Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ubiquiti all but confirms breach response iniquity

krebsonsecurity.com

Post reply on HN
Print view View original

241–250 of 322 posts

Re: Ubiquiti all but confirms breach response iniquity

#241

Post by jimnotgym »

Hang on a minute there

> Ubiquiti’s IoT gear includes things like WiFi routers

I understood IoT to mean wifi toasters, TVs and other home appliances. Since when was a router an IoT device? Are we going to call all nework devices IoT now. This strikes me as taking rather too much journalistic license.

In fact wtf is a WiFi Router. I use Unifi to deploy Wireless Acess Points on a LAN with centralized control. It is possible to do this without them having internet access at all, but it makes it rather harder to update everything. This is miles away from IoT.

Describing Ubiquity as a IoT company is like calling Cisco, Juniper, Mikrotik and Aruba IoT companies. This sounds like an attempt to feed the narrative that the IoT is going to eat us alive.

Let us focus instead on what Ubiquity actually did wrong, isn't that bad enough?

Re: Ubiquiti all but confirms breach response iniquity

#242

Post by GekkePrutser »

Ubiquiti should really stop making cloud logins mandatory. The latest stuff (UDM/UDM Pro, Cloud Key G2) must be connected to their cloud at installation time. Remote access can be turned off but an admin account connected to their cloud remains.

Without those ties to their infrastructure, this breach would not be as severe. It would just cause an attacker to see what I've bought from them, nothing else.

I'm glad I can still use the unifi controller in docker without any ties to UI.com however their later stuff like Unifi protect, access, talk etc no longer works with that.

Re: Ubiquiti all but confirms breach response iniquity

#243

Post by dustinmoris »

I find it really strange that so many claim that they need Ubiquiti and that there is "sadly" no other good alternative. What are people doing with their home networks? What are they comparing it with? Has anyone actually tried some of the mesh networks from TP-Link or other brands? I have one at home and honestly I don't even know what the admin management looks like because I never have to go there and do something. What are people doing? Is it that I am so ignorant to some needs which people have that they constantly need to tweak their networks at home or is it just a symptom of Ubiquity kit that requires users to constantly do something with it that now they think they need all that fancy management stuff because they got used to do so much maintenance work on something that should just work without ever having to touch it again?

Re: Ubiquiti all but confirms breach response iniquity

#244

Post by dustinmoris »

efitz wrote: post #55

You get great insight into the character of the leaders of a company watching how breaches are handled. Companies that put the customer first are transparent, and quickly take action (even if painful to customers) to ensure that customers’ data and systems stay intact and confidential. Companies that try to gloss over, hide or downplay things indicate that the leadership does not respect their customers and is only i…

> You get great insight into the character of the leaders of a company watching how breaches are handled.

No, that is too late. You get even sooner an even greater insight into leaders of a company based on the things they build. Does a hardware company try to force its users to move things to a proprietary cloud for no clear benefit? You know it's a company run by ar*eholes. Nothing more to know.

Re: Ubiquiti all but confirms breach response iniquity

#245

Post by youngtaff »

msh wrote: post #239
phil21 wrote: post #205

Earlier quoted context omitted.

Really sad to see. I still see no realistic alternative for the "distributed decent wifi at a reasonably SMB scale" wireless product though. Miraki I guess is as close as it gets, but then you are locked in 100% cloud and it's certainly not remotely the same price point. I am relegating Unify to manage my APs and (some) switches for ease of use - while I enjoy CLI fun, it gets old doing routine stuff the for the 100t…

Meraki go is their direct unifi competitor.

Trouble is the firewall in the Meraki Go Gateway only does 250Mbps - bit crap if you've got gigabit fibre to the house

https://www.meraki-go.com/products/security-gateway/

Re: Ubiquiti all but confirms breach response iniquity

#246

Post by beezischillin »

posguy wrote: post #75
mopsi wrote: post #60

Earlier quoted context omitted.

