40 ms·

Whistleblower: Ubiquiti Breach “Catastrophic”

• robbiet480 6y ago
  > According to Adam, the hackers obtained full read/write access to Ubiquiti databases at Amazon Web Services Not good!
• amzans 6y ago
  The scope of this breach is frightening. Would be great to better understand how the Lastpass credentials got leaked in the first place. Anyone found any comment on that?
• blhack 6y ago
  Well this absolutely sucks :(. I've been a huge supporter of Ubiquiti ever since I was buying mini their PCI cards and sticking them into soekris engineering boards (ubiquiti started out as a hardware company). The magic thing that absolutely sold me on their equipment was the ease with with you could provision and mesh new gear. Does anybody have anything that compares with that ease of use? To explain what I mean: I recently had a buddy move into our guest house/apartment. While we waited for the ISP to come out and hook up his internet, I just put an AP on his counter, powered it up, and meshed it into our home network. The whole process took less than a minute and didn't require any running of ethernet. (Maybe that's a common feature nowadays and I've just been out of the industry for so long?)
  • smashah 6y ago
    I can vouch for Google WiFi. Very simple to set up.
    • bogwog 6y ago
      If you give away your data, it can't be stolen. That's fool-proof security!
      • smashah 6y ago
        Ha I get it. The way I look at it is, I have chosen my security sin and that's Google. I turn off ad settings, pay for GSuite, YT premium and Google one, have ad block/ad guard everywhere and buy their nest home products. Smaller threat area, much larger utility plus they by default have more resources than any other company to have better security. Don't get me wrong, I was looking forward to moving to ubiquity but that's not happening anymore unfortunately. As far as I'm aware Google has not had this magnitude of hack recently.
• mjfl 6y ago
  Is internet of things useful for anything except being a major security vulnerability you could trick an enemy into installing?
• EvanAnderson 6y ago
  I wonder how difficult it would be to implement a rudimentary controller for their APs. The WLAN configurations are just text files in the /etc directory. Getting feature parity would be a lot of work, but I bet the bar isn't too high for simple functionality. Most of the "magic" is happening in hostapd on the APs anyway.
  • nemesisdesign 6y ago
    I think you are wrong. I have been working on https://openwisp.org https://openwisp.org for some time and implementing a controller which is robust and can handle many different corner cases and offer good functionality and also ease of use is a challenge and requires several people working full time on it. Even simple functionality it's a lot of work, unless for simple you mean really trivial. If it wasn't hard, there would be many alternatives but as far as I know there aren't many.
    • EvanAnderson 6y ago
      I was definitely shooting my mouth off to some extent. I'd defer to your experience for sure. I took a look at your project pages briefly and I'm going to spend more time looking them later. It definitely looks neat, and much more "feature-ful" than I'd be looking for. I'm particularly interested in looking at your modular configuration system. My needs definitely don't exercise corner cases. Most of the UniFi gear I've got out there is just running a single SSID w/ WPA-RADIUS and a RADIUS-assigned VLAN. Here or there I've got an SSID w/ a PSK and a hard-set VLAN. Nothing too fancy. Adopting new APs quickly and easily based on a "magic" DNS name, alerting when an AP disappears, and syslog to show association/roaming/disassociation events is about all I want. I'm putting Customer-owned gear in small offices w/ under 10 APs, rather than being a service provider.
      • nemesisdesign 6y ago
        Interesting information, thanks for sharing. Definitely doable by adding also the monitoring module, which would show you associated clients in a chart. But it's not as easy to set up as Ubiquiti though. I hope in the future it will be.
• jeffhodge 6y ago
  Kinda strange that they'd ask for a ransom in Bitcoin and not something fully anonymous..
• jniedrauer 6y ago
  > the attacker(s) had access to privileged credentials that were previously stored in the LastPass account of a Ubiquiti IT employee The interesting part of this story is how the employee's LastPass got popped. My guess is their local workstation was compromised, and their LastPass was either not logged out in a browser plugin, or they didn't have 2 factor auth required for each login and a keylogger got the password. In either case, it's a good reminder to be paranoid about your password manager, make sure it's got a logout timer, and use 2 factor auth. I also don't let my cloud password managers touch a mobile device. It's fairly inconvenient, so I hesitate to recommend this to others. But I don't trust mobile devices very much. Anyone have thoughts on this?
  • baybal2 6y ago
    Easy to imagine they just got a spiked chrome binary installed
    • cutemonster 6y ago
      How could an attacker make that happen?
      • baybal2 6y ago
        Hack the admin machine
  • cutemonster 6y ago
    > My guess is their local workstation was compromised You mean someone was physically at the laptop/desktop and could access the OS and apps? Maybe if the employee was working remote (covid?) from, say, a cafe and left the laptop unattended when refilling coffee? Or something else? ... Hmm, could also have been eg a browser zero day that gave someone remote access to the computer? Or a dev tools supply chain attack?
    • hn_throwaway_99 6y ago
      It's not that complicated. The local workstation could have had a trojan or virus that installed a keylogger or screengrabber.
• heavyset_go 6y ago
  At least for home networking, I'll always pick something I can throw OpenWRT on over a managed service, subscription or closed-source option. In the 15 years I've been using OpenWRT, I have never been disappointed with it, and I don't have to worry about some company's "secure" backdoor into my network being exploited.
  • vorpalhex 6y ago
    What prosumer level OpenWRT devices do you recommend? I don't want to flash a subpar consumer router.
