Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Former Ubiquiti employee charged with stealing data and extorting company

justice.gov

Post reply on HN
Print view View original

41–50 of 244 posts

Re: Former Ubiquiti employee charged with stealing data and extorting company

#41

Post by myrandomcomment »

baskethead wrote: post #27
ex_ubiquiti wrote: post #23

Ex-Ubiquiti employee here. Nick Sharp wasn't just a senior software engineer. He was the Cloud Lead and ran the whole cloud team. His LinkedIn profile will confirm it. This is why he had access to everything. Nick had his hands in everything from GitHub to Slack and we could never understand why or how. He rose to power in the company by claiming to find a vulnerability that let him access the CEO's personal system,…

Is this why Ubiquiti quality has fallen over the last ~2 years? I went all-in on Ubiquiti almost 3 years ago and I’ve been less than thrilled with the quality and level of support. This chaos that you say happened seems to line up with what I was seeing as a customer but everyone has been shocked at how UI has dropped in terms of quality.

I used to recommend them. Not anymore. My complete home setup is all their kit (the GUI means that if I kick it, the family can likely sort - it is import). I opened a case that a replacement switch (new model, old is EOL) did not work with one of their POE devices. I know this stuff backwards and forwards. I did my testing and basically sent the case to support with all the details (I know this stuff at the ASIC level). Wasted my time for a week. Finally I just said screw it and RMA the switch (nothing wrong with it) because support would not move. I received the replacement and surprise, same issue. Only after that I got the "sorry, we will reach out to L2 support." Wasted my time on a good debug that clearly ID the issue and I had to pay for shipping on RMA. I am stuck with them for now, but as soon as I can find a better offering I am going switch.

(My issue is that I understand that most users are clueless, heck I started in support for Win3.1 for an ISP, but the stuff in the debug clearly was a statement that I understood what I was say, and even as a Jr. engineer 30 years ago, I would have read it and said "hum, this dude knows his stuff, maybe I should ask at the next level").

Re: Former Ubiquiti employee charged with stealing data and extorting company

#42

Post by Vaslo »

seibelj wrote: post #11
jimsparkman wrote: post #2

Wow, quite brazen. What an interesting read. Couple things that stood out to me was that the incident occurs in December and the raid ensues March 24th, so roughly 3 months. Building the case I presume. Then after the raid, the accused doubles down and seeds fake news stories.

I'm a big fan of a show called "Forensic Files", which is like a real-life CSI where each episode is a documentary and only takes 20 minutes (I highly recommend). In addition to the the usual passion killings and random murders, there is the occasional criminal that thinks they are way smarter than everyone else and doubles or triples down even as the noose is tightening, because they 100% believe they are geniuses a…

George Trepal was certainly one of the better episodes! Amazing that one detective had to go undercover for almost two years before he slipped up. Then they found traces of the rare poison in his home. You’d think he would have trashed it and cleaned like crazy but I bet he thought he would get away with it and may want to do it again.

Great show

Re: Former Ubiquiti employee charged with stealing data and extorting company

#43

Post by adrr »

jeroenhd wrote: post #34

He could've prevent all of this by a) making sure his traffic was blackholed when the VPN went down and b) adding another layer from a free service (like TOR or a proxy or another VPN). He also should've been actively using the VPN so his traffic patterns wouldn't stand out as much, and so his purchase would be justifiable. If he really did buy the VPN 6 months ahead then he was a fool to leave the subscription dorma…

Why a stolen credit card? Just buy gift visa card with cash.

Re: Former Ubiquiti employee charged with stealing data and extorting company

#44

Post by paxys »

dotBen wrote: post #31
mjamil wrote: post #13

Mr. Sharp is apparently not so sharp. He carried out the attack from his home network. He connected directly for enough time that his bare IP was logged. The rest of the time, he carried out the attack using a commercially purchased VPN solution that was trivial to trace back to him via the purchase record. He lied to the FBI. (I have yet to understand why people talk to law enforcement instead of staying silent so a…

(I have yet to understand why people talk to law enforcement instead of staying silent so as to not implicate themselves.) When the FBI knock at the door you totally do the whole "no comment/talk to my lawyer" thing. But what happens next if you're actually part of an investigation is they hand you a grand jury subpoena (which they were going to do anyway, even if you just talked willingly, because they have already…

The difference is that every step after the initial "no comment" can/should be done with explicit guidance from an attorney, and no attorney in the country will have their client blatantly lie in front of the FBI or a grand jury despite there being solid evidence proving otherwise.

