Former Ubiquiti employee charged with stealing data and extorting company • Hacker News Board

Re: Former Ubiquiti employee charged with stealing data and extorting company

#31

Post by dotBen » Thu, Dec 02, 2021, 4:06 AM UTC

mjamil wrote: post #13

Mr. Sharp is apparently not so sharp. He carried out the attack from his home network. He connected directly for enough time that his bare IP was logged. The rest of the time, he carried out the attack using a commercially purchased VPN solution that was trivial to trace back to him via the purchase record. He lied to the FBI. (I have yet to understand why people talk to law enforcement instead of staying silent so a…

(I have yet to understand why people talk to law enforcement instead of staying silent so as to not implicate themselves.)

When the FBI knock at the door you totally do the whole "no comment/talk to my lawyer" thing. But what happens next if you're actually part of an investigation is they hand you a grand jury subpoena (which they were going to do anyway, even if you just talked willingly, because they have already gone to the trouble of asking a judge to issue one and have it with them by the time they ring your doorbell)

That subpoena is likely to require you to hand over any digital records you have related to the investigation (you can't plead 5th on that) and turn up at a time and place to be interviewed (you have to turn up, even if it's on the other side of the country eg in the Southern District of NY in Manhattan and you live in SF Bay Area). BTW I don't think people widely realize the government has the power to compel you to hand over EVERY piece of material you have on a given subject they are investigating - eg search and share anything from every email you have ever received since you signed up for GMail in 2004, etc.

You can plead 5th during the interview but if you have material information (or are actually guilty) and knowing they have all of the documentation subpoenaed and whatever other evidence from other subjects/targets/witnesses, it will likely help you at that point to be cooperative via guidance from your attorney. Remaining silent at that point is just going to leave you at the mercy of whatever other witnesses/subjects/targets convey and their own conclusions from the subpoenas.

If you are on a visa or green card you almost certainly can't plead the 5th because they can leverage your right to remain in the US.

So, that's why people typically talk to the FBI. It's not at the doorstep when they first engage you, it's once you have been compelled to participate.

Source: happened to me a number of years ago, although I wasn't guilty of anything. Lawyered up, cooperated, no further action. Wasn't pleasant.

IANAL, not legal advice

Re: Former Ubiquiti employee charged with stealing data and extorting company

#32

Post by wnevets » Thu, Dec 02, 2021, 4:07 AM UTC

So that "hack" from a few months ago really wasn't a hack at all, it was an inside job?

Re: Former Ubiquiti employee charged with stealing data and extorting company

#33

Post by [deleted] » Thu, Dec 02, 2021, 4:08 AM UTC

baskethead wrote: post #27

ex_ubiquiti wrote: post #23

Ex-Ubiquiti employee here. Nick Sharp wasn't just a senior software engineer. He was the Cloud Lead and ran the whole cloud team. His LinkedIn profile will confirm it. This is why he had access to everything. Nick had his hands in everything from GitHub to Slack and we could never understand why or how. He rose to power in the company by claiming to find a vulnerability that let him access the CEO's personal system,…

Is this why Ubiquiti quality has fallen over the last ~2 years? I went all-in on Ubiquiti almost 3 years ago and I’ve been less than thrilled with the quality and level of support. This chaos that you say happened seems to line up with what I was seeing as a customer but everyone has been shocked at how UI has dropped in terms of quality.

[deleted]

Re: Former Ubiquiti employee charged with stealing data and extorting company

#34

Post by jeroenhd » Thu, Dec 02, 2021, 4:10 AM UTC

He could've prevent all of this by a) making sure his traffic was blackholed when the VPN went down and b) adding another layer from a free service (like TOR or a proxy or another VPN). He also should've been actively using the VPN so his traffic patterns wouldn't stand out as much, and so his purchase would be justifiable. If he really did buy the VPN 6 months ahead then he was a fool to leave the subscription dormant. If he wanted a fire and forget VPN subscription, he also could've bought the subscription with stolen credit cards. He would've had to make sure to only connect to the VPN through something like TOR, but credit card fraud is pretty difficult to trace if you do it right.

Had he put in a little more thought and preparation then I still don't know if he would've gotten away with it, but at least he'd be in a better position. He wouldn't have to lie to the FBI agents and they probably would've had to catch him by going after the source of the place where the data was leaked instead.

Opsec is hard, but this is just embarrassing for someone in the know trying to steal 50 bitcoin. I'm also not sure why he did it. Suddenly owning a few million in crypto would be noticed, unless he didn't spend any of it, ever. What was his plan, just quit his job and move away right after the hack?

Re: Former Ubiquiti employee charged with stealing data and extorting company

#35

Post by lotsofpulp » Thu, Dec 02, 2021, 4:12 AM UTC

baskethead wrote: post #27

ex_ubiquiti wrote: post #23

Ex-Ubiquiti employee here. Nick Sharp wasn't just a senior software engineer. He was the Cloud Lead and ran the whole cloud team. His LinkedIn profile will confirm it. This is why he had access to everything. Nick had his hands in everything from GitHub to Slack and we could never understand why or how. He rose to power in the company by claiming to find a vulnerability that let him access the CEO's personal system,…

Is this why Ubiquiti quality has fallen over the last ~2 years? I went all-in on Ubiquiti almost 3 years ago and I’ve been less than thrilled with the quality and level of support. This chaos that you say happened seems to line up with what I was seeing as a customer but everyone has been shocked at how UI has dropped in terms of quality.