    • rubatuga 6y ago
      I’m using an WRT1200ac to great success. Just make sure to set your 5GHz network to a non-DFS channel.
  • christophilus 6y ago
    I’d like to know what you recommend. I’m running asus routers at home, but would like an option that’s easier to upgrade.
    • heavyset_go 6y ago
      Mikrotik hardware if you're looking for hardware you can upgrade. I haven't found the need to upgrade my hardware in a couple of years so I don't know what the market currently looks like. I'd just look on the OpenWRT wiki or forum and see what is best supported and buy that. Also, Atheros radios are generally supported really well on Linux, so I stick with hardware that has an Atheros chipset over something with a Broadcom radio.
• vorpalhex 6y ago
  Well, guess I won't be about to drop a few thousand on Ubiquiti gear anymore until we get some more details. Hopefully this account isn't fully truthful, otherwise Ubiquiti has really screwed up.
  • rswskg 6y ago
    meh, not really a good substitute. They've got the prosumer market locked down. Probably why they got into this mess. Lots of successful product people deferring 'non product' stuff.
  • knz 6y ago
    > Hopefully this account isn't fully truthful Brian Krebs is a reputable source who has a lot to lose if he makes unsubstantiated claims.
    • vorpalhex 6y ago
      He's quoting a source. I don't doubt Krebs in the slightest but he's simply forwarding someone elses account.
  • deleted 6y ago
    [deleted]
  • kitsunesoba 6y ago
    A few months ago I was considering outfitting my apartment with Ubiquiti gear but ultimately decided to stick to an aging AirPort Extreme and a couple of cheap ethernet switches after seeing reports of bugs with various Ubiquiti pieces. Seems that was a good judgement…
• logicslave 6y ago
  But the routers have a nice user interface!
  • temp0826 6y ago
    My favorite part of the web interface is when it silently reverts changes made at the command line.
    • nikisweeting 6y ago
      The APs and switches are stateless by design (which I sort of like), but if you make CLI changes on the controller using the config file they are not reverted in my experience. Though it's not super well supported either because they prefer people using the web UI to the config file.
    • 650REDHAIR 6y ago
      That's a feature not a bug
    • dismalpedigree 6y ago
      You enjoy that also? I thought I was the only one...
• speeder 6y ago
  I wonder why their legal department would PREVENT them from saving their users. What legal reason would exist for that? I thought legal would instead force them to save their users, since otherwise they would risk getting sued by all of them by all the damages caused or something.
  • tgsovlerkhgsel 6y ago
    Successfully sweeping it under the carpet means you don't get sued for the mistakes you made. Legal isn't there to make sure the company complies with the laws. Legal is there to advise on and minimize legal risk.
    • cheph 6y ago
      > Legal isn't there to make sure the company complies with the laws. Legal is there to advise on and minimize legal risk. Breaking laws is one sure way to increase legal liability.
      • hedora 6y ago
        Only if you get caught.
        • mywittyname 6y ago
          And be successfully prosecuted. I'm sure someone in legal knows someone at the AG's office who might be "considering the private sector" in the near future.
      • rStar 6y ago
        but if you get away with it 90% of the time....
      • tgsovlerkhgsel 6y ago
        Yes, but if you've broken one law already, breaking another one by sweeping it under the carpet may sound very attractive.
• yabones 6y ago
  > “The breach was massive, customer data was at risk, access to customers’ devices deployed in corporations and homes around the world was at risk.” > “They were able to get cryptographic secrets for single sign-on cookies and remote access, full source code control contents, and signing keys exfiltration,” Maybe putting your network control plane in 'the cloud' isn't such a good idea after all... Edit: Just re-read the article, this part stood out: > the attacker(s) had access to privileged credentials that were previously stored in the LastPass account of a Ubiquiti IT employee, and gained root administrator access to all Ubiquiti AWS accounts, including all S3 data buckets, all application logs, all databases, all user database credentials, and secrets required to forge single sign-on (SSO) cookies. > Adam says Ubiquiti’s security team picked up signals in late December 2020 that someone with administrative access had set up several Linux virtual machines that weren’t accounted for. If this is true, and whoever breached them had full access to their AWS account, can we really trust them to clean up all their tokens and fully eradicate all forms of persistence the hackers may have gotten?
  • ryandrake 6y ago
    > Maybe putting your network control plane in 'the cloud' isn't such a good idea after all... Isn't one of the major selling points of cloud-everything "How can you possibly secure your service better than BigRespectableCompany?" I know any time I bring up self-hosting E-mail or a web site or whatever, someone always comes out of the woodwork to remind me that I am not an expert in securing Internet services, and that BigRespectableCompanies have full-time employees dedicated to security. Surely I should be moving to the cloud for this expertise! This is sounding more and more like FUD to me.
    • vkou 6y ago
      You may be smart, and have secured your systems properly, but someone with the same resume as you in another company might not be. As your manager, how can I tell the difference between someone who actually did the work right, and someone who said they did the work right (and also legitimately believes that they did)?
• surfsvammel 6y ago
  This company is a disaster it seems, and I have just setup my whole home infrastructure and home security aound their products... They where the most recommended brand when I was shopping for new stuff a year ago.
  • alkonaut 6y ago
    I picked up an EdgeRouter and none of the cloudkey/unifi stuff. I initially felt like maybe I should have picked the unifi gear and maybe a dumb switch, but now I don’t regret the EdgeRouter. Couldn’t be happier with it. I don’t trust anything that tries to solve the “firewall problem” by setting up a cloud service for what should be a local appliance.
