by unionpivo »

IgorPartola wrote: post #43
yabones wrote: post #7

> “The breach was massive, customer data was at risk, access to customers’ devices deployed in corporations and homes around the world was at risk.” > “They were able to get cryptographic secrets for single sign-on cookies and remote access, full source code control contents, and signing keys exfiltration,” Maybe putting your network control plane in 'the cloud' isn't such a good idea after all... Edit: Just re-read…

Was shopping for alternatives to my Ubiquiti last night. Seems like there is nothing good out there. Engenius has shit hardware and a cloud controller. Aruba has a cloud controller AND you have to pay for a license. Cisco makes you pay for a license. TP-Link is cloud-based. WTF. Does anyone have a decent WAP where I can use PoE, deploy like 5 of them and have them support roaming between APs, all managed locally? Is…

i use microtik.

It needs some getting used to, but preform well.

They have their clod versions also, but they keep putting out non cloud devices.

Post reply on HN