Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ubiquiti all but confirms breach response iniquity

krebsonsecurity.com

Post reply on HN
Print view View original

251–260 of 322 posts

Re: Ubiquiti all but confirms breach response iniquity

#251

Post by sigg3 »

commandar wrote: post #162
LgWoodenBadger wrote: post #88

Earlier quoted context omitted.

I’m done buying ubiquiti equipment. 6 devices, and 3 family members I recommended ubiquiti to who also have multiple devices. Clearly the market exists for what they’re offering. I am surprised at the serious lack of alternatives.

HPE seems to be aiming squarely at Ubiquiti with their Aruba Instant On line (which is distinct from the Aruba Instant line because what's life without some confusing branding?). I installed some of their APs and switches in my home a few weeks ago and it's working well. It ended up a little less expensive than comparable UBNT gear would have been and there's actual availability on their Wifi6 APs. The APs are cloud…

> The APs are cloud managed only, but, personally, I trust HPE not to make a complete clown show

That is unwise on the long-term, though. The technology is there so you don't have to trust anyone, so why do you choose to trust them when they're not offering cloudfree solutions?

Re: Ubiquiti all but confirms breach response iniquity

#252

Post by tediousdemise »

bogwog wrote: post #167
tediousdemise wrote: post #130

Earlier quoted context omitted.

Indeed. Even more terrifying is using an unsafe language like C rather than Rust or C++ for systems development. shudders

C++? Safe??

Smart pointers? Automatic memory management?

Re: Ubiquiti all but confirms breach response iniquity

#253

Post by lucb1e »

lostlogin wrote: post #196
lucb1e wrote: post #30

Earlier quoted context omitted.

A friend of my boss recommended Ubiquity semi-recently. We're a small IT company, plenty of theoretical expertise but no dedicated network admins, so it made sense to go on a recommendation. The fact that doing anything , for example assigning a VLAN to a switch port, requires you to first setup a mongodb server on your machine before you can install the controller software tipped me off to the quality of what we had…

> The device also gets like 80°C while idle. This sounds like a 8 port poe switch. They get hot. However they also don’t seem to mind it.

I'm not worried for the switch, I'm wondering about the useless power draw of the gazillion switches they sold. An idle switch should be barely above environmental temperature, not produce gaming PC levels of heat.

It's not PoE and more than 8 ports.

Re: Ubiquiti all but confirms breach response iniquity

#254

Post by sigg3 »

KirillPanov wrote: post #36
Hikikomori wrote: post #27

Earlier quoted context omitted.

Afaik performance will be abysmal on edge router series as the npu isn't used.

From firsthand experience: performance is in fact awesome on the edgerouters (4, 6, 8, and 12) using plain-vanilla Linux. It's a big honking MIPS chip with firehose connections to the ethernet PHYs. Precisely the kind of device you want for a router.

Please elaborate.

What are the thruput measurements on OpenWRT when compared to ER-.. stock firmware, with hw accel or with DPI..?

I have an ER-4 to be able to use the entire wan connection, but on stock firmware I must disable DPI to enable hw acceleration (otherwise the thruput floors). I don't use DPI atm, so no big loss.

Can you utilize the hw accel in openWRT too?

Re: Ubiquiti all but confirms breach response iniquity

#255

Post by tobr »

woofie11 wrote: post #123
TeMPOraL wrote: post #56

Earlier quoted context omitted.

That would be the reverse of the usual strategy, wouldn't it? Most companies seem to try to pin breaches on sophisticated hacker groups backed by nation states. But then, they benefit from the perception of a threat that's impossible to defend from (so there wasn't anything they could do) - whereas Ubiquiti benefits from people thinking the attack was just a small actor that couldn't possibly threaten Ubiquiti's cust…

Accusing whistleblowers of criminal activity? That's a pretty common ploy. Been there, done that. Early in my career when I was naive enough to try to whistleblow on things over my head.

I’d love to hear that story, if you can share it!

Re: Ubiquiti all but confirms breach response iniquity

#256

Post by ImprovedSilence »

miles wrote: post #101
monkey34 wrote: post #67

Earlier quoted context omitted.