    • kiseleon 6y ago
      I bought the EdgeRouter X a year or two ago because I was tired of having to reboot my router constantly. Still use it, still love it.
  • moonbas3 6y ago
    Yeah well, more money in marketing than anything else.
  • thedanbob 6y ago
    Same, my setup is 100% Unifi from back before they started going downhill. At least I was self-hosting the software so I wasn't bitten by this breach.
    • izacus 6y ago
      Hmm, even the self-hosted SW can use SSO from cloud... so I'm now worried that our equipment is still vulnerable by whatever system allows cloud logins.
    • pseudalopex 6y ago
      They forced cloud authentication on self hosted software too.[1] [1] https://www.reddit.com/r/Ubiquiti/comments/kslyh9/cloud_key_local_account/ https://www.reddit.com/r/Ubiquiti/comments/kslyh9/cloud_key_...
• vmception 6y ago
  > Adam wrote in his letter. “Legal overrode the repeated requests to force rotation of all customer credentials, and to revert any device access permission changes within the relevant period.” tsk.
  • 650REDHAIR 6y ago
    By trying to sweep it under the rug they just opened themselves up. Crazy.
  • beervirus 6y ago
    Yeah that doesn’t make sense to me. Sales would do something like that. Legal should be erring in the opposite direction.
    • jasonwatkinspdx 6y ago
      No. They don't care if customers get pwnd. They care if customers become aware of exactly how they got pwnd and launch a class action. It's shitty but entirely predictable behavior common in these situations.
      • airstrike 6y ago
        But rotating credentials would not hurt or help that alleged goal of hiding the truth from customers...
        • chrisbolt 6y ago
          “force rotation of all customer credentials” = make customers change their passwords, which is a huge red flag that would draw attention to why they were forcing that.
          • hn_throwaway_99 6y ago
            Github just recently logged out all users because they had a bug that could leak other account data into sessions. They were very transparent about why they did that, what happened, and I for one trust them more for it.
• gautamcgoel 6y ago
  Wow, this is huge. I wonder if the attacker was a state actor, and if so, what their intended mischief is.
  • eqvinox 6y ago
    I don't think a state actor would've tried to extort bitcoin, but who knows…
• noinsight 6y ago
  > ”Ubiquiti had negligent logging (no access logging on databases) so it was unable to prove or disprove what they accessed” Perversely, this is exactly the logging that you want to have in place in case of a breach. You can then (factually) make the statement that ”we have no evidence any customer data was accessed.”
  • baaym 6y ago
    Ironically they can factually make that statement now as well.
  • jasonhansel 6y ago
    "We believe that the hackers obtained read-write access to our database, but we also believe that they were too polite to actually use it for anything."
    • samstave 6y ago
      "Hacker came in through the server hard-line" <-- HollyWoods favorite Hacker Trope.
  • toyg 6y ago
    Aka plausibile deniability
    • chillfox 6y ago
      I have never ever seen "plausible deniability" keep someone out of trouble. I have seen attempts at applying it several times, but never successfully. As an excuse for why to not do the right thing I really hate "plausible deniability".
      • g_p 6y ago
        Under GDPR, a failure to know about (detect) a breach (and then report it yourself) is in itself a violation. Likewise, failing to have suitable organisational and technical measures in place to protect the data is a breach. I'd certainly argue your inability to account for processing operations after having been breached through lacking knowledge of what was done due to a lack of logs was therefore a breach.
• meepmorp 6y ago
  > Adam says the attacker(s) had access to privileged credentials that were previously stored in the LastPass account of a Ubiquiti IT employee, and gained root administrator access to all Ubiquiti AWS accounts, including all S3 data buckets, all application logs, all databases, all user database credentials, and secrets required to forge single sign-on (SSO) cookies. A root user user breach, seemingly on the organization main account. Ouch. I wonder if MFA was set up, with the TOTP creds also kept in LastPass.
  • liaukovv 6y ago
    What is the right way store credentials to something like this? Hardware keys?
    • meepmorp 6y ago
      I use a Yubikey, personally.
    • NovemberWhiskey 6y ago
      For AWS root account? Generate a long random password, print it out and then lock it in a safe without allowing anyone to see it. Turn on 2FA and then lock the second factor in a different safe. There’s virtually never a need for the root account and it’s impossible to attenuate (by design).
      • dmlittle 6y ago
        This is a lot harder to do if you have lots of AWS accounts and create new ones over time on-demand (e.g. AWS account per team).
        • NovemberWhiskey 6y ago
          Use Organizations. If you’re creating new standalone independent accounts for teams you’re just seeking yourself up for some kind of billing/security/governance catastrophe down the road.
• Arrath 6y ago
  Shit, I had plans to refresh the network infrastructure in my parent's place with a full ubiquiti setup to replace the years of added on junk.
  • Terretta 6y ago
    Parent’s place? Go Eero Pro. Your future time management self will thank you.
    • Arrath 6y ago
      I'll take a look at it, but also note that I need in total: Router, Wifi AP (probably two to get full coverage), Powerline extender, Point-to-point extender with a switch on the other end. Stupid outbuildings. Anyway, thanks for the tip!
