Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Former Ubiquiti employee charged with stealing data and extorting company

justice.gov

Post reply on HN
Print view View original

101–110 of 244 posts

Re: Former Ubiquiti employee charged with stealing data and extorting company

#101

Post by the_gipsy »

stef25 wrote: post #97
ex_ubiquiti wrote: post #23

Ex-Ubiquiti employee here. Nick Sharp wasn't just a senior software engineer. He was the Cloud Lead and ran the whole cloud team. His LinkedIn profile will confirm it. This is why he had access to everything. Nick had his hands in everything from GitHub to Slack and we could never understand why or how. He rose to power in the company by claiming to find a vulnerability that let him access the CEO's personal system,…

> He rose to power in the company by claiming to find a vulnerability that let him access the CEO's personal system Do you mean he got promotions cause he found a non existent vuln? Surely whoever handed out those promotions is to blame here?

Ultimately, you can blame the CEO for everything.

Re: Former Ubiquiti employee charged with stealing data and extorting company

#102

Post by Thorrez »

kabes wrote: post #90
throwuxiytayq wrote: post #80

Earlier quoted context omitted.

> wrote everything in Node, but absolutely _refused_ to use any existing libraries except for ones he personally wrote. He didn't "trust" them. Sounds like the single sensible thing he did. Have you seen the npm ecosystem?

Are node apps getting way more hacked than say php or java servers? Was his code any better?

There are frequently posts on HN about NPM packages getting compromised.

Of the top 10 posts on HN about NPM in the past 30 days[1], 9 are about security problems, and last 1 is about package spam.

[1] https://hn.algolia.com/?dateRange=pastMonth&page=0&prefix=fa...

Re: Former Ubiquiti employee charged with stealing data and extorting company

#103

Post by dmix »

Vaslo wrote: post #42
seibelj wrote: post #11

Earlier quoted context omitted.

I'm a big fan of a show called "Forensic Files", which is like a real-life CSI where each episode is a documentary and only takes 20 minutes (I highly recommend). In addition to the the usual passion killings and random murders, there is the occasional criminal that thinks they are way smarter than everyone else and doubles or triples down even as the noose is tightening, because they 100% believe they are geniuses a…

George Trepal was certainly one of the better episodes! Amazing that one detective had to go undercover for almost two years before he slipped up. Then they found traces of the rare poison in his home. You’d think he would have trashed it and cleaned like crazy but I bet he thought he would get away with it and may want to do it again. Great show

They were also fortunate to have that level of expertise, both medically and law enforcement which the US offered.

But I guess in retrospect using an exotic method of killing someone is bound to draw heavy attention.

Re: Former Ubiquiti employee charged with stealing data and extorting company

#104

Post by the_gipsy »

throwuxiytayq wrote: post #80
_pplp wrote: post #76

Earlier quoted context omitted.

> This man was a senior developer Dude, let's not be generous. Could he write code? Yes. But this is a guy who wrote everything in Node, but absolutely _refused_ to use any existing libraries except for ones he personally wrote. He didn't "trust" them. He wasn't even hired on as a dev, he was hired to be the "Cloud guy", essentially a sysadmin for AWS, and basically spooked the CEO into giving him the keys to the cas…

> wrote everything in Node, but absolutely _refused_ to use any existing libraries except for ones he personally wrote. He didn't "trust" them. Sounds like the single sensible thing he did. Have you seen the npm ecosystem?

Why would you use node, if it wasn’t for the vast package exosystem?

Re: Former Ubiquiti employee charged with stealing data and extorting company

#105

Post by Thorrez »

DangitBobby wrote: post #85
Hamuko wrote: post #72

Earlier quoted context omitted.

Are you saying that someone purchased a VPN account using his PayPal account and by sheer coincidence, while that said VPN account was in middle of data exfiltration, his home IP address also connected to said servers with no connection to the exfiltration?

I mean... That is what someone who's setting up a patsy would do if they could. Home networks are not exactly Fort Knox, are they? I had a bunch of rogue connections banging around trying to brute-force database logins within my home LAN earlier this year. I imagine they could have made a connection to a server look like it originated from within my LAN, and if I wasn't watching a live feed of my database connection…

Why, after he realized his own PayPal account had been hacked and used to hack his own company, would he then become a whistleblower and accuse his company of not investigating the hack?

He should have been spending his time finding out how his PayPal account and home network got hacked, not talking to journalists accusing the company of not handling the hack correctly.

Re: Former Ubiquiti employee charged with stealing data and extorting company

#106

Post by Thorrez »

astrange wrote: post #89
fastball wrote: post #69

Earlier quoted context omitted.

Alas not true. The higher your market cap, the more money you can raise by printing more stocks.

Theoretically it would go down if you did that. In practice it seems to go up if people like you.

>Theoretically it would go down if you did that.

Why? If a company prints a single stock then sells it for $100, I would expect the company's market cap to go up by $100 since it now has $100 more dollars in its bank account.

