Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ubiquiti all but confirms breach response iniquity

krebsonsecurity.com

Post reply on HN
Print view View original

311–320 of 322 posts

Re: Ubiquiti all but confirms breach response iniquity

#311

Post by ThePowerOfFuet »

ex_ubiquiti wrote: post #259
lazyweb wrote: post #111

Mentioned it before, but since a few days ago my unifi devices (2 wifi APs, a small switch, plus one Debian VM with the controller, all on it's on VLAN) are not allowed to do outbound traffic anymore, with the exception of NTP, DNS and one trusted apt mirror. Looking at the firewall logs it seems the devices try to ping (ICMP type 8) a bunch of AWS IPs every few hours. The controller tries to connect 80/443 on differ…

Is that going to the trace service? There was a falling out between teams while I was there because the cloud team wanted to collect stats from APs even when users disabled analytics in the UI. It was so bad that some of the developers and one of the leads quit because they didn't want to be a part of it. Someone on Reddit started reverse engineering it https://www.reddit.com/r/Ubiquiti/comments/lwr4ud/update_ubi...…

I've DNS-blackholed trace.svc.ui.com (maybe it's slightly different, this is from memory) and plan to entirely wipe and sell all my UI gear within the next two months.

Re: Ubiquiti all but confirms breach response iniquity

#312

Post by jiggawatts »

worik wrote: post #295
jiggawatts wrote: post #238

Earlier quoted context omitted.

Logs are typically off by default in most Enterprise software, or goes nowhere by default which is basically the same thing. Logs cost money to both collect and store. Not everyone is cheerfully burning through VC capital. Some people have budgets. Speaking of log collection, simply dumping the logs into a central repository is the same as taking the garbage to the landfill. Collecting trash just results in a big col…

It is untrue that logs are trash. I gag at the comparison. If the would just look at logs they could answer so many questions that are costing a lot of money. I am used to a Unix world, with logs as text files. They take up very little room, and it is easy to through out old ones (keeping logs for ever is foolish for a lot of reasons). I am staggered that "I turned logging on extensively for a recent Azure project. S…

> There is no way that this can be true unless there is some very very bad craziness going on. A real mindfuck

System Center Operations Manager and all derived products such as the various Azure Monitor and Azure Logs offerings have craziness going on.

For example, a typical metric is stored with a 300:1 write amplification because the database schema they use repeats the fully qualified machine name, counter name, and counter instance name per measurement. This prevents the collection of a useful set of metrics at a useful frequency.

Logs are similarly generated using suuuuuuper verbose JSON, capturing everything except the critical fields you actually wanted, and then stored uncompressed record-by-record, keeping the full field names for each and every row.

What incentive do you think they have to improve on the efficiency of the wire format or the storage format if they charge by the gigabyte?

Re: Ubiquiti all but confirms breach response iniquity

#313

Post by abestic9 »

jimnotgym wrote: post #241

Hang on a minute there > Ubiquiti’s IoT gear includes things like WiFi routers I understood IoT to mean wifi toasters, TVs and other home appliances. Since when was a router an IoT device? Are we going to call all nework devices IoT now. This strikes me as taking rather too much journalistic license. In fact wtf is a WiFi Router . I use Unifi to deploy Wireless Acess Points on a LAN with centralized control. It is po…

I believe the IoT distinction is that the platform reports to a cloud service, where parts of that are implemented as SaaS, if only for SSO and remote management. I think this is a fairly loose definition though if the underlying device data is still on-prem.

Wi-Fi router I would take to mean one of those consumer all-in-one boxes, which is what the UDM fits the description of.

I agree that this distinction is unnecessary. When we consider who wrote the article and who it's for, we should expect a bit more granularity than foggy acronyms.

Re: Ubiquiti all but confirms breach response iniquity

#314

Post by Sebb767 »

theshrike79 wrote: post #217
Sebb767 wrote: post #210

Earlier quoted context omitted.

Depending on your viewpoint. Compared to an enterprise setup with similar features? Basically free. Compared to your average all-in-one home router, however, these are very expensive.

> Compared to your average all-in-one home router, however, these are very expensive. Compared to your average all-in-one home router, however, these are also markedly less shitty.

Are they, though? The only difference my parents (for example) would recognize between their ISP router and Ubiquiti would (might) be that the WiFi is "a bit better". And talking about security is a bit moot, given the topic of this thread.