      • Terretta 6y ago
        Decent chance you don’t need all that. Eero Pro (not standard) kit comes with 3 identical boxes, each with a third radio band for backhaul mesh, each can be wired or wireless as well. https://evanmccann.net/blog/eero-vs-eero-pro https://evanmccann.net/blog/eero-vs-eero-pro See comparison table illustration here: https://evanmccann.net/blog/2021/2/eero-6-vs-eero-6-pro https://evanmccann.net/blog/2021/2/eero-6-vs-eero-6-pro Not sure if still the case, but last time I dug into it, eero was also the only consumer grade software-defined-radio router/ap, allowing them to rapidly patch for various vulns that others couldn’t necessarily or took much longer for.
    • pseudalopex 6y ago
      Eero is cloud managed too. And reports MAC addresses and network usage to Amazon.
    • cced 6y ago
      Does their gear have any cloud offerings?
• seneca 6y ago
  There was just a thread[1] yesterday about them starting to serve ads in their UI. It seems this company is rapidly losing credibility. I have had plans kicking around for a bit over a year to do a full build out using their products, and just within that time it seems like they've gone from a glowing reputation to severely tarnished. Unfortunate, as it seems like they once had great products. 1: https://news.ycombinator.com/item?id=26628198 https://news.ycombinator.com/item?id=26628198
• markwillis82 6y ago
  Was days away from refitting my home out with £2,000 of gear. Any other recommendations for routers, wifi and security cameras?
  • pseudalopex 6y ago
    Mikrotik is the most common recommendation probably but wifi speed is a problem apparently. There were some other suggestions in yesterday's Ubiquiti discussion.[1] [1] https://news.ycombinator.com/item?id=26628198 https://news.ycombinator.com/item?id=26628198
  • tecleandor 6y ago
    I use Mikrotik (or OpenWRT) for routers, but Mikrotik is not that good on WiFi. Peeople recommend Ruckus, but it's pretty expensive (and not that easy to get second hand in Europe, or Spain at least). Is there any (good) brand with pricing between Mikrotik and a Ruckus that doesn't need a cloud connection?
    • mr_woozy 6y ago
      Is it not possible to just add in a separate WAP to the MikroTik device ?
    • ghostpepper 6y ago
      Can you elaborate on your experience with Mikrotik wifi? What don't you like about it?
  • ruph123 6y ago
    For router check out the Turris Omnia [0]. Seems to be a good choice. [0]: https://www.turris.com/en/omnia/overview/ https://www.turris.com/en/omnia/overview/
    • pkaye 6y ago
      That looks pretty nice. Too bad I didn't see this a week earlier since I just upgrade my home network last week.
• dataminded 6y ago
  Thank you Adam. You saved me thousands, I was seriously considering a network upgrade.
• whereis 6y ago
  The simple interpretation is that lawyers know that the law offers no consumer protections in these scenarios, and tried to use that to protect the corporation. Morals aside, and assuming their assessment about such legal boundaries was correct, they were simply doing their jobs. The system may be broken, but a patch is necessary, and that is only going to arise via legislation. Sadly, the system of governance is also broken, so I expect this will be closed with status "WONTFIX".
• dec0dedab0de 6y ago
  Cloud managed anything has a giant red target painted on it. Especially infrastructure equipment. I'm still surprised anyone think's it's ok to use their ISP provided router and wifi, let alone having it be managed remotely by the manufacturer.
  • zerkten 6y ago
    The problem is that on-prem isn't much better in many cases. Only the largest organizations have the capability to operate deep defenses against these threats whether it's the cloud, or the on-prem. If you and your team have the skills you can operate fairly effectively on a small scale, but that's a pretty luxurious situation. Most home users can't tell the difference between a router and cable modem hence it's in the interest of cable providers to lower support costs by providing a managed offering. It's terrible from a security perspective, but customers have signed that away. The common theme running through these breaches is that the organization isn't necessarily small, but they aren't Google/Apple/Microsoft-size either. Those companies have multiple layers of expertise and the cash flow to hold up development of anything in order to make sure things are secure. It's hard to wing stuff once the bureaucracy understands security is needed. They even start pushing their product security initiatives outside of product development to mundane departments because they get attacked by very smart actors. You can see from the news it's still far from perfect. Once you get to companies the size of Ubiquiti, you start having challenges with implementing close to the same degree of security because you don't have float in the system to allow for additional costs, delays, etc. on top of the lack of expertise. Apparently Ubiquiti have been hemorrhaging expertise in other areas due to opportunistic cost-cutting, so it isn't a surprise that they suffer and respond in this way given that culture. A bad security decision by one exec in companies of this size can cut across many departments which doesn't happen in the behemoths.
    • pseudalopex 6y ago
      The problem isn't Ubiquiti using AWS. It's Ubquiti forcing customers to use cloud authentication.
      • 6y ago
• caseysoftware 6y ago
  "Adam says the attacker(s) had access to privileged credentials that were previously stored in the LastPass account of a Ubiquiti IT employee, and gained root administrator access to all Ubiquiti AWS accounts, including all S3 data buckets, all application logs, all databases, all user database credentials, and secrets required to forge single sign-on (SSO) cookies." Holy... Wow. That is catastrophic. Everything is compromised. That's a complete rebuild.
  • jandrese 6y ago
    Or they'll just change their passwords and pretend to have solved the problem.
• abledon 6y ago
  >Adam says the attacker(s) had access to privileged credentials that were previously stored in the LastPass account of a Ubiquiti IT employee. So the laptop probably had some malware/keylogger on it that was able to pick up some data in the lastpass browser extension or something?
  • hedora 6y ago
    previously stored. They probably made a csv backup of the lastpass database. Those aren’t encrypted.
