Whistleblower: Ubiquiti Breach “Catastrophic”

Post by mafro » Wed, Mar 31, 2021, 1:52 AM UTC

ihsw wrote: post #275

ex_ubiquiti wrote: post #223

Earlier quoted context omitted.

The early days at Ubiquiti were good. I worked with a lot of good engineers and we shipped good work. The decline is a recent problem. > How the brand hasn't become toxic already is a mystery to me, yet look at the stock price tracker. It's been trending up for years and it has well over doubled in the past six months alone. This is your answer. No incentive to change. All of the bad engineering decisions have been r…

What do you suggest for someone leaning on an EdgeRouter Lite (with EdgeOS v1.10.11, staying far away from v2.x) and a Unifi UAP-AC-PRO access point? The router will probably reliably carry me until saturating 1Gbps becomes a daily occurrence and the access point will be retired when WiFi 6E comes around (assuming Ubiquiti's WiFi 6E access points aren't required to connect to the cloud.)

Post by kortilla » Wed, Mar 31, 2021, 1:53 AM UTC

vkou wrote: post #438

grayhatter wrote: post #259

Earlier quoted context omitted.

You never can be... but you should already know that being a manager. But if you're the target of an advanced persistent threat. It doesn't matter how good your guys is, they'll win eventually when the next 0day no one knew about shows up. But then your cloud provider will have been broken into dozens of times already. Hundreds of companies have to do a security audit of all of their networks now* because Ubnt got, g…

So what, you are suggesting a strategy of staying away from large services and hoping that you won't be targeted? I posit that it doesn't take burning a zero day, or a coordinated effort by the CIA, the FSB, and Randy Waterhouse to break the typical DIY self-hosted security implementation. (And that the manager paying someone to build it has no ability to tell between a great , a good and a bad DIY job.)

Post by Cpoll » Wed, Mar 31, 2021, 1:56 AM UTC

tjoff wrote: post #246

1vuio0pswjnm7 wrote: post #138

It is interesting to do a search of HN for past references to "Ubiquiti". Whenever the topic of routers came up, many comments followed that recommended them above any alternatives. Commenters seemed proud to tell the world they were using Ubiquiti, as if the "HN concensus" for home routers was to choose Ubiquiti. It seemed to me Ubiquiti would never allow customers the option to install their own OS (e.g., BSD) or b…

"It is even worse: Ubiquiti forced all users to use cloud-based authentification even for accessing your controller software on a local network with a local client. This was not even properly communicated but deployed by one of the regular maintenance updates." Uh? that is demonstrably not true. Any more details?

Post by easton » Wed, Mar 31, 2021, 2:06 AM UTC

wnevets wrote: post #102

Is it just me or are you no longer able to avoid the cloud with the latest software updates for unifi?

Post by asix66 » Wed, Mar 31, 2021, 2:14 AM UTC

red_phone wrote: post #430

judge2020 wrote: post #414

Earlier quoted context omitted.

> having a trustworthy and secured backend. Ubiquiti had a secured backend - their screw-up was not doing MFA on their admin accounts. I would still like if there was an option for a local-only control panel.

For their UniFi line, at least, you don't have to use their cloud controller. You can self-host.