Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ubiquiti developer charged with extortion, causing 2020 “breach”

krebsonsecurity.com

Post reply on HN
Print view View original

121–130 of 239 posts

Re: Ubiquiti developer charged with extortion, causing 2020 “breach”

#121

Post by _pplp »

Sirened wrote: post #112
_pplp wrote: post #80

Earlier quoted context omitted.

Hoo boy, this is gonna be a fun one. For reference, I spent a year (mid-2018 to mid-2019) running the UniFi Network team and worked with Nick during that time. > * Why was it so easy for a lead engineer to get access to a root AWS user without anyone else being notified? I.e. AWS GuardDuty provides FREE alerting for when an AWS root IAM account is logged in or used, this account should be under lock and key and when…

>Also, for some perspective, at that time Ubiquiti kept all the hardware signing keys in a private GitHub repo that every employee had read access to. And they were in plain-text. So... yeah. This is frankly worse than any of this other news. So there's essentially zero trust associated with the code signatures since any employee, past or present, can sign a payload. Wonderful.

I've since heard that the repo has been taken down and all the keys rotated, but just kinda makes you wonder how many APs and switches and cloud keys, etc are still out there using compromised keys.

Also, even though they may have had read access, not many knew it existed. But it wasn't super hard to find (I stumbled across it basically).

Oh and then there the whole metrics collection debacle, where the controller basically phoned home about the topology of every network that it managed. Even if you opted out. Opting out just meant they fuzzed your ID so any given record couldn't be linked back to PII. Which may or may not be legal, IANAL.

But either way it definitely wasn't clear that opting out meant data was still collected. Super sketchy.

Re: Ubiquiti developer charged with extortion, causing 2020 “breach”

#122

Post by OJFord »

mynameisvlad wrote: post #99
therein wrote: post #72

Earlier quoted context omitted.

With wireguard since there is no "connection" to be maintained, you could argue this is a non-issue.

But Wireguard itself relies on an active internet connection, which needs to still be set up to not fall back on in case the wg connection deactivates.

A good (the best?) way to solve that is 'the new namespace solution' described at the bottom of the page here:

https://www.wireguard.com/netns/

In brief, you move your physical eth/wlan device to a new namespace, and create the wg device in that namespace but then move it to the init ns.

By default (and without root) everything will use the init ns and only be able to reach the physical device via wg. If it's not active, nothing will even reach your NIC, nevermind the internet.

Re: Ubiquiti developer charged with extortion, causing 2020 “breach”

#123

Post by OJFord »

mynameisvlad wrote: post #120
midasuni wrote: post #104

Earlier quoted context omitted.

> With wireguard since there is no "connection" to be maintained

What does that even mean? Let's say you have a Wireguard configuration, wg0 which runs off ens0. If your wg0 connection dies, for whatever reason (let's say the remote server goes down), your computer falls back to ens0. What does "not having a connection to be maintained" change about this?

GP's just taking issue with the word 'connection', it's fine, I think it's clear.

Re: Ubiquiti developer charged with extortion, causing 2020 “breach”

#124

Post by sbuk »

LilBytes wrote: post #29

For me a company of their size and, what I would expect, maturity, this new announcement does not satisfy me or provide me much assurance. Consequently I am still happy I have been recommending people against Ubiquiti since the original announcement from Krebs. * Why was it so easy for a lead engineer to get access to a root AWS user without anyone else being notified? I.e. AWS GuardDuty provides FREE alerting for wh…

See https://news.ycombinator.com/item?id=29412262

Obviously we have to take the linked comment at face value.

Re: Ubiquiti developer charged with extortion, causing 2020 “breach”

#126

Post by oaiey »

jolux wrote: post #3
throwoutway wrote: post #2

Hopefully this gets upvoted more but it somewhat repairs my view of Ubiquiti's brand now that more details have come out about what actually happened. I hope the courts will determine the full extent of the truth

Aren't they still serial and uncaring GPL violators?

You can assume that from 99% of all device vendors. It is a shame but it is a reality. That is not something I would put on Ubiquti especially considering all their other serious flaws in product management.

Re: Ubiquiti developer charged with extortion, causing 2020 “breach”

#127

Post by rainonmoon »

rmbyrro wrote: post #107
rainonmoon wrote: post #89

Earlier quoted context omitted.

I think there's a fair chance that whatever someone's mental/emotional state, if a workplace could motivate someone to act as extremely as he did, there are others similarly disenfranchised.

No work culture is excuse to turning oneself into a criminal

Plenty of whistleblowers would disagree.

Re: Ubiquiti developer charged with extortion, causing 2020 “breach”

#129

Post by deadbunny »

dmos62 wrote: post #115
LilBytes wrote: post #29

For me a company of their size and, what I would expect, maturity, this new announcement does not satisfy me or provide me much assurance. Consequently I am still happy I have been recommending people against Ubiquiti since the original announcement from Krebs. * Why was it so easy for a lead engineer to get access to a root AWS user without anyone else being notified? I.e. AWS GuardDuty provides FREE alerting for wh…

Those are good points, but Ubiquiti lost me at centralized, private management of my network devices. Someone might, you know, abuse that; plus, I'm not in control of what's on my device.

You don't have to use their cloud services, everything can be managed 100% locally.

With that said I'm moving away from Ubiquity after years of broken pointless updates, years long outstanding bugs, and after this thread obvious massive lacking security.

Re: Ubiquiti developer charged with extortion, causing 2020 “breach”

#130

Post by deadbunny »

Semaphor wrote: post #49
thejosh wrote: post #22

Earlier quoted context omitted.

Most come with a killswitch, so if it wonks out you can't access the net.

Are killswitches actually fast enough? Serious question, I don’t know much/anything about networking internals. I never trust killswitches and when I want to ensure I don’t leak anything, I bind to the VPN interface instead, but I don’t know if that actually gives better security?

Just setup your routes/firewall so that the only possible way traffic can leave your machine is via the VPN device. VPN dies? no traffic going anywhere. Pretty much networking 101 stuff.
Post reply on HN