• akkartik 6y ago
  Why do people trust any IoT devices these days? Shouldn't we be trying to reduce our exposure to (inevitably insecure) software? What benefits does it provide that are worth the unbounded risks?
  • ramraj07 6y ago
    It’s not _that_ unbounded? At least not yet! Until a tech savvy neighbor who’s also a creep can easily break into your network and home camera I’m not personally worried.
    • akkartik 6y ago
      Why does it have to be a neighbor? It says "internet" on the tin. Do you have confidence that random people on the internet can't do the equivalent of a port-scan on you? The other way I think of it is, I don't use it right now. It likely has open doors, intentional or unintentional. If the open doors are widely discovered, reliably closing them seems difficult. The highest-leverage point in time to influence this story is before I start using it. "The only winning move is not to play." Feedback appreciated on this thought process.
      • ramraj07 6y ago
        The question is what incentive a random person in the internet has into finding and targeting me. I’m a single dude who’s not rich, and I’m not gullible to scams (at least not easily). So unless they have a personal grudge against me, I would probably not be currently worried about installing a doorbell camera for example. The threat modeling will Change the moment I have a family of course. I see it no different from driving a car. You can get carjacked, you can get in a crash, you don’t just not drive a car because of it, you just calculate your risk tolerance and do it.
        • akkartik 6y ago
          Imagine someone taking control of your door and telling you you need to pay them $50 at a random bitcoin address before you can open it. $50 isn't a reasonable payoff for most carjackings, but this isn't like a carjacking. They're doing the same thing at the same time to 1000 people using a script they wrote. That changes the payoff, and that means more people are likely to try to do something like this. This is an extremely mild scenario. It's possible I'm wrong about IoT, and there's a case for using it in its current state. But one thing I'm _sure_ of is that analogies with cars don't work.
• bedhead 6y ago
  Ubiquiti is another one of these companies where if you did nothing but read about them on HN, Reddit, et al, you would think they're filing for bankruptcy tomorrow, set orphanages on fire, kill puppies, etc. The negative hyperbole around this company is something else, hack or not. And yet, all they do is thrive...
  • blablabla123 6y ago
    The hardware is very cheap and the market for their products is thriving. In fact it's possible to put custom software on it actually without using their cloud. > if you did nothing but read about them on HN, Reddit, et al, you would think they're filing for bankruptcy tomorrow, set orphanages on fire, kill puppies, etc. I need to check these posts ;)
    • bedhead 6y ago
      Seriously I'm just tired of it. Do you know how many tech geeks over the last few years have proudly proclaimed online that the company is "going downhill" and they'll never buy any more Ubiquiti products? 50 billion, that's how many. How many follow through? Evidently zero. It's comical. The hack obviously not good, but GMAFB.
      • akkartik 6y ago
        Can you elaborate on what break this is that you desire? What would you like to have happen?
  • deleted 6y ago
    [deleted]
  • tw04 6y ago
    It's a long-tail if I had to guess. In my "circle" of coworkers almost every last one has ubiquiti today, and every last one is planning to replace it with something else when they make the jump to WiFi-6. Maybe we're the anomaly, but I have a feeling 2 years from now if they continue down the path they're on, their earnings will not be quite so rosy.
• xoa 6y ago
  I wish I could say I was surprised :(. Along with a bunch of other people who've used their products for a decade or more now, I've been watching the ever steepening downward spiral of the company really becoming noticeable over the last 3-4 years. In an academic way, it's actually been kind of fascinating to watch happen in real time over the course of years with fairly front room seats. Seeing the deepening technical debt (lots of very old hardware still sold as new with no replacements in sight, inability to migrate their frameworks or keep their sources up to date and more), bikeshedding ramp up and up, the forums start to fall apart, marketing starting to write more and more checks development couldn't keep up with and then that getting brushed under the rug (the SHD and it's dedicated security radio comes to mind), the forums getting nuked entirely in favor of a horrible New Web thing with even worse bug/feature tracking then before and there wasn't any proper one before, ever worsening stability, universally hated UI changes that would just get shoved through anyway, and on and on. It's been everything one reads about, "Ubiquiti's Burning Platform" and all that, and in turn seems like it should be avoidable. Yet on it ground with sickening inevitability. It's just now finally starting to reach critical mass and become visible to the more general public, spreading through the same tech grapevine that gave them such a boost in the first place. But less academically it's depressing as hell too, because the grapevine liked them for good reason and there still isn't any drop in replacement. Their p2p/p2mp gear is still solid. And UniFi was a wonderful concept solidly executed. It also eschewed the subscription/cloud bullshit so many other players are chasing, which indeed is something of a saving grace here. While there is a cloud option, lots (if not most) people can and do run their UniFi networks completely self-hosted even for remote sites. The single pane of glass, ease of provisioning and recovery, etc made sense and saved time. And they had an incredibly enthusiastic and supportive community, like when they asked about moving L3 switching way back on the old forums (back when the rot was in its earliest stages and not clear yet) they got huge amounts of feedback, their beta testing had many people putting in a lot of good work. Such a damn stupid waste. And the nature of the beast for tech infrastructure is that market signals are always behind the curve and thus muted until things are already getting to be too late. Robert Pera also owns the majority of their stock IIRC so there isn't any way to effect an outside management change there either. It is odd to me that nobody has sought to go after them directly and aggressively, though I heard rumblings late last year that Cisco was giving a go at something clearly aimed right at the UniFi market (no subscriptions like Meraki)? At any rate, final straw for me on routing was the flop their "UXG" has been, I finally gave up at long last and began migrating everything to OPNsense a month back. And once the single pane of glass is broken, the barrier to start moving more drops in turn and network effects (harhar) begin to go into reverse. I'd still be happy if they somehow recovered, but if they do I think it'll be a long time. Problems that build for years tend to take years to reverse too, if they can be. I hope we get some stories someday internally on how it all went down.
