Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Whistleblower: Ubiquiti Breach “Catastrophic”

krebsonsecurity.com

Post reply on HN
Print view View original

631–640 of 815 posts

Re: Whistleblower: Ubiquiti Breach “Catastrophic”

#631

Post by vxNsr »

beervirus wrote: post #562
H8crilA wrote: post #424

By the way, reporting to krebsonsecurity is a giant waste of potential income. This is what the SEC whistleblower program is for. You get paid for submissions there that lead to successful enforcement actions, and the payouts can be very substantial. Furthermore because payouts exist, there's an industry of competent lawyers that will happily take cases with compensation coming exclusively from your payout. Also, how…

> how is this a securities case? Everything is securities fraud.[0] [0] https://www.bloomberg.com/opinion/articles/2019-06-26/everyt...

OP was asking a rhetorical question.

Re: Whistleblower: Ubiquiti Breach “Catastrophic”

#632

Post by rexarex »

IgorPartola wrote: post #43
yabones wrote: post #7

> “The breach was massive, customer data was at risk, access to customers’ devices deployed in corporations and homes around the world was at risk.” > “They were able to get cryptographic secrets for single sign-on cookies and remote access, full source code control contents, and signing keys exfiltration,” Maybe putting your network control plane in 'the cloud' isn't such a good idea after all... Edit: Just re-read…

Was shopping for alternatives to my Ubiquiti last night. Seems like there is nothing good out there. Engenius has shit hardware and a cloud controller. Aruba has a cloud controller AND you have to pay for a license. Cisco makes you pay for a license. TP-Link is cloud-based. WTF. Does anyone have a decent WAP where I can use PoE, deploy like 5 of them and have them support roaming between APs, all managed locally? Is…

At least a few years ago you could self host Aruba.

Re: Whistleblower: Ubiquiti Breach “Catastrophic”

#633

Post by xtat »

biktor_gj wrote: post #231
yabones wrote: post #7

> “The breach was massive, customer data was at risk, access to customers’ devices deployed in corporations and homes around the world was at risk.” > “They were able to get cryptographic secrets for single sign-on cookies and remote access, full source code control contents, and signing keys exfiltration,” Maybe putting your network control plane in 'the cloud' isn't such a good idea after all... Edit: Just re-read…

After the Unifi Video fiasco, I bought a UDM Pro to test Unifi Protect. Once I saw it required cloud login I got scared. After I saw an ubiquiti ssh key preinstalled in a device with unfeteted internet access I shut it down to never bring it up again

All of this makes me skeptical about ubnt but a few corrections

1) You dont need to turn on cloud acccess 2) My UDM pro doesn't have ssh open to the world so not sure how that would be useful externally

Re: Whistleblower: Ubiquiti Breach “Catastrophic”

#634

Post by xtat »

yabones wrote: post #7

> “The breach was massive, customer data was at risk, access to customers’ devices deployed in corporations and homes around the world was at risk.” > “They were able to get cryptographic secrets for single sign-on cookies and remote access, full source code control contents, and signing keys exfiltration,” Maybe putting your network control plane in 'the cloud' isn't such a good idea after all... Edit: Just re-read…

Full ACK but also you can run a local only setup

Re: Whistleblower: Ubiquiti Breach “Catastrophic”

#635

Post by sellyme »

kortilla wrote: post #559
sofixa wrote: post #352

Earlier quoted context omitted.

> BigRespectableCompanies Ubiquiti really aren't in the same ballpark as AWS or Microsoft, which are the companies people use that argument for, and you can bet your ass their security is better than in most places.

This is a fallacy. Just because these companies have great security teams doesn’t mean that things don’t fall through the cracks. Shit slips past the security team in product meetings all the time.

The claim wasn't that they never have security flaws, the claim was that they almost certainly have fewer security flaws than the alternative self-hosted solution someone named MastodonFan87 comes up with.

Re: Whistleblower: Ubiquiti Breach “Catastrophic”

#636

Post by sjfidsfkds »

IgorPartola wrote: post #139
dolni wrote: post #110

Earlier quoted context omitted.