I keep seeing the requests for central management interface, which leave me somewhat puzzled. Why do you need in a home environment? I run a small network with one big router and several access points, and at least with Mikrotik's gear, it's pretty much fire and forget. It has CAPsMAN[1] to centrally manage wireless networks, but I've found it to introduce unneeded complexity. Auto-updates[2] don't need any central m…

I have a good deal of experience with Mikrotik's offerings, and I am not looking to power networks I support with a patchwork of different systems that each have their own interface. Most of the value proposition of the Unifi lineup is I can look at a single website that I host and see the WiFi clients connected to an access point, what switch feeds that access point internet (and whether its linked at gigabit or 100…

Mikrotik itself had security problems before. Tom Lawrence covered a lot of this on YouTube. I can recommend his channel on the topic.

Re: Ubiquiti all but confirms breach response iniquity

#247

Post by MindTooth »

After seeing that they did not capture the logs. What is the “proper” way of storing said logs? I guess you need a remote logserver like logstash to store them. But what service does actually send the logs from the server to a central storage.

Looking into Loki, Graphite, etc. But I’m a bit at a loss where to begin.

Re: Ubiquiti all but confirms breach response iniquity

#248

Post by mavhc »

mopsi wrote: post #60
posguy wrote: post #43

Earlier quoted context omitted.

I want to fire Ubiquiti, but where can I go to get my router, wireless access points and switches in one management interface? There are plenty of poorly performing consumer grade options out there which hide all complexity, but they break in fun ways (eg: Google WiFi creating loops in the network when users try to do wired backhaul) and only tackle part of the stack. I really just want to manage an OpenWRT based net…

I keep seeing the requests for central management interface, which leave me somewhat puzzled. Why do you need in a home environment? I run a small network with one big router and several access points, and at least with Mikrotik's gear, it's pretty much fire and forget. It has CAPsMAN[1] to centrally manage wireless networks, but I've found it to introduce unneeded complexity. Auto-updates[2] don't need any central m…

Mikrotik have not been able to keep up with the latest, or previous to latest wifi standards, seems like it's become too complex

Re: Ubiquiti all but confirms breach response iniquity

#249

Post by sigg3 »

sylens wrote: post #115
Causality1 wrote: post #106

Earlier quoted context omitted.

Frankly I wonder at how big some of these peoples' houses are. My single seven year old Nighthawk router covers an entire 2300 square foot home and penetrates the brick walls to reach halfway up the street.

I feel the same way - my Nighthawk is going strong with custom firmware, but my friends with Ubiquiti gear try to get me to replace it with a bunch of Unifi stuff every time I talk to them.

What firmware?

I need new APs soon.

Re: Ubiquiti all but confirms breach response iniquity

#250

Post by ta20210405 »

dijit wrote: post #235
ta20210405 wrote: post #223

Earlier quoted context omitted.

>nftables (like iptables before it) is rule based and not bucket based. What does this even mean? Do you have any documentation to explain? >So high numbers of rules will not affect pf’s performance like it does with nftables. This is wrong. From OpenBSD documentation: "More lines being evaluated for each packet will result in slower performance." [0] https://www.openbsd.org/faq/pf/perf.html It's not 2001 any more. N…

The key is “for each packet”, because it’s bucket based it will entirely skip evaluation for packets that do not match. This is due to how the rule set is compiled, but I can see how it could be confusing if you’re used to iptables and only think in those terms. I posted the architectural diagrams of both in another comment on this thread yesterday, I think you missed that.

>The key is “for each packet”, because it’s bucket based it will entirely skip evaluation for packets that do not match.

That is how it works in nftables.

>but I can see how it could be confusing if you’re used to iptables and only think in those terms.

Considering you're misunderstanding some basics about nftables and iptables here, I think you need to look in the mirror.

>I posted the architectural diagrams of both in another comment on this thread yesterday, I think you missed that.

I saw, and it only reenforced the fact that that's how nftables works. Hilariously enough, the OpenBSD webpage crashed and wouldn't load, giving various 500 and 42X errors.

Post reply on HN