Ubiquiti developer charged with extortion, causing 2020 “breach” • Hacker News Board

Re: Ubiquiti developer charged with extortion, causing 2020 “breach”

#221

Post by megous » Mon, Dec 06, 2021, 7:38 PM UTC

mynameisvlad wrote: post #210

megous wrote: post #151

Earlier quoted context omitted.

Wireguard will keep contacting the remote server. You'd have to delete the wg0 interface or delete the default route for packets to go out via ens0. Wireguard only has "connection" in a sense that it caches some runtime information about the peer's endpoint, but endpoint configuration is static. I guess, too much magic automation on top of this is not the best thing for opsec, including having some daemon that can di…

> You'd have to delete the wg0 interface or delete the default route for packets to go out via ens0 So... You'd have to do work to properly blackhole traffic when wg0 goes down. However long it takes to reconnect, you still will automatically fall back down to ens0 while it's down unless you do something to stop that.

wg0 doesn't go down by itself.

Packets are always delivered to wg interface as long as it is marked as 'UP' (or 'enabled', if 'UP' sounds to you like having anything to do with some kind of "connection") when your routing table directs them there.

When they hit the wg interface when the other endpoint is unreachable for whatever reason, they are either dropped, or queued, or get ICMP unreachable response generated for them, depending on situation. This is done internally by wireguard.

Re: Ubiquiti developer charged with extortion, causing 2020 “breach”

#222

Post by tertius » Mon, Dec 06, 2021, 7:47 PM UTC

mynameisvlad wrote: post #210

megous wrote: post #151

Earlier quoted context omitted.

Wireguard will keep contacting the remote server. You'd have to delete the wg0 interface or delete the default route for packets to go out via ens0. Wireguard only has "connection" in a sense that it caches some runtime information about the peer's endpoint, but endpoint configuration is static. I guess, too much magic automation on top of this is not the best thing for opsec, including having some daemon that can di…

> You'd have to delete the wg0 interface or delete the default route for packets to go out via ens0 So... You'd have to do work to properly blackhole traffic when wg0 goes down. However long it takes to reconnect, you still will automatically fall back down to ens0 while it's down unless you do something to stop that.

You have a route to stop that. You route 0.0.0.0/0 through wg0 and it doesn't matter if no traffic returns, it'll keep trying because that's the route that's been defined for wg0.

If you wanted to not go through wg0 (whether it can reach the other wireguard peer or not) you'd have to remove the routes first.

Re: Ubiquiti developer charged with extortion, causing 2020 “breach”

#223

Post by [deleted] » Mon, Dec 06, 2021, 7:57 PM UTC

ex_ubiquiti wrote: post #200

_pplp wrote: post #80

Earlier quoted context omitted.

Hoo boy, this is gonna be a fun one. For reference, I spent a year (mid-2018 to mid-2019) running the UniFi Network team and worked with Nick during that time. > * Why was it so easy for a lead engineer to get access to a root AWS user without anyone else being notified? I.e. AWS GuardDuty provides FREE alerting for when an AWS root IAM account is logged in or used, this account should be under lock and key and when…

> For reference, I spent a year (mid-2018 to mid-2019) running the UniFi Network team and worked with Nick during that time. Nick's whole strategy was to find a problem, exaggerate it as much as he could get away with, and then offer himself as the hero who would fix it all. He exaggerated or lied about everything he wanted to use for political advantage, right up to the end where he fabricated a hack and used Krebs…

[deleted]

Re: Ubiquiti developer charged with extortion, causing 2020 “breach”

#224

Post by AeroNotix » Mon, Dec 06, 2021, 7:58 PM UTC

_pplp wrote: post #205

ex_ubiquiti wrote: post #201

Earlier quoted context omitted.

> Also, even though they may have had read access, not many knew it existed. But it wasn't super hard to find (I stumbled across it basically). We didn't have read access until Nick Sharp and his team took over GitHub permissions and gave everyone access. Wonderful security work. > Oh and then there the whole metrics collection debacle, where the controller basically phoned home about the topology of every network th…

Oh god don't remind me about Trace. I had to deal with the Controller side of that and it was a damn nightmare. He basically dictated that you couldn't use any kind or repo+deployment pipeline except for what his team was building. Which wasn't actually functional for like 8 months. So we never even got a dev or staging tier to test against for months. And then when I ended up with access to push things along, the ac…

Oh hai people who used to work at UBNT. From reading your responses here (and elsewhere) it definitely seems our paths did not cross, but the shared sense of Schadenfreude is good and strong :)

Re: Ubiquiti developer charged with extortion, causing 2020 “breach”

#225

Post by [deleted] » Mon, Dec 06, 2021, 8:28 PM UTC

LilBytes wrote: post #29

For me a company of their size and, what I would expect, maturity, this new announcement does not satisfy me or provide me much assurance. Consequently I am still happy I have been recommending people against Ubiquiti since the original announcement from Krebs. * Why was it so easy for a lead engineer to get access to a root AWS user without anyone else being notified? I.e. AWS GuardDuty provides FREE alerting for wh…

[deleted]

Re: Ubiquiti developer charged with extortion, causing 2020 “breach”

#226

Post by mobutu » Mon, Dec 06, 2021, 8:29 PM UTC

SEJeff wrote: post #163

travoc wrote: post #156

Earlier quoted context omitted.