• eqvinox 6y ago
  I am extremely relieved none of our Ubiquiti devices are set up for this cloud shit. (We use the PtP stuff, not the APs, the cloud bits are optional there.) Then again we have a "clear skies" policy & wouldn't have bought anything that requires cloud blah. (Which covers a whole bunch of other vendors too, looking at you Cisco "SmartLicense")
  • vageli 6y ago
    What is a "clear skies" policy?
    • remir 6y ago
      I'm guessing clear sky as in no clouds, meaning stuff should like AP/network management must remain on premise.
      • eqvinox 6y ago
        Indeed it is a pun on a cloud-free sky.
• exabrial 6y ago
  If they would have stayed with the on-premise model, this would have never happened.
• rossipedia 6y ago
  I am 100% not surprised. I spent a year working for Ubiquiti, running the Network Controller team. Trust me, this whistle-blower "Adam" (I have a few suspicions of who it actually is), toned it down. The reality is much much worse.
  • ex_ubiquiti 6y ago
    I worked at Ubiquiti while you were there. I can confirm that the company was going downhill fast. The US offices were starting to feel empty because so many people were leaving the company. Only place I've ever worked where engineers would quit before they got another job. Saddest part was all the wasted potential. There were good engineers making good products at Ubiquiti only a few years ago. Once UniFi exploded in popularity the CEO started trying to micromanage everything and it all started falling apart.
    • Silhouette 6y ago
      It's unfortunate what seems to have happened to Ubiquiti. The idea of decent network hardware with a good UI that can support the prosumer to small business segment of the market has a lot going for it. In the early days, it seemed like Ubiquiti was going to nail it and was building up a strong, loyal following as a result. Then came all the reports of quality problems, promised features never delivered, phoning-home, ads in UIs, the not just security breaches but cover-ups... How the brand hasn't become toxic already is a mystery to me, yet look at the stock price tracker. It's been trending up for years and it has well over doubled in the past six months alone. Apparently investors aren't too worried about any potential consequences of all these reported problems.
      • ex_ubiquiti 6y ago
        The early days at Ubiquiti were good. I worked with a lot of good engineers and we shipped good work. The decline is a recent problem. > How the brand hasn't become toxic already is a mystery to me, yet look at the stock price tracker. It's been trending up for years and it has well over doubled in the past six months alone. This is your answer. No incentive to change. All of the bad engineering decisions have been rewarded by increasing stock price and continued sales. Most of the original engineers have quit by now. I lost track of how many UniFi engineering leads joined and then quit after it started falling apart. Before I quit, I heard rumors that the CEO was making two separate teams work on the Dream Machine project separately, competing against each other. That made more people quit. I think they were trying to reboot engineering in foreign countries when I left because it felt like we were forgotten in the US offices.
• qwertox 6y ago
  It really doesn't get worse than this. But isn't Ubiquiti more of a prosumer company, like MikroTik? MikroTik does get a lot of heat when they have a security vulnerability and get downranked for it as if it were far, far away from Ubiquiti's security profile (something like "US vs. some east EU country"), but this event tells a lot about Ubiquiti's upper management and their internal security practices.
  • messo 6y ago
    Have MikroTik had any security vulnerabilities anywhere close to what has now been revealed about Ubiquiti? MikroTik's firmware seems very solid and I get the impression that they care about security and routines.
    • g_p 6y ago
      It seems the issue with Ubiquiti here has potential wider implied for users of the equipment (signing keys compromised, cloud dependency giving remote management plane access). An individual vulnerability in a device is an issue but it gets patched. Hopefully it can't be exploited remotely. My biggest annoyance is when "infrastructure" ends up with outside connections in place (to the cloud or elsewhere), that breaks this model down (trusting the provider to mediate remote access, for example). They're a big single point of failure, and this incident really proves that.
  • pilsetnieks 6y ago
    Fun fact - a lot of Ubiquiti's engineering is located in that same "east EU country". In fact, if you look at the open positions - https://careers.ui.com/positions https://careers.ui.com/positions - it appears most of the development appears to happen in Central/Eastern/Northern Europe.
• wnevets 6y ago
  Is it just me or are you no longer able to avoid the cloud with the latest software updates for unifi?
  • surfsvammel 6y ago
    If you are using CK, Protect and/or the iOS app, it seems that you need Remote Access (a.k.a. Cloud) enabled for authentication.
    • myrandomcomment 6y ago
      No you do not, only setup. You can disable it after. See my other comment.
      • surfsvammel 6y ago
        I just tried. It does at least not work for protect and it does not work for the IOS apps.
        • myrandomcomment 6y ago
          I have not looked at Protect yet, however for Network you can disable remote login after creating a local account. Open Network app on IOS and make sure you go the main page that list the controllers. Click on the arrow. Next screen you will see a section called “Launch Type” which list all the access methods, local IP 4, IPv6 and cloud. Pick the local IP adresss.
  • easton 6y ago
    Only if you have the newer Cloud Key or Dream Machine. The older Cloud Key isn't fast enough to handle the new OS (which ended up being good in this case, since it's still getting security updates).
