Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Former Ubiquiti employee charged with stealing data and extorting company

justice.gov

Post reply on HN
Print view View original

181–190 of 244 posts

Re: Former Ubiquiti employee charged with stealing data and extorting company

#181

Post by staticassertion »

neom wrote: post #180
staticassertion wrote: post #177

Earlier quoted context omitted.

> Is that (creds) considered safe/secure these days? No, definitely not. It's just super convenient and happens all the time at every organization. The most recent Twitter breach involved a credential shared in a Slack channel. Security teams have a hard time monitoring Slack and the default settings are pretty bad (infinite session length, infinite message retention).

Should there be a chat bot for this? "Hey, I see you just shared a credential, I'll remind you in 5 minutes to delete it, if the message is not deleted I'll alert a member of the security team" kinda thing?

Absolutely. I know lots of companies have rolled their own. I'm unaware of a public one. I've been meaning to write one myself, maybe I'll do that this weekend.

Re: Former Ubiquiti employee charged with stealing data and extorting company

#182

Post by kadoban »

stjohnswarts wrote: post #161
astrange wrote: post #91

Earlier quoted context omitted.

Paypal, and apparently this guy's email server, don't have a no-receipts policy though.

some services drop your payment information after something like 45 days, -supposedly-. Who knows if they actually do.

Yeah, so many say that, but I do find it very hard to believe.

If nothing else, wouldn't they want to keep some information about customers that in the past have abused the service? You need some way to ban assholes, right? How would you do that if you have no idea who anyone is?

Re: Former Ubiquiti employee charged with stealing data and extorting company

#183

Post by krisoft »

staticassertion wrote: post #169
ivalm wrote: post #66

Earlier quoted context omitted.

> When faced correcting a false reality you have created, it can be quite hard to decide to phase change into telling the truth. The lies that come out come from not being prepared and not being a very good liar. For people who lie like this, a good way to think about it is as though it were a disease. Or just don’t talk to the police and lawyer up. I agree the best thing is to not do the crime, but if you are a crim…

Having a lawyer doesn't mean you can just not answer questions when subpoenad. "Don't talk to cops" is complicated.

Yes, it is complicated. And that is why you need the lawyer.

Re: Former Ubiquiti employee charged with stealing data and extorting company

#184

Post by neom »

staticassertion wrote: post #181
neom wrote: post #180

Earlier quoted context omitted.

Should there be a chat bot for this? "Hey, I see you just shared a credential, I'll remind you in 5 minutes to delete it, if the message is not deleted I'll alert a member of the security team" kinda thing?

Absolutely. I know lots of companies have rolled their own. I'm unaware of a public one. I've been meaning to write one myself, maybe I'll do that this weekend.

Can I help you with it just for fun? I'm not an engineer but somehow I'd love to help you! :) I added you on linkedin.

Re: Former Ubiquiti employee charged with stealing data and extorting company

#185

Post by staticassertion »

neom wrote: post #184
staticassertion wrote: post #181

Earlier quoted context omitted.

Absolutely. I know lots of companies have rolled their own. I'm unaware of a public one. I've been meaning to write one myself, maybe I'll do that this weekend.

Can I help you with it just for fun? I'm not an engineer but somehow I'd love to help you! :) I added you on linkedin.

Sure, though I'm planning to write it in Rust so if you're not an engineer it may be a bit rough. Will reply on Linkedin though.

Re: Former Ubiquiti employee charged with stealing data and extorting company

#186

Post by staticassertion »

krisoft wrote: post #183
staticassertion wrote: post #169

Earlier quoted context omitted.

Having a lawyer doesn't mean you can just not answer questions when subpoenad. "Don't talk to cops" is complicated.

Yes, it is complicated. And that is why you need the lawyer.

I missed where it said he didn't have a lawyer?

Re: Former Ubiquiti employee charged with stealing data and extorting company

#188

Post by alex_sf »

stef25 wrote: post #114
underwater wrote: post #108

Earlier quoted context omitted.

If they're accusing you the they are at the stage where they already convinced you did it. They would simple think the receipt is an easily faked alibi. Then by talking to them you accidentally give them ammunition. "Yeah, I hated the guy, but I couldn't have killed him" turns into "the defendant told us that he hated the guy". Or you lie accidentally, which gives them another crime to threaten you with; "you had bet…

Surely there's a world where not every cop is bent on convicting the first guy that comes up in the conversation and every piece of evidence is seen as fake? It's totally true that you can give cops ammo against yourself without realizing and you must be very careful wrt lying and saying the wrong things. But there also has to be some kind of middle ground.

The middle ground is bringing in a mediator on your behalf that is a neutral party to the issue. I.e., get a lawyer.

Re: Former Ubiquiti employee charged with stealing data and extorting company

#189

Post by secureleaf »

cyounkins wrote: post #71
myrandomcomment wrote: post #41

Earlier quoted context omitted.

I used to recommend them. Not anymore. My complete home setup is all their kit (the GUI means that if I kick it, the family can likely sort - it is import). I opened a case that a replacement switch (new model, old is EOL) did not work with one of their POE devices. I know this stuff backwards and forwards. I did my testing and basically sent the case to support with all the details (I know this stuff at the ASIC lev…

Possibly related: Ubiquiti used non-standard 24V POE for some devices. Plugging standard 48V POE into certain old devices could damage them, and 48V devices won't power on with 24V injectors.

This is true, although it's important to differentiate active and passive adapters.

Ubiquiti sells some devices that are 24V passive PoE. These devices include their UISP products (such as devices like the AirMax). Passive injectors are dangerous because they always supply 24V to the port; this could damage a non-24V PoE device.

There's also the 802.3a* standards family, such as the 802.3at (what Ubiquiti calls PoE+). Each of the standards (e.g. 802.3at, 802.3af, etc.) support different amounts of current, but they're all 48V active adapters. Active PoE is safer because the device "requests" the power it wants; the switch does not always supply 48V power over the port, so devices that don't require PoE won't be receiving power.

Ubiquiti sells a few switches that support both 24V passive PoE and 48V active PoE. You can change this in the switch's web interface, through the port settings. You may also want to consider just using a 24V passive injector, especially if your switch cannot be configured to supply 24V power.

Re: Former Ubiquiti employee charged with stealing data and extorting company

#190

Post by tptacek »

sneak wrote: post #61
InTheArena wrote: post #46

I do that that the media that breathlessly amplified this persons attack should learn from it. In particular, As much as I like and appreciate his reporting, Brian Krebs was the key person amplifying this message - which makes him a unwitting accomplice to many billions of dollars of damage to ubiquiti shareholders. Responsible disclosure exists for a reason.

Brian Krebs isn't a good reporter or a good person. He has a history of doxxing people without basis (or for the basis of leaving bad reviews on his books). It disappoints me that he has the audience he does.

He's a reporter. "Doxxing" isn't a thing in journalism, even though it upsets people on message boards to hear it.
Post reply on HN