Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Final thoughts on Ubiquiti

krebsonsecurity.com

Post reply on HN
Print view View original

131–140 of 238 posts

Re: Final thoughts on Ubiquiti

#131

Post by [deleted] »

acoard wrote: post #61
PuppyTailWags wrote: post #48

Earlier quoted context omitted.

I think it's obvious he's going to do something to avoid this happening again but also I highly doubt anything would be disclosed publicly about this. This isn't exactly a guy with a track record of not learning.

> I think it's obvious he's going to do something to avoid this happening again but also I highly doubt anything would be disclosed publicly about this. This isn't exactly a guy with a track record of not learning. Sure, but part of a "mea culpa" is saying what's important to be said. Otherwise why say anything at all? Maybe he doesn't get it? Maybe he sees the facts differently? Generally I agree with you, and think…

[deleted]

Re: Final thoughts on Ubiquiti

#132

Post by InTheArena »

balentio wrote: post #112
InTheArena wrote: post #108

Earlier quoted context omitted.

Get caught in a lie in front of a jury for a white-collar criminal prosecution with any sort of competent lawyer, and you never regain credibility. Regardless, the other points still stand. It's incredibly hard to defend yourself if your head of security decides to extort you. They are the ones that design the protections to keep insider attacks from working. Luckily for Ubiquiti - the attacker screwed up his network…

>> Get caught in a lie in front of a jury for a white-collar criminal prosecution with any sort of competent lawyer, and you never regain credibility. Which is great for mega corporations who are always innocent of any robber-baroning or impulse to make security a secondary consideration to profit. >>Regardless, the other points still stand. On feeble legs. >>It's incredibly hard to defend yourself if your head of se…

Sounds good. I would not double down on Krebs right now. Or on the tinfoil theory that the FBI and Ubiquiti are lying about this.

Re: Final thoughts on Ubiquiti

#133

Post by ajross »

blantonl wrote: post #12
acoard wrote: post #6

An accurate but pretty lacklustre "mea culpa" and retraction. I don't mind people making mistakes, everyone does, but seeing how Krebs has handled this whole episode has not inspired optimism in how he'll handle future mistakes. He was essentially used as an unwitting party in a cyber blackmail scheme, and he doesn't touch on that at all. There will continue to be nefarious parties trying to misuse his reputation, so…

This is about of straightforward as a "I screwed up, I own it, I apologize" Everyone makes mistakes. Some of the good work Krebs has done seems to be completely overshadowed by a mistake here. Granted, this is probably in response to some legal action either in progress or already settled, but what more do you want from the guy?

The timing doesn't support that take, though. Nikolas Sharp (the sole source for these stories) was arrested almost a year ago. Krebs knew then that his source was tainted, and he did nothing. Instead he waited until he was months into litigation with Ubiquity (which he's almost sure to lose) to try to backpedal.

That's just a straight up violation of journalistic ethics. I think it's very reasonable to demand that our reporters in the security community be clear about their sourcing and prompt about corrections.

A "what more do you want from the guy" implies that we shouldn't hold his past actions to account. And... we should. We absolutely should.

Re: Final thoughts on Ubiquiti

#134

Post by bedhead »

oaiey wrote: post #124
bedhead wrote: post #121

Earlier quoted context omitted.

I’m still bitter about this. The story absolutely reeked from the beginning and Krebs did nothing but unnecessarily sensationalize it like a tabloid journalist. I got downvoted a million times over when I pointed this out at the time, why I don’t know, it was obvious to anyone who wasn’t foaming at the mouth to pounce on Ubiquiti. In decades past this was a career-ending error…I wish it still was, I’ll never take a s…

One upvote returned ;)

Ha, thanks. Seriously, this was not a run-of-the-mill journalistic mistake for which one apologizes for and moves on. This was so brazen I couldn't even believe it at the time, my assumption was that he was short Ubiquiti's stock or something. What Krebs did was so egregious and so extreme that I really have no idea why the world hasn't turned its back on him as a journalist.

Re: Final thoughts on Ubiquiti

#135

Post by hot_gril »

mikestew wrote: post #129
hot_gril wrote: post #117

Earlier quoted context omitted.

