I wonder why the developer had access to so many resources on AWS and GitHub? Can’t these excessive permissions be removed? Why it was undetected for such long time?
He was part of the team investigating the hack.
Ubiquiti developer charged with extortion, causing 2020 “breach”
41–50 of 239 posts
Re: Ubiquiti developer charged with extortion, causing 2020 “breach”
#42The funny thing is that krebsonsecurity.com are the ones that published the false information in the first place. Good summary of the whole saga by Crosstalk youtube channel which covers mostly Ubiquiti: https://www.youtube.com/watch?v=paLm0tP5GbI
I give Krebs a little credit here because the "whistleblower" from his original article was really an insider that was part of the investigation into the breach. Obviously this source was also the hacker, but knowing that was impossible.
Now, I believe Krebs should at least acknowledge he made this mistake, sadly he hasn't here yet.
Re: Ubiquiti developer charged with extortion, causing 2020 “breach”
#43Earlier quoted context omitted.
use tor. it's specifically designed to avoid traffic leaks (as long as you don't open an external application). I trust that far more than whatever "killswitch" VPN providers have, or properly implementing a home rolled solution with iptables/network namespaces/raspberry pis. the "bouncing your traffic across 3 servers to obfuscate tracking" is a nice bonus as well.
That wouldn't solve this problem. The VPN issue was a 'killswitch' mode that was turned off, or didn't work 100% of the time. You could encounter the same issue with Tor. They didn't have their IP leak via webrtc or some special protocol, it was the VPN app itself with the bug.
>The VPN issue was a 'killswitch' mode that was turned off, or didn't work 100% of the time. You could encounter the same issue with Tor.
No you won't, because tor isn't a VPN. In fact it specifically tells you not to use it with other browsers/applications[1]. It's a combo of a browser + tor client. The browser has its proxy set to the tor client, so the only way it can reach the internet is via tor. Getting that to behave properly is far easier/reliable than trying to get it to work for every application/os/hardware configuration.
[1] https://2019.www.torproject.org/docs/faq.html.en#CompatibleA...
Re: Ubiquiti developer charged with extortion, causing 2020 “breach”
#44Earlier quoted context omitted.
While wearing a hoodie and a face mask and probably some other accessories
like this? https://www.freepik.com/free-photo/hacker-with-anonymous-mas...
No like this.
Re: Ubiquiti developer charged with extortion, causing 2020 “breach”
#45Earlier quoted context omitted.
He wasn’t just any dev but the cloud lead.
Accounts and actions like this are easily managed in AWS GuardDuty since they were so foreign from the user benchmarks. Outside of the normal security standards you'd expect of next level monitoring from companies such as CrowdStrike. It took Ubiquiti weeks to notice these issues and he used the AWS root account, this account should be actively secured and alerted for abuse using AWS GuardDuty or similar. I've made m…
But who configures AWS GuardDuty and who does it report to? Presumably the root account owner? In that case, wouldn't that be the cloud lead?
Re: Ubiquiti developer charged with extortion, causing 2020 “breach”
#46> Investigators say they were able to tie the downloads to Sharp and his work-issued laptop because his Internet connection briefly failed on several occasions while he was downloading the Ubiquiti data. Those outages were enough to prevent Sharp’s Surfshark VPN connection from functioning properly — thus exposing his Internet address as the source of the downloads. Not the first time I’ve read about a VPN unable to…
Proper opsec is you blackhole all traffic when the vpn isn’t active.
Re: Ubiquiti developer charged with extortion, causing 2020 “breach”
#47lol so much wrong with this:
using surfshark
talking to FBI
being a terrible extortionist
devising such a terrible way to make money
Re: Ubiquiti developer charged with extortion, causing 2020 “breach”
#48Earlier quoted context omitted.
What is the proper way to ensure 100% bulletproof VPN connections without leakage?
use tor. it's specifically designed to avoid traffic leaks (as long as you don't open an external application). I trust that far more than whatever "killswitch" VPN providers have, or properly implementing a home rolled solution with iptables/network namespaces/raspberry pis. the "bouncing your traffic across 3 servers to obfuscate tracking" is a nice bonus as well.
tor is great if you don't mind 99% of websites not working on it
Re: Ubiquiti developer charged with extortion, causing 2020 “breach”
#49> Investigators say they were able to tie the downloads to Sharp and his work-issued laptop because his Internet connection briefly failed on several occasions while he was downloading the Ubiquiti data. Those outages were enough to prevent Sharp’s Surfshark VPN connection from functioning properly — thus exposing his Internet address as the source of the downloads. Not the first time I’ve read about a VPN unable to…
Most come with a killswitch, so if it wonks out you can't access the net.
Are killswitches actually fast enough? Serious question, I don’t know much/anything about networking internals.
I never trust killswitches and when I want to ensure I don’t leak anything, I bind to the VPN interface instead, but I don’t know if that actually gives better security?