Re: Former Ubiquiti employee charged with stealing data and extorting company

#45

Post by doctor_eval »

klabb3 wrote: post #38
LiquidPolymer wrote: post #19

I've always been fascinated by the idea that intelligence lies within a spectrum. Someone might be incredibly smart about a narrow topic or field, yet be blind to their own stupidity within another realm. To me, this seems like a classic example. To quote the press release: "During the execution of that search, SHARP made numerous false statements to FBI agents, including, among other things, in substance, that he wa…

> I've always been fascinated by the idea that intelligence lies within a spectrum. Someone might be incredibly smart about a narrow topic or field, yet be blind to their own stupidity within another realm. I've been seriously bitten by this, and find it more scary than fascinating. Growing up, I thought people who followed cult leaders and charismatic narcissists were so stupid (still do), it appeared so transparent…

> I found myself to be equally gullible when intelligent people were abusive or outright dumb in other areas. This has been a challenge to unlearn, like learning an old dog to sit. Basically, our proxies for predicting people's character range from bad to terrible.

oh I am 100% with you on this. I tried to elaborate but I just sound bitter and twisted, and that's probably true. But I've spent the last few years unlearning things I thought I knew. It has been a painful and expensive set of lessons.

long story short: I think we judge people's reaction to a situation by projecting how we would act... but that's not how people actually act.

Re: Former Ubiquiti employee charged with stealing data and extorting company

#46

Post by InTheArena »

I do that that the media that breathlessly amplified this persons attack should learn from it. In particular, As much as I like and appreciate his reporting, Brian Krebs was the key person amplifying this message - which makes him a unwitting accomplice to many billions of dollars of damage to ubiquiti shareholders.

Responsible disclosure exists for a reason.

Re: Former Ubiquiti employee charged with stealing data and extorting company

#47

Post by TedDoesntTalk »

> SHARP used a virtual private network service that he subscribed to from a company named Surfshark to mask his Internet Protocol (“IP”) address when he accessed Company-1’s AWS and GitHub infrastructure without authorization.

How did they know it was SurfShark?

Re: Former Ubiquiti employee charged with stealing data and extorting company

#48

Post by OverlordXenu »

adrr wrote: post #43
jeroenhd wrote: post #34

He could've prevent all of this by a) making sure his traffic was blackholed when the VPN went down and b) adding another layer from a free service (like TOR or a proxy or another VPN). He also should've been actively using the VPN so his traffic patterns wouldn't stand out as much, and so his purchase would be justifiable. If he really did buy the VPN 6 months ahead then he was a fool to leave the subscription dorma…

Why a stolen credit card? Just buy gift visa card with cash.

they take your ID. you could get someone else to buy it for you, but they'll be easy to flip when looking at time.

Re: Former Ubiquiti employee charged with stealing data and extorting company

#49

Post by scrollbar »

zamadatix wrote: post #37
oars wrote: post #16

Ubiquiti's stock price (NYSE: UI) dropped by over 25% from $380 to $290 during the week following news of its breach. That's almost $5 billion wiped off the company's market capitalisation because of this employee.

Probably could have been a lot less and/or recovered by now had Ubiquiti not also gone through great lengths to cover it up and actively avoid taking appropriate mitigation action. https://krebsonsecurity.com/2021/03/whistleblower-ubiquiti-b... I mean Nick Sharp certainly took a chunk out of them but there is more to the story for why the market lost that much faith.

But the Krebs article was based off statements by an anonymous whistleblower “Adam” - Nick Sharp himself, to further extort the company. Hard to know what is actually true in that article at this point

Re: Former Ubiquiti employee charged with stealing data and extorting company

#50

Post by TedDoesntTalk »

colechristensen wrote: post #29
LiquidPolymer wrote: post #19

I've always been fascinated by the idea that intelligence lies within a spectrum. Someone might be incredibly smart about a narrow topic or field, yet be blind to their own stupidity within another realm. To me, this seems like a classic example. To quote the press release: "During the execution of that search, SHARP made numerous false statements to FBI agents, including, among other things, in substance, that he wa…

It's not really about intelligence. When faced correcting a false reality you have created, it can be quite hard to decide to phase change into telling the truth. The lies that come out come from not being prepared and not being a very good liar. For people who lie like this, a good way to think about it is as though it were a disease. Actually intelligent people just don't do things like this, even if they have nefa…

> Actually intelligent people just don't do things like this

Are you really claiming that intelligent people don’t commit crime or don’t lie? That seems incredibly naive.

Post reply on HN