Is identifying a real person by their internet pseudonym really doxxing?

Krebbs doxxed one of my friends who happens to be a gay hacker in a country where both being gay and being a hacker are illegal. Krebbs doesn’t take kindly to any sort of bad reviews or even the hint that he’s not perfect FYI.

Serves that faggot right

Re: Ubiquiti developer charged with extortion, causing 2020 “breach”

#227

Post by giobox » Mon, Dec 06, 2021, 9:57 PM UTC

azinman2 wrote: post #100

_pplp wrote: post #80

Earlier quoted context omitted.

Hoo boy, this is gonna be a fun one. For reference, I spent a year (mid-2018 to mid-2019) running the UniFi Network team and worked with Nick during that time. > * Why was it so easy for a lead engineer to get access to a root AWS user without anyone else being notified? I.e. AWS GuardDuty provides FREE alerting for when an AWS root IAM account is logged in or used, this account should be under lock and key and when…

This is all pretty damning. What would you use at home instead?

The usual answer I've found to this question is Microtik, they strike a similar balance between enterprise feature-set and more consumer level price point as Ubiquiti sort of aims for with the Unifi line.

The quality/feature set is there and the software is well designed, even if not quite as networking beginner-friendly as Unifi has become. Mikrotik's RouterOS can do much the same tasks as Unifi's management console, and can configure for auto-adoption of APs/other hardware in the Mikrotik range just like Unifi does for their own hardware.

Most competitors (I see Aruba suggested) are priced much more into the enterprise/business buyer realm. Unifi has generally been keenly priced in this market, their latest Wifi 6 APs are just 99 dollars each (when in stock of course...). Microtik's pricing is generally comparable or cheaper than Unifi in my experience.

https://mikrotik.com/

Re: Ubiquiti developer charged with extortion, causing 2020 “breach”

#228

Post by ianhawes » Mon, Dec 06, 2021, 10:00 PM UTC

kurisufag wrote: post #211

SEJeff wrote: post #186

Earlier quoted context omitted.

That’s pretty shitty of him. I’m not saying anyone is a saint, only that krebs doxxes people who disagree with him, which can put their lives in direct harm. I’m not any more of a fan of wee ve than you. Also, fuck Nazis.

weev is not blind, nor was he recently released from prison

I was not referring to weev.

Re: Ubiquiti developer charged with extortion, causing 2020 “breach”

#229

Post by arglebargle123 » Mon, Dec 06, 2021, 10:09 PM UTC

azinman2 wrote: post #100

_pplp wrote: post #80

Earlier quoted context omitted.

Hoo boy, this is gonna be a fun one. For reference, I spent a year (mid-2018 to mid-2019) running the UniFi Network team and worked with Nick during that time. > * Why was it so easy for a lead engineer to get access to a root AWS user without anyone else being notified? I.e. AWS GuardDuty provides FREE alerting for when an AWS root IAM account is logged in or used, this account should be under lock and key and when…

This is all pretty damning. What would you use at home instead?

Secondhand Ruckus APs are a pretty decent alternative, you'll have a hard time getting AX gear for a reasonable price though.

edit: Secondhand Ruckus/Brocade switches are solid, at least on the 7000 series the evaluation key has no time limit so you're not license-limited in what you can do with them. Switches are mostly <$250 on eBay if you're buying an ICX7150, ICX7250, etc. Yes, that includes PoE models.

Re: Ubiquiti developer charged with extortion, causing 2020 “breach”

#230

Post by azinman2 » Mon, Dec 06, 2021, 10:38 PM UTC

pbronez wrote: post #182

azinman2 wrote: post #100

Earlier quoted context omitted.

This is all pretty damning. What would you use at home instead?

That’s the real question. Aruba has some relevant offerings, but UniFi is still pretty unique in what it offers to prosumers.

Seems like a market opportunity!

Is it just software that's UniFi's weakness? Anything wrong with the hardware itself? I've had quite good luck with UniFi in my home myself but perhaps I'm not using all the features...