> Nobody competes with them as 'Apple for networking' Apple used to ;_; I was still using my Airport Expresses until they gave out. Didn't care if they didn't have the latest wifi standards, they were way easier to manage than Ubiquiti or anything else.

As a hard-core Apple Airport user for a long time, the Apple stuff was great until it wasn't. For example, wanting to put the Xbox in the DMZ. You can do that on the Airports, but it's not called "DMZ" (IIRC) and it's not at all obvious. Whereas Ubiquiti is like the industrial version of an Airport or something, because if you do want to put devices in a DMZ or on a VLAN, you can do it and without a lot of effort. Of…

I've seen the term "default host" on other routers too, so it's fair enough. AirPort settings were pretty full-featured for a consumer device, just lacked advanced routing stuff that I'd not use in a home anyway.

It started falling apart when they made the new AirPort Utility, which hid some settings. I had to go install the old version.

Re: Final thoughts on Ubiquiti

#136

Post by hot_gril »

Reminds me of the Bloomberg SuperMicro article with a single anonymous source alleging that several big companies were compromised, which they deny. Funniest part is how Bloomberg itself also claims it wasn't compromised:

> Bloomberg LP has been a Supermicro customer. According to a Bloomberg LP spokesperson, the company has found no evidence to suggest that it has been affected by the hardware issues raised in the article.

Re: Final thoughts on Ubiquiti

#137

Post by blitzar »

oaiey wrote: post #125
PragmaticPulp wrote: post #47

> As a result of the new information that has been provided to me, I no longer have faith in the veracity of my source or the information he provided to me. I always endeavor to ensure that my articles are properly sourced and factual. This is a strange statement given how the details of the FBI investigation have been public for a very long time. Krebs was fast to report on the initial accusations, but seems to have…

Maybe part of an informal settlement ;)

The lawsuit was close to being settled ... my guess is this is part of the formal settlement.

Re: Final thoughts on Ubiquiti

#138

Post by hot_gril »

NelsonMinar wrote: post #45

It's great that he retracted his story but the way he did it isn't so great. In particular he's removed his older incorrect stories and replaced them with a redirect to the retraction. Thankfully the Wayback Machine has archives https://web.archive.org/web/20220223015405/https://krebsonse... https://web.archive.org/web/20220711220855/https://krebsonse...

Eh, this is what web archives are for. Krebs doesn't want to show wrong info, and he may even be legally obligated not to.

Re: Final thoughts on Ubiquiti

#139

Post by skullone »

acoard wrote: post #6

An accurate but pretty lacklustre "mea culpa" and retraction. I don't mind people making mistakes, everyone does, but seeing how Krebs has handled this whole episode has not inspired optimism in how he'll handle future mistakes. He was essentially used as an unwitting party in a cyber blackmail scheme, and he doesn't touch on that at all. There will continue to be nefarious parties trying to misuse his reputation, so…

I think he had to limit what he said, because he potentially has some liability on what he had reported on in the past. Crazy situation

Re: Final thoughts on Ubiquiti

#140

Post by rovr138 »

acoard wrote: post #61
PuppyTailWags wrote: post #48

Earlier quoted context omitted.

I think it's obvious he's going to do something to avoid this happening again but also I highly doubt anything would be disclosed publicly about this. This isn't exactly a guy with a track record of not learning.

> I think it's obvious he's going to do something to avoid this happening again but also I highly doubt anything would be disclosed publicly about this. This isn't exactly a guy with a track record of not learning. Sure, but part of a "mea culpa" is saying what's important to be said. Otherwise why say anything at all? Maybe he doesn't get it? Maybe he sees the facts differently? Generally I agree with you, and think…

This is a a publishing retraction. This isn’t a postmortem from a technical issue.

He can’t say it won’t happen again. Like stated above, they’ll try to keep abusing him.

He can’t say what his process is or how it will change, because that leaves it open to exploit.

mea culpa is just that, admitting fault. He did. He also took action and described it there.

There is no root cause analysis, corrective actions, and preventive steps.

It can happen again and statistically, if it goes long enough, we can say it will happen again.

Post reply on HN