While I've not yet made the purchase, I'm eyeing a Synology RT2600ac ( https://www.synology.com/en-us/products/RT2600ac ) and an MR2200ac ( https://www.synology.com/en-us/products/MR2200ac#specs ). It seems like they'll be adding VLAN support in their 1.3 release ( https://community.synology.com/enu/forum/2/post/130414 ), which should be nice for adding dedicated VPN and guest networks. For me it's one of the few opt…

https://www.amazon.com/gp/customer-reviews/R3GCUBZSITZCYS/

Fwiw, i have 2 synology routers, and did not have to create a cloud account or use the cloud to setup. Its there, and an option, and you can get other plugins if u have the cloud account, but by no means is it required for setup or use.

Re: Ubiquiti all but confirms breach response iniquity

#257

Post by UncleMeat »

tediousdemise wrote: post #252
bogwog wrote: post #167

Earlier quoted context omitted.

C++? Safe??

Smart pointers? Automatic memory management?

They help a little. But there are so many more ways of introducing vulns to C++ programs than just double frees and use-after-free. Replacing all your pointers with shared_ptr won't give you a safe program. Not even close.

Re: Ubiquiti all but confirms breach response iniquity

#258

Post by ex_ubiquiti »

_pplp wrote: post #216
ex_ubiquiti wrote: post #171

Earlier quoted context omitted.

> There was no company wide communication, and all communication channels were made private I couldn't understand why the ex-Amazon cloud lead was also in charge of Slack. When he made all channels private and put a Slackbot in every channel to monitor conversations, I knew it was all over. I'm worried his Slackbot logs are part of the leak. Guy had his hands in everything :( Same guy who took over GitHub and forced…

I mean, I didn't necessarily agree with all of his methods or reasonings on everything, but I've come to realize a lot of times his hands were just as tied as ours. And the draconian surveillance stuff? Yeah, he was directed to do that. One guess by whom. He was "in charge" because he convinced Robert that he was the right guy for the job by finding a security flaw that let him log into Robert's personal UniFi Protec…

He was in charge of cloud when he "found" a way to forge Ubiquiti SSO logins for any user using his root access to the SSO signing secrets.

In the Krebs article the whistleblower calls out forging SSO logins as one of the things that was compromised. If the attacker is really an ex-employee like Ubiquiti says, then it's scary that the SSO signing keys aren't even being rotated after the account forgery stunt.

> Adam says the attacker(s) had access to privileged credentials that were previously stored in the LastPass account of a Ubiquiti IT employee, and gained root administrator access to all Ubiquiti AWS accounts, including all S3 data buckets, all application logs, all databases, all user database credentials, and secrets required to forge single sign-on (SSO) cookies.

Re: Ubiquiti all but confirms breach response iniquity

#259

Post by ex_ubiquiti »

lazyweb wrote: post #111

Mentioned it before, but since a few days ago my unifi devices (2 wifi APs, a small switch, plus one Debian VM with the controller, all on it's on VLAN) are not allowed to do outbound traffic anymore, with the exception of NTP, DNS and one trusted apt mirror. Looking at the firewall logs it seems the devices try to ping (ICMP type 8) a bunch of AWS IPs every few hours. The controller tries to connect 80/443 on differ…

Is that going to the trace service?

There was a falling out between teams while I was there because the cloud team wanted to collect stats from APs even when users disabled analytics in the UI. It was so bad that some of the developers and one of the leads quit because they didn't want to be a part of it.

Someone on Reddit started reverse engineering it https://www.reddit.com/r/Ubiquiti/comments/lwr4ud/update_ubi... The APs are reporting things like connected clients and client stats according to recent dumps. Do you have analytics disabled in the UI and this is still happening?

Re: Ubiquiti all but confirms breach response iniquity

#260

Post by [deleted] »

jiggawatts wrote: post #238
worik wrote: post #211

I can believe that they do not keep logs of the database access. As brain dead as it sounds. I have been in the position of implementing a client on a API I do not control. The owners of the servers (colleagues but in a different country) do not seem to know what logs are. We get random failures from the server. I can pin down to the second when they occur (not closer because of network lag). I suspect that the serve…

Logs are typically off by default in most Enterprise software, or goes nowhere by default which is basically the same thing. Logs cost money to both collect and store. Not everyone is cheerfully burning through VC capital. Some people have budgets. Speaking of log collection, simply dumping the logs into a central repository is the same as taking the garbage to the landfill. Collecting trash just results in a big col…

[deleted]
Post reply on HN