Re: Former Ubiquiti employee charged with stealing data and extorting company

#107

Post by function_seven »

stef25 wrote: post #98
sneak wrote: post #57

Earlier quoted context omitted.

Most people don't understand that they can't explain themselves out of a legal investigation. LEOs exploit this.

Imagine the simple scenario of "someone who looks like you was spotted in area X doing crime Y" and in your pocket you have a receipt that puts many miles away at that time (or something else that would immediately stop you from being a suspect). In what way would "fuck you talk to my lawyer" be helpful?

1. You don't have to say it aggressively. Politely say, "I need to talk to my lawyer before answering questions."

2. “The suspect conveniently had a receipt in their pocket placing them elsewhere at the exact time of the Y crime. It was the only receipt in his pocket! Seems suspicious to me. He plainly engineered the alibi.”

3. There's no reason you have to immediately begin demonstrating your innocence. It can wait until you have proper representation.

It's rarely the case where a receipt in your pocket is the difference between handcuffs and freedom. I'm sure they exist, but more often the decision to arrest you or not is not hinging on your answers to the cop's questions. It's already been made.

Re: Former Ubiquiti employee charged with stealing data and extorting company

#108

Post by underwater »

stef25 wrote: post #98
sneak wrote: post #57

Earlier quoted context omitted.

Most people don't understand that they can't explain themselves out of a legal investigation. LEOs exploit this.

Imagine the simple scenario of "someone who looks like you was spotted in area X doing crime Y" and in your pocket you have a receipt that puts many miles away at that time (or something else that would immediately stop you from being a suspect). In what way would "fuck you talk to my lawyer" be helpful?

If they're accusing you the they are at the stage where they already convinced you did it. They would simple think the receipt is an easily faked alibi.

Then by talking to them you accidentally give them ammunition. "Yeah, I hated the guy, but I couldn't have killed him" turns into "the defendant told us that he hated the guy". Or you lie accidentally, which gives them another crime to threaten you with; "you had better plead out, because we have a whole list of crimes we can get you for".

If someone thinks you have wronged them or committed a crime do not engage them. You will not change their mind. You are not that convincing, and they will see your efforts as manipulative and slimey.

(My own first-hand experience with this was civil, not criminal. Someone I had never met accused me of something absolutely nonsensical and filed a lawsuit against me. I thought I could reason with them, but this just made things worse. I would have been much better to approach the situation as though they were dangerously irrational. Just don't engage.)

Re: Former Ubiquiti employee charged with stealing data and extorting company

#109

Post by philjohn »

1991g wrote: post #83
bithavoc wrote: post #20

A quick search revealed a LinkedIn profile[0] of a previous Ubiquiti employee, he seemed to have left the company in March 2021. I wonder what was first, he quitting his job at Ubiquiti or the FBI Raid. [0] https://www.linkedin.com/in/nickolassharp

Somewhat amusing that he has a new dev job since the incident.

Even more amusing is reading some of the job descriptions ...

Re: Former Ubiquiti employee charged with stealing data and extorting company

#110

Post by stef25 »

function_seven wrote: post #107
stef25 wrote: post #98

Earlier quoted context omitted.

Imagine the simple scenario of "someone who looks like you was spotted in area X doing crime Y" and in your pocket you have a receipt that puts many miles away at that time (or something else that would immediately stop you from being a suspect). In what way would "fuck you talk to my lawyer" be helpful?

1. You don't have to say it aggressively. Politely say, "I need to talk to my lawyer before answering questions." 2. “The suspect conveniently had a receipt in their pocket placing them elsewhere at the exact time of the Y crime. It was the only receipt in his pocket! Seems suspicious to me. He plainly engineered the alibi.” 3. There's no reason you have to immediately begin demonstrating your innocence. It can wait…

You mistook my assertiveness for aggression :) And let's assume it's not just the only receipt you happen to have in your house.

Anyway, real life example - police calls me up saying this number came up in an investigation, who are you and a few more other questions. They were obviously expecting me to cooperate cause they hadn't bothered to do the paperwork to obtain my identity which was tied to the number. First thing I did was say I'll call you back cause I'm driving, what's your name? So I could verify it was an actual cop.

When I called them back I said I'm not telling you anything until you tell me what it's about. Cop hesitantly starts giving a few bits of information and we go back and forth until my mother's town comes up (too small a place to be a coincidence) and the whole thing unravels.

Turns out my mom had been getting some weird calls at home and when she was out & about by a person who seemed to be following her. Because of her age and absentmindedness she gave the wrong number out of her recent calls list to the police. Hilarity ensues. Cop suggests I check on my mom, we genuinely thought she had some kind of attack of dementia (she was fine, just very embarrassed).

Cop also called my mom to saying your kid's a real hard-ass (but polite and correct)!

Anyway my point is - don't you think me lawyering up for this would have been absurd?

Post reply on HN