Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Final thoughts on Ubiquiti

krebsonsecurity.com

Post reply on HN
Print view View original

211–220 of 238 posts

Re: Final thoughts on Ubiquiti

#211

Post by LilBytes »

thesausageking wrote: post #183
ganoushoreilly wrote: post #178

Earlier quoted context omitted.

I don't think it's fair to attribute their losses directly to Krebs. While this instance is in their favor, Ubiquiti have been doing plenty on their own to alienate their client base. Half backed software updates, pushing products in new verticals without delivering on existing prodcuts. It's clear that there are still issues within Ubiquiti that aren't washed away by this "breach". They're attempting to be enterpris…

It went down by $4B the day after he published his post. A one day drop isn't about their products or how they treat their customers.

The thing is even with Kreb's article, and subsequent reports from both sources at Ubiquiti and their partners from current and past employees in prior conversations on HN (can't recall the ex-employees handle but I spoke to an ex-staff member at Ubiqitui on HN a while back, it's in my comment history, found the comments see [1])

Ubiquiti had a part to play in their compromise, their products have demonstrably gotten worse and it was clear from everything that came out in the wash. Ubiquiti's market value has gone down for a multitude of reasons.

Sure, Krebs has a part to play in being socially engineered to push a criminals MO. But Ubiquti's market cap also went down because:

* Ubiquti are huge, and it's clear they don't have a good engineering culture, or have one at all and that had a part to play in their compromise with or without Krebs being a willing participant in it at all

* For a several billion dollar company, they don't have appropriate risk strategies or security controls in place that are expected of a business of their size

* Their products have gotten significantly worse over the years and as a consequence of the Covid-19 pandemic and supply chain markets, they haven't got product out the door as quickly as prior

The question isn't if they deserved to lose $4B as a consequence of the hack, it's a question of how much of that $4B market loss is because they're not a well ran business as evident by the hack. Vs. how much of that $4B loss was directly because of Krebs? That's a much harder line to define.

[1] https://news.ycombinator.com/item?id=29455730

Re: Final thoughts on Ubiquiti

#212

Post by BonoboIO »

bedhead wrote: post #121
acoard wrote: post #6

An accurate but pretty lacklustre "mea culpa" and retraction. I don't mind people making mistakes, everyone does, but seeing how Krebs has handled this whole episode has not inspired optimism in how he'll handle future mistakes. He was essentially used as an unwitting party in a cyber blackmail scheme, and he doesn't touch on that at all. There will continue to be nefarious parties trying to misuse his reputation, so…

I’m still bitter about this. The story absolutely reeked from the beginning and Krebs did nothing but unnecessarily sensationalize it like a tabloid journalist. I got downvoted a million times over when I pointed this out at the time, why I don’t know, it was obvious to anyone who wasn’t foaming at the mouth to pounce on Ubiquiti. In decades past this was a career-ending error…I wish it still was, I’ll never take a s…

Sometimes HN doesn’t want to see the obvious, because he is their hero

Re: Final thoughts on Ubiquiti

#213

Post by LilBytes »

jonpurdy wrote: post #24

There was a lot of discussion from ex-Ubnt employees in a January 2021 thread※ related to outsourcing and incompetent management. From what I've read, they still show ads for their products in newer Unifi Controller web interfaces and don't have a way of disabling tracking. But now that the Krebs retraction has occurred, my brain doesn't know how bad/incompetent Ubiquiti is these days. Is there an updated-for-2022 so…

Also see [1] from HN user `_pplp` who was an ex-employee of Ubiqitui, and my own comments when this all first came out.

https://news.ycombinator.com/item?id=29455730

Re: Final thoughts on Ubiquiti

#214

Post by windexh8er »

williamscales wrote: post #177
PuppyTailWags wrote: post #152

Earlier quoted context omitted.

Frankly, he is retracting something because is wrong and he is broadcasting that retraction on the largest platform he has access to: his platform. He has sincerely apologized to and made clear who he has harmed: Ubiquiti. So like, what do you want? What more should he say? You say "maybe he sees the facts differently" as if we as anonymous internet crowds are entitled to a post-mortem on his psychological state. Thi…

It’s about reputation. His reputation has been damaged. I think people genuinely appreciate what he’s done and hope that he’ll rehabilitate it. Let’s avoid ad hominem.

While Krebs may have gotten it wrong this time, I think there are some interesting components that we better understand because of the scrutiny on Ubiquiti.

The first is that Ubiquiti's opsec was subpar and contributed to the breach. This was at a time where long time Ubiquiti customers were getting very publicly frustrated that they were forcing products and users to rely on their cloud ops for authentication into local gear. This mainly impacted the products under the UniFi lineup, but it was clear Ubiquiti was testing the waters to see how much pushback they'd get by removing the capability of local auth. The two together likely made the public fiasco even more turbulent internally.

The second is that we learned that Ubiquiti did not do right by customers in their timing or statement of breach disclosure. It was a very weak disclosure and they did everything to skirt around the true situation. Let's not forget that Ubiquiti buried this into a very benign looking statement in the 10-Q files on 02-04-22 [0] (around page 31) when they knew damn well that this was a significant risk to all of their customers.

All in all I think the additional exposure Krebs brought on Ubiquiti at least forced a lot of the truth into the spotlight. Without that I don't think the extent of the breach would be known. Ubiquiti downplayed and chose to not respond to their customers. For that, I still think they handled the situation very poorly.