Don't get me wrong, I see why you would spend money on Ubiquiti gear; in fact, I run a similar setup. But for your average non-technical user, it's going to be a harder sell. It's the same reason you (probably) don't run a several thousand euro enterprise WiFi at home.

Re: Ubiquiti all but confirms breach response iniquity

#315

Post by worik »

jiggawatts wrote: post #312
worik wrote: post #295

Earlier quoted context omitted.

It is untrue that logs are trash. I gag at the comparison. If the would just look at logs they could answer so many questions that are costing a lot of money. I am used to a Unix world, with logs as text files. They take up very little room, and it is easy to through out old ones (keeping logs for ever is foolish for a lot of reasons). I am staggered that "I turned logging on extensively for a recent Azure project. S…

> There is no way that this can be true unless there is some very very bad craziness going on. A real mindfuck System Center Operations Manager and all derived products such as the various Azure Monitor and Azure Logs offerings have craziness going on. For example, a typical metric is stored with a 300:1 write amplification because the database schema they use repeats the fully qualified machine name, counter name, a…

Perhaps it is too much to ask for the HTTP request strings dumped to a file?

If it is too much for production, turn it on for development servers.

My foreign friends seem to know not what that means

Re: Ubiquiti all but confirms breach response iniquity

#316

Post by msh »

youngtaff wrote: post #245
msh wrote: post #239

Earlier quoted context omitted.

Meraki go is their direct unifi competitor.

Trouble is the firewall in the Meraki Go Gateway only does 250Mbps - bit crap if you've got gigabit fibre to the house https://www.meraki-go.com/products/security-gateway/

Yeah but that is something unifi only recently fixed with the dream machine. The standard unifi security gateway mazes out below 100 megabit if ips and ids is enabled.

Re: Ubiquiti all but confirms breach response iniquity

#317

Post by CRConrad »

theshrike79 wrote: post #217
Sebb767 wrote: post #210

Earlier quoted context omitted.

Depending on your viewpoint. Compared to an enterprise setup with similar features? Basically free. Compared to your average all-in-one home router, however, these are very expensive.

> Compared to your average all-in-one home router, however, these are very expensive. Compared to your average all-in-one home router, however, these are also markedly less shitty.

> Compared to your average all-in-one home router, however, these are also markedly less shitty.

Unless, of course, you find spyware shitty... Which one would think most reasonable people do.

Re: Ubiquiti all but confirms breach response iniquity

#318

Post by theshrike79 »

Sebb767 wrote: post #314
theshrike79 wrote: post #217

Earlier quoted context omitted.

> Compared to your average all-in-one home router, however, these are very expensive. Compared to your average all-in-one home router, however, these are also markedly less shitty.

Are they, though? The only difference my parents (for example) would recognize between their ISP router and Ubiquiti would (might) be that the WiFi is "a bit better". And talking about security is a bit moot, given the topic of this thread. Don't get me wrong, I see why you would spend money on Ubiquiti gear; in fact, I run a similar setup. But for your average non-technical user, it's going to be a harder sell. It's…

If you've got under a half dozen devices in your network, just go with the ISP provided one. When you start approaching dozens of devices, the ISP ones tend to choke.

And yes, Ubiquiti most definitely isn't for non-technicals (Except for the AmpliFi stuff). It's more prosumer grade stuff. More features than the "gaming wifi" crap but still easier to configure than official Cisco stuff.

Re: Ubiquiti all but confirms breach response iniquity

#319

Post by cure »

bscphil wrote: post #233
KirillPanov wrote: post #35

Earlier quoted context omitted.

Ubiquiti does not lock their bootloaders like phone manufacturers do. It is very, very easy to run vanilla Linux (or even OpenBSD) on their hardware. I do exactly this: https://news.ycombinator.com/item?id=26645062 Octeons (not Octeon-TX) are amazing processors. Ubiquiti makes killer hardware. I hear their software is junk but wouldn't really know since I always erase it immediately after unboxing.

Do you run Debian on Ubiquiti's access points too?

Not with Debian, but I do this routinely with OpenWRT.

Re: Ubiquiti all but confirms breach response iniquity

#320

Post by sylens »

sigg3 wrote: post #249
sylens wrote: post #115

Earlier quoted context omitted.

I feel the same way - my Nighthawk is going strong with custom firmware, but my friends with Ubiquiti gear try to get me to replace it with a bunch of Unifi stuff every time I talk to them.

What firmware? I need new APs soon.

https://www.myopenrouter.com/blog/asuswrt-merlin-xwrtcross-w...
Post reply on HN