    • wnevets 6y ago
      > Only if you have the newer Cloud Key that would explain it then.
• modeless 6y ago
  Should have blown the whistle to the SEC instead. SEC whistleblowers get paid. Up to 30% of eventual penalties paid by the company with no upper limit. Lying about a breach could be securities fraud.
  • MrFoof 6y ago
    They may already have. Investigation is already pending: https://finance.yahoo.com/news/shareholder-alert-ubiquiti-inc-investigated-184800904.html https://finance.yahoo.com/news/shareholder-alert-ubiquiti-in...
    • surfsvammel 6y ago
      This might just be a law-firm fishing for people willing to be plaintiffs when they sue. So, this in itself might not mean much of anything. This might just be a lawyer who read the news and though "Hey, let's see if we can find enough people willing to sue!"
    • modeless 6y ago
      That's not the SEC, it's just some ambulance-chasing law firm.
• neartheplain 6y ago
  Don’t have time to dig into this right now, but I have a Ubiquiti WiFi AP at my home behind a NAT; does this breach mean my home network is vulnerable/effectively exposed to the Internet? Do I need to log off HN and deal with this now, or can it wait?
  • aaomidi 6y ago
    I mean, yes, it does. However hopefully the hackers aren't in their system anymore - so if you were at risk it's already probably over. I guess just change your password and reset your 2FA?
    • neartheplain 6y ago
      Ugh. Guess I’ll just go wired for now and unplug the AP. Hopefully I’m only paranoid, but I really don’t like the feeling of a hole in the network with my family’s NAS and IoT devices. Never again with the cloud-connected network appliances. Time to build a router from scratch, I guess.
      • geephroh 6y ago
        You can run the AP locally with the standalone controller appliance in a container or VM[1]. Pretty simple, and doesn't require a UNBT login. Probably still worth doing a factory reset on your AP first, if you're paranoid like me... 1. https://help.ui.com/hc/en-us/articles/360012282453-UniFi-Set-up-a-UniFi-Network-Controller#h_01EPDDV86GTK4M229TJHQK93MR https://help.ui.com/hc/en-us/articles/360012282453-UniFi-Set...
  • xoa 6y ago
    It depends. How do you manage said AP? The leaked credentials issue here is specifically in SSO Cloud authentication to Controllers, which are used to administer all the actual hardware devices. However, the devices themselves aren't affected. So depending on how, or for that matter if, you manage them you may be unaffected as well which has always been a major touted advantage of UniFi and has indeed proved true right with this very incident. Your post seems to imply you have just that AP and that's it? If you set it up initially (putting the controller on one of your own computers temporarily maybe), and then just left it standalone from there on out you're fine. There is no need to have an active Controller for all the hardware to work as configured, a Controller is just needed to change configuration, collect real time statistics/send notifications, and do necessarily active things like run a guest portal. If you are running a Controller, but you're doing entirely standalone on your own hardware (or your own cloud service for that matter), and haven't enabled Ubiquiti SSO cloud access, you're unaffected. That's how I've always run since I don't trust 3rd party cloud stuff for something like this, ever. It's """only""" an issue for their cloud service, and apparently their "Cloud Keys" and "Dream Machines" as well since they pushed it on people some recent firmware. Which granted covers a lot of surface area, and Ubiquiti has pushed very, very hard (see advertising outrage from just a few days ago). But it's thankfully still not everything.
• post_break 6y ago
  Verkada, now Ubiquiti, yikes. Also according to this leaker, it seems like they tried to cover it up before letting the public know. They are on my blacklist now.
• outerspace 6y ago
  The most disconcerting part for me is the fact that the attackers gained full access to one of the administrators’ LastPass account. I would love to know how that happened.
• myrandomcomment 6y ago
  You are required to have internet access to setup something like the UDM-Pro. After it is setup you can create a local admin account and disable remote access. Here is how: 1. Login with your online account credentials and password 2. Choose system settings 3. Choose advanced 4. Disable Remote Access 5. Confirm that "Transfer owner" won't be available if you disable remote access. The issue in general is that the UniFi stuff can be crappy and buggy, but it SUCKS LESS then any other complete solution for a home / small enterprise there at the price point. I personally used to given them a strong recommendation and even now that is a recommendation with some footnotes. They have been growing to fast and the SW quality has gone down. Being on the latest release is not always the best idea. To be fair in my I have had many conversation with Cisco that started with "no, not the latest GA, but what is the latest proven STABLE GA."
  • tenacious_tuna 6y ago
    Just verifying my understanding: this will make it impossible to reach the device from ui.com or otherwise off-network, but an attacker could: 1. use leaked SSO keys to forge an SSO token 2. craft a malicious webpage 3. get an unsuspecting UDMP user (e.g., me) to navigate to that page 4. run scripts on that page that would access & interact with the UDMP from the browser within the network, using the forged SSO Is this still a possible vector? Presumably UI would have rotated their SSO keys by now, but since there's no way to disable SSO-based login to the UDMP....
    • TimTheTinker 6y ago
      The difference is that the attack you suggest has to be targeted
    • myrandomcomment 6y ago
      So SSO is disabled here. You just use a local account. IE, I go to https://192.168.27.1 https://192.168.27.1 to get to my UDMP and the account to auth is locally stored.
