Ubiquiti developer charged with extortion, causing 2020 “breach” • Hacker News Board

Re: Ubiquiti developer charged with extortion, causing 2020 “breach”

#131

Post by kortilla » Mon, Dec 06, 2021, 9:48 AM UTC

OJFord wrote: post #122

mynameisvlad wrote: post #99

Earlier quoted context omitted.

But Wireguard itself relies on an active internet connection, which needs to still be set up to not fall back on in case the wg connection deactivates.

A good (the best?) way to solve that is 'the new namespace solution' described at the bottom of the page here: https://www.wireguard.com/netns/ In brief, you move your physical eth/wlan device to a new namespace, and create the wg device in that namespace but then move it to the init ns. By default (and without root) everything will use the init ns and only be able to reach the physical device via wg. If it's not act…

+1 to this being the safest way. No physical nic for your traffic to fallback to. The downside is this isn’t supported by any GUIs that I know of so it’s a pretty miserable workflow for WiFi.

Re: Ubiquiti developer charged with extortion, causing 2020 “breach”

#132

Post by nottorp » Mon, Dec 06, 2021, 9:50 AM UTC

So... do the ubiquity things work again without being tied to their 'cloud'?

Fake vulnerability or not, this is the worst part about their devices these days.

Speaking of which, are there any semi-pro APs that still work without going through the vendor's servers?

Re: Ubiquiti developer charged with extortion, causing 2020 “breach”

#133

Post by 1_player » Mon, Dec 06, 2021, 9:52 AM UTC

rtpg wrote: post #87

kobalsky wrote: post #26

Earlier quoted context omitted.

if a security tool lets the user shoot themselves on the foot it's a problem of the security tool not of the user.

To be clear, at least ExpressVPN has a "prevent traffic going through outside the VPN" mode which would handle this case, and it's on by default. I am not sure how it's implemented, but it's pretty easy to imagine someone deciding to not use it cuz "it's slow/annoying" or whatever.

That option isn't enough, it works only when the VPN connection is up. If your internet connection is flaky and lose connectivity to the VPN itself, your OS will revert to using its default gateway, and your home IP, which is how the guy got caught.

You need your firewall to block any internet access when the VPN is down.

I have something like that set up in a Docker container for my torrenting VPN system, so I never connect with my residential IP.

Re: Ubiquiti developer charged with extortion, causing 2020 “breach”

#134

Post by joelhaasnoot » Mon, Dec 06, 2021, 9:53 AM UTC

nottorp wrote: post #132

So... do the ubiquity things work again without being tied to their 'cloud'? Fake vulnerability or not, this is the worst part about their devices these days. Speaking of which, are there any semi-pro APs that still work without going through the vendor's servers?

Mikrotik

Re: Ubiquiti developer charged with extortion, causing 2020 “breach”

#135

Post by nklmilojevic » Mon, Dec 06, 2021, 9:55 AM UTC

nottorp wrote: post #132

So... do the ubiquity things work again without being tied to their 'cloud'? Fake vulnerability or not, this is the worst part about their devices these days. Speaking of which, are there any semi-pro APs that still work without going through the vendor's servers?

TP-Link EAP are decent for WiFi and for routers - Mikrotik.

Re: Ubiquiti developer charged with extortion, causing 2020 “breach”

#136

Post by deadbunny » Mon, Dec 06, 2021, 9:55 AM UTC

colechristensen wrote: post #12

niros_valtos wrote: post #6

I wonder why the developer had access to so many resources on AWS and GitHub? Can’t these excessive permissions be removed? Why it was undetected for such long time?

He wasn’t just any dev but the cloud lead.

As a "cloud lead" equivalent I make sure I have as a little access as possible and all my (and everyone else's) actions are logged in an (as much as possible) immutable way. And if anyone managed to log into any AWS account with root credentials (MFA token stored in a safe) we get alerts in GuardDuty, Slack, and email within a couple of minutes.

AWS provides all the tools to do this and it does not take that much work to implement. There is zero excuse for a company to allow cowboy shit like this.

Re: Ubiquiti developer charged with extortion, causing 2020 “breach”

#137

Post by scandox » Mon, Dec 06, 2021, 9:57 AM UTC

Given how often we've seen people shooting the messenger in our field, we probably should save our commentary until the outcome of the trial.

A lot of corporate leadership are extremely paranoid and that's why whistle blowing is such a dangerous activity.

How strong do we all feel most digital evidence gathered really is? How much faith do we have in the technical knowledge of the investigators? Or the courts to parse this type of evidence?

Re: Ubiquiti developer charged with extortion, causing 2020 “breach”

#138

Post by vasco » Mon, Dec 06, 2021, 9:57 AM UTC

rmbyrro wrote: post #103

dreyfan wrote: post #46

Earlier quoted context omitted.

Proper opsec is you blackhole all traffic when the vpn isn’t active.

We have to admit the guy is consistent, at the least. He drove employer's security to ruins on purpose, and did the same to himself. I can't believe someone can literally destroy its life for BTC. Imagine his family and close friends. His parents probably thought he was a tech wizard genius. And now he destroyed his reputation, his employer's, and he'll be behind bars for quite a few years. I hope he doesn't have kid…

> And picture: he could have been the guy who did a great job "fixing" employer's lack of security

This is not really a thing. It's very hard to get recognition or even a shared understanding of the risk mitigation. As everything else in the world, it's way easier to reward someone for things that happen (new functionality) than rewarding someone for preventing things happening (hack).

Re: Ubiquiti developer charged with extortion, causing 2020 “breach”

#139

Post by stavros » Mon, Dec 06, 2021, 10:10 AM UTC

duxup wrote: post #14

> Investigators say they were able to tie the downloads to Sharp and his work-issued laptop because his Internet connection briefly failed on several occasions while he was downloading the Ubiquiti data. Those outages were enough to prevent Sharp’s Surfshark VPN connection from functioning properly — thus exposing his Internet address as the source of the downloads. Not the first time I’ve read about a VPN unable to…

Or he didn't screw it up and that's the FBI's standard excuse.

Re: Ubiquiti developer charged with extortion, causing 2020 “breach”

#140

Post by tiagod » Mon, Dec 06, 2021, 10:45 AM UTC

gruez wrote: post #65

mopsi wrote: post #61

Earlier quoted context omitted.

So few people are actually using Tor that correlation-based traffic analysis has very good odds of revealing identities: get the list of employees, pick out those whose connections have accessed Tor at the time of attacks, and you'll have a very short list of suspects.

where do you get tor usage data? The only time I heard of it being used was when someone used tor on some university's wifi network to send a bomb threat. In that case it would be fairly easy to get the data, but if it's just a random guy using his home internet connection, can you get their ISP to cooperate? do they even keep such data around?

Many of the tor relays are operated by intelligence agencies (this is known, and obvious otherwise).

If you connect to one of those, your IP is logged somewhere forever. These same agencies, depending on your country, can probably know who that IP belonged to at the time instantly, or quickly enough.

If the agency has a wiretap on the ISP's fiber, then they'll know even if you're not connected to one of their relays (you could use the unlisted bridges, but they probably know those anyway)