I read somewhere (maybe on Reddit) that ubiquiti had started offshoring a lot of the work and as a result quality had suffered.

Re: Former Ubiquiti employee charged with stealing data and extorting company

#36

Post by zamadatix » Thu, Dec 02, 2021, 4:13 AM UTC

baskethead wrote: post #27

ex_ubiquiti wrote: post #23

Ex-Ubiquiti employee here. Nick Sharp wasn't just a senior software engineer. He was the Cloud Lead and ran the whole cloud team. His LinkedIn profile will confirm it. This is why he had access to everything. Nick had his hands in everything from GitHub to Slack and we could never understand why or how. He rose to power in the company by claiming to find a vulnerability that let him access the CEO's personal system,…

Is this why Ubiquiti quality has fallen over the last ~2 years? I went all-in on Ubiquiti almost 3 years ago and I’ve been less than thrilled with the quality and level of support. This chaos that you say happened seems to line up with what I was seeing as a customer but everyone has been shocked at how UI has dropped in terms of quality.

I mean this genuinely: I'm amazed there was a point at which people were ever thrilled enough with the quality and level of support from Ubiquiti that they are now shocked. Other than the working hours first level chat support I can't think of anything they had in support that remotely resembled having quality support. Shit, 3 years ago I was happy if there was someone on the forums that found a version of firmware that had killer features like "routing, hardware NAT, and IPv6" working all at the same time without (major) bugs. Low quality software and support with cheap hardware is what they've always been known for with everyone I've ever talked to.

Re: Former Ubiquiti employee charged with stealing data and extorting company

#37

Post by zamadatix » Thu, Dec 02, 2021, 4:26 AM UTC

oars wrote: post #16

Ubiquiti's stock price (NYSE: UI) dropped by over 25% from $380 to $290 during the week following news of its breach. That's almost $5 billion wiped off the company's market capitalisation because of this employee.

Probably could have been a lot less and/or recovered by now had Ubiquiti not also gone through great lengths to cover it up and actively avoid taking appropriate mitigation action. https://krebsonsecurity.com/2021/03/whistleblower-ubiquiti-b...

I mean Nick Sharp certainly took a chunk out of them but there is more to the story for why the market lost that much faith.

Re: Former Ubiquiti employee charged with stealing data and extorting company

#38

Post by klabb3 » Thu, Dec 02, 2021, 4:32 AM UTC

LiquidPolymer wrote: post #19

I've always been fascinated by the idea that intelligence lies within a spectrum. Someone might be incredibly smart about a narrow topic or field, yet be blind to their own stupidity within another realm. To me, this seems like a classic example. To quote the press release: "During the execution of that search, SHARP made numerous false statements to FBI agents, including, among other things, in substance, that he wa…

> I've always been fascinated by the idea that intelligence lies within a spectrum. Someone might be incredibly smart about a narrow topic or field, yet be blind to their own stupidity within another realm.

I've been seriously bitten by this, and find it more scary than fascinating. Growing up, I thought people who followed cult leaders and charismatic narcissists were so stupid (still do), it appeared so transparent to me. Later, in my professional and adult life I found myself to be equally gullible when intelligent people were abusive or outright dumb in other areas. This has been a challenge to unlearn, like learning an old dog to sit. Basically, our proxies for predicting people's character range from bad to terrible.

Re: Former Ubiquiti employee charged with stealing data and extorting company

#39

Post by teeray » Thu, Dec 02, 2021, 4:32 AM UTC

> At one point during the exfiltration of Company-1 data, SHARP’s home IP address became unmasked following a temporary internet outage at SHARP’s home

It’s interesting that that was what brought him down. I was going to guess a rogue log from the VPN provider until I got to that point.

Re: Former Ubiquiti employee charged with stealing data and extorting company

#40

Post by gonehome » Thu, Dec 02, 2021, 4:33 AM UTC

dotBen wrote: post #31

mjamil wrote: post #13

Mr. Sharp is apparently not so sharp. He carried out the attack from his home network. He connected directly for enough time that his bare IP was logged. The rest of the time, he carried out the attack using a commercially purchased VPN solution that was trivial to trace back to him via the purchase record. He lied to the FBI. (I have yet to understand why people talk to law enforcement instead of staying silent so a…

(I have yet to understand why people talk to law enforcement instead of staying silent so as to not implicate themselves.) When the FBI knock at the door you totally do the whole "no comment/talk to my lawyer" thing. But what happens next if you're actually part of an investigation is they hand you a grand jury subpoena (which they were going to do anyway, even if you just talked willingly, because they have already…

> "it will likely help you at that point to be cooperative via guidance from your attorney"

guidance from your attorney seems to be the critical bit of that - it's okay to talk, but with your lawyer present.