So the question for becomes: is there just not a good enthusiast market for this stuff? I have met a number of people who are "network nerds", so I'm inclined to think the market does exist. With any of the plethora of consumer devices (Linksys, Netgear, D-Link) it's a dice roll whether your gear is complete garbage or not. A lot of the time, you're coming up snake eyes. I've got some Ubiquiti gear I bought a couple…

I can't imagine that there isn't a market for this. Look at the number of people recommending Ubiquiti stuff to each other. There are entire YouTube channels dedicated to it. If your whole living space or small office can be covered with a single access point, get a 3-in-1 combo that has a WAP, a router, and a small switch. But if you don't, you are left with, what exactly? There is also some demand for mesh stuff, f…

You can connect the Google mesh routers together with Ethernet. I’d guess other competing products will do the same. It’s cheaper and much simpler than a full Ubiquiti setup for a few access points.

Re: Whistleblower: Ubiquiti Breach “Catastrophic”

#637

Post by cheph »

tgsovlerkhgsel wrote: post #380
cheph wrote: post #29

Earlier quoted context omitted.

> Legal isn't there to make sure the company complies with the laws. Legal is there to advise on and minimize legal risk. Breaking laws is one sure way to increase legal liability.

Yes, but if you've broken one law already, breaking another one by sweeping it under the carpet may sound very attractive.

Maybe, not sure any laws were broken here though, would be interesting to know if there are laws covering it.

Re: Whistleblower: Ubiquiti Breach “Catastrophic”

#638

Post by scheme271 »

Scramblejams wrote: post #583
Melkman wrote: post #432

Earlier quoted context omitted.

I also have a TP-Link Omada setup. For layer2 networking with switches and AP's it's fine. Cost effective, reasonably stable, acceptable performance and features that are regularly used are all there. The layer-3 stuff however is still early days and I can't recommend getting the secure gateway at this time. No IPv6 support. Depends strictly on an internet uplink configuration for default route to which all traffic i…

Do you know if you can opt out of the cloud connection on the OC-200?

If you login to the OC200, it's under settings > cloud access. It should be off by default. Or you can login to the cloud interface and forget the OC200 under actions.

Re: Whistleblower: Ubiquiti Breach “Catastrophic”

#639

Post by locusm »

benjohnson wrote: post #132
bpye wrote: post #76

Earlier quoted context omitted.

These recent posts about Ubiquiti have made me look again at MikroTik. Their hardware is more affordable than I had remembered. Is there any good intro to their hardware - there are certainly a lot more options than you get with Ubiquiti. Even before now there are some limitations with UniFi that have annoyed me. Setting up more complex DNS and firewall rules requires editing the JSON config. IPv6 tunnelling isn’t we…

It may sound strange, but for Mikrotik, I find it more productive to concentrate on setting them up via CLI. It's certainly more trainable. CLI for Port Forward: /ip firewall nat add chain=dstnat dst-port=1234 in-interface=ether1-gateway action=dst-nat protocol=tcp to-address=192.168.1.1 to-port=1234 VS having to document the same task in the GUI: IP->Firewall->Nat-> Add New General Tab Chain: dstnat Protocol: TPC Ds…

Same reason I like EdgeRouters and VyOS

Re: Whistleblower: Ubiquiti Breach “Catastrophic”

#640

Post by locusm »

dolni wrote: post #110
IgorPartola wrote: post #43

Earlier quoted context omitted.

Was shopping for alternatives to my Ubiquiti last night. Seems like there is nothing good out there. Engenius has shit hardware and a cloud controller. Aruba has a cloud controller AND you have to pay for a license. Cisco makes you pay for a license. TP-Link is cloud-based. WTF. Does anyone have a decent WAP where I can use PoE, deploy like 5 of them and have them support roaming between APs, all managed locally? Is…

So the question for becomes: is there just not a good enthusiast market for this stuff? I have met a number of people who are "network nerds", so I'm inclined to think the market does exist. With any of the plethora of consumer devices (Linksys, Netgear, D-Link) it's a dice roll whether your gear is complete garbage or not. A lot of the time, you're coming up snake eyes. I've got some Ubiquiti gear I bought a couple…

Ive seen someone have a fair bit of success with Grandstream AP's. The controller runs on an AP itself or on their router if memory serves me right. I believe they are also moving into the switch market later this year.
Post reply on HN