[0] https://ir.ui.com/financial/sec-filings

Re: Final thoughts on Ubiquiti

#215

Post by modriano »

obblekk wrote: post #32

Before people jump on this with super negativity... mistakes happen. What is Krebs' false positive rate? I think low enough that a simple, clear explanation of why it happened is sufficient. There's no weasel words or evasion here - he owns up to the error, apologizes to affected parties, and retracts all original posts. It's true that his reporting probably caused stress for Ubiquity. I'm curious what people think i…

I had been looking to improve my home network and was about to buy a Unifi Dream Machine Pro-SE and some access points when I read Krebs initial article on Ubiquiti being compromised (coupled with HN commenters really dogpiling on Ubiquiti). Since then, I must have spent 40 hours trying to find a comparable alternative before my discomfort with the opacity of my prior setup drove me to surrender and buy what I had planned out a year ago.

I still think highly of Krebs, but I'm pretty irritated that he wasted so much of my time by reporting something so poorly sourced.

Re: Final thoughts on Ubiquiti

#216

Post by lazide »

lostlogin wrote: post #172
PuppyTailWags wrote: post #152

Earlier quoted context omitted.

Frankly, he is retracting something because is wrong and he is broadcasting that retraction on the largest platform he has access to: his platform. He has sincerely apologized to and made clear who he has harmed: Ubiquiti. So like, what do you want? What more should he say? You say "maybe he sees the facts differently" as if we as anonymous internet crowds are entitled to a post-mortem on his psychological state. Thi…

> So like, what do you want? This hasn’t been a particularly prompt retraction. Why the delay?

Because it's been an active court case?

Re: Final thoughts on Ubiquiti

#217

Post by BeefWellington »

obblekk wrote: post #32

Before people jump on this with super negativity... mistakes happen. What is Krebs' false positive rate? I think low enough that a simple, clear explanation of why it happened is sufficient. There's no weasel words or evasion here - he owns up to the error, apologizes to affected parties, and retracts all original posts. It's true that his reporting probably caused stress for Ubiquity. I'm curious what people think i…

> What is Krebs' false positive rate? I think low enough that a simple, clear explanation of why it happened is sufficient.

Pretty damned high. From doxxing completely incorrect people over Twitter beef to over-trusting sources like this, he's had a number of controversies over the years and has demonstrated his unreliability as a source of information.

> There's no weasel words or evasion here - he owns up to the error, apologizes to affected parties, and retracts all original posts.

Actually he carefully does not own up to the error:

> Last year, I posted a series of articles about a purported “breach” at Ubiquiti. My sole source for that reporting was the person who has since been indicted by federal prosecutors for his alleged wrongdoing – which includes providing false information to the press.

By including "which includes providing false information to the press" he's effectively saying it wasn't his fault. Did other press report on it? Did other press ignore the follow-up for nearly a year after it became apparent the source of this information was the person committing the crimes? It would seem to me that owning up to the error wouldn't look so devoid of any responsibility.

He then writes:

> As a result of the new information that has been provided to me, I no longer have faith in the veracity of my source or the information he provided to me. I always endeavor to ensure that my articles are properly sourced and factual.

> This time, I missed the mark and, as a result, I would like to extend my sincerest apologies to Ubiquiti, and I have decided to remove those articles from my website.

"This time, I [failed to ensure my articles are properly sourced and factual], and as a result, I would like to extend my sincerest apologies to Ubiquiti, and have decided to remove those articles from my website."

The paraphrasing I've done is a more direct way of taking responsibility than Krebs has done. Note in his version the complete lack of ownership, passive voice, and key -- the separation of the problem from where the failure occurred by a paragraph. That's all designed to essentially shirk responsibility here.

Given Krebs' other tendency to get things really wrong, I think it's time people actually viewed him as an unreliable reporter. Especially given he seemingly ignored/dug his heels in about being taken for a ride on this and that then begs the question: How many other instances like this are there that we just haven't heard of or seen?

Re: Final thoughts on Ubiquiti

#218

Post by lazide »

Werewolf255 wrote: post #87
nibbleshifter wrote: post #71

Earlier quoted context omitted.

many of Krebs's sources are criminals, often dropping their competitors info in Brian's lap as a way to get ahead. Brian's a willing and witting participant in this behaviour, even encourages it, because it gives him more stories.

Yeah, this reflects my views too. He's using the veneer or pretext of journalism and reporting the truth in order for him to cover sloppy sourcing.

Have you even met any Journalists?

Re: Final thoughts on Ubiquiti

#219

Post by UberFly »

user3939382 wrote: post #29

Ubiquiti is so worried about suing Krebs meanwhile their brand reputation has turned to mud due to the quality of their products, both from my own experience and the general consensus I've heard online. If this incident had never occurred I still would have stopped recommending and using their equipment.

"their brand reputation has turned to mud"

Meh. You're paying attention only one small side of the story. Most by far are pretty happy with the product for the price.

Re: Final thoughts on Ubiquiti

#220

Post by archon810 »

blitzar wrote: post #141
filmgirlcw wrote: post #91

Earlier quoted context omitted.

As I said in another comment, I feel certain (based on my own direct experience working for a publication that faced numerous lawsuits over what in those cases were factual articles) that this was a condition of a legal settlement. And the thing is, you settle in this case because even though the defamation bar is really high, if your sourcing was wrong (and you maybe didn't do the best job of vetting that sourcing)…

Date Filed: August 25th, 2022 "Defendants Brian Krebs and Krebs on Security, LLC respectfully request that the Court extend the deadline for Defendants to respond to the Complaint by an additional thirty days in light of extraordinary circumstances that have delayed the finalization of the parties’ settlement" https://www.courtlistener.com/docket/63197557/21/ubiquiti-in... They have been finalizing the settlement for…

Great find, thank you.
Post reply on HN