      • 6y ago
• 1vuio0pswjnm7 6y ago
  It is interesting to do a search of HN for past references to "Ubiquiti". Whenever the topic of routers came up, many comments followed that recommended them above any alternatives. Commenters seemed proud to tell the world they were using Ubiquiti, as if the "HN concensus" for home routers was to choose Ubiquiti. It seemed to me Ubiquiti would never allow customers the option to install their own OS (e.g., BSD) or boot from external media containing a non-Ubiquiti OS, without sacrificing the benefits of hardware specs that were likely deciding factors in selecting the Ubiquiti hardware above existing alternatives. The intent was clearly to have Ubiquiti retain control over the hardware after purchase. The customer effectively remained tied to Ubiquiti forever, so if the company started serving ads, using AWS unnecessarily, etc., there's no way to opt out. Customer is compelled to accept all updates. Specs are important, but maybe not as important as control. Reliance on third parties necessarily increases potential risk. Unnecessary use of third parties is, IMO, poor decision-making. This is of course rampant in "tech" and, IMO, marks a triumph of the salesforce for those third parties over common sense, possibly assisted by network effects. Further, I dislike products where there is a heavy focus on opaque "updates". Again, many customers have been trained to believe that not updating is always the wrong decision. (Meanwhile they have no idea what is in each update.) As stated in one of the blog post comments: "It is even worse: Ubiquiti forced all users to use cloud-based authentification even for accessing your controller software on a local network with a local client. This was not even properly communicated but deployed by one of the regular maintenance updates."
  • myrandomcomment 6y ago
    I do not understand this comment. Ubiquiti sells turn key HW and there never was any hint that this was HW you could roll you own on. I could buy APs that I could install OpenWRT. I could setup an OpenBSD firewall. I could run my own DNS. I have done all this in the past. The point is I do not want to anymore. I have better things to do with my time. So as a turn key solution that is "prosumer" their kit works and I think you will find that is why most people here have recommend it. You can disable the Cloud connection and I posted how in this thread. People on HN are tech savvy enough I sort that part. The fact of the matter is they had a bad security breach and they have a cloud connected platform. Ops. That sucks. But the reality is that market forces have pretty much tied evaluations to cloud connections and telemetry gathered from it. That is the part that REALLY sucks. I do not blame them for trying to make money. I am angry if they were less then truthful in the details of the breach and I am sure both the SEC and the court of public option with punish them. For my part, I have no plans to replace the 4 switches in my house with boxes running SONiC nor the 4 APs with OpenWRT or my firewall with OpenBSD because I just really do not care to have to maintain it, and if I drop dead tomorrow my wife can likely sort the UniFi stuff (as I have documentation on the setup) but there is no way could she sort the roll you own.
• Saris 6y ago
  A potential option for anyone wanting to avoid buying new hardware to move away from Ubiquiti management software: https://openwrt.org/toh/start?dataflt%5BBrand*%7E%5D=Ubiquiti+ https://openwrt.org/toh/start?dataflt%5BBrand*%7E%5D=Ubiquit...
• eyeareque 6y ago
  How many of you would be surprised to hear that 99% of companies have similar security gaps? These problems happen literally everywhere.
  • koluna 6y ago
    No, they don’t. Ubiquity literally covered up a giant security breach to avoid backlash while putting every single customer at risk for 3 months. Imagine - for 3 months someone had direct access to your entire network and you didn’t know.
• surfsvammel 6y ago
  The plot Thickens: "SHAREHOLDER ALERT: Ubiquiti, Inc. Investigated for Possible Securities Laws Violations by Block & Leviton LLP; Investors Should Contact the Firm" https://finance.yahoo.com/news/shareholder-alert-ubiquiti-inc-investigated-184800904.html https://finance.yahoo.com/news/shareholder-alert-ubiquiti-in...
  • hpkuarg 6y ago
    This type of solicitation is a dime a dozen, but I do find the name of the firm hilarious. Anyone who's had to make patch cables would recognize the name...
  • wp381640 6y ago
    This is just class action ambulance chasing. Almost all of these guys are assholes.
• tjoff 6y ago
  Is there any reason to worry if you run a local controller that doesn't have any connection to a cloud account?
• Quarrelsome 6y ago
  > Ubiquiti’s shares have surged from $243 on Jan. 13 to $370 as of today. How are we ever going to solve security as an industry against this? Again we're told that security isn't important. Being the first to market and insecure is the winning play and that's just fucked.
  • genmud 6y ago
    I don't think that it is a solvable problem if the economics stay the same. SolarWinds is actually trading almost $2/share more than it did 1 year ago today ($15.67 v $17.23). Sure, it is down from its 52 week high ($24.34). I would argue that SolarWinds should not be allowed to be in business in its current form, considering what a threat they have been to themselves and others in their mis-handling their software practices and subsequent breach. If an individual did what they did as an employee of the government, they would currently be in jail. It is probably one of the most impactful national security events in our lifetimes and the impact of this event will be felt in certain areas for years or even decades.
    • Quarrelsome 6y ago
      I feel like we have to regulate this at a governmental level to get anywhere. We keep automating more and more of our society and its clear we're unable to protect it but the casuals don't get that and keep charging ahead and we enable them. The amount of power we gift to a given attacker seems to just grow and grow. But how do we achieve political intervention when technologists and politics appear to be completely incompatible? The closest I've seen is the Pirate Party which never get more than a few percent or that democratic candidate (Yang was it?) and he was pretty fucking clueless on the tech when poked with any significant vigour.
      • genmud 6y ago
        It is certainly a difficult problem and as such, like most difficult problems, it will likely not be fixed in any meaningful manner. We will likely be talking about this exact issue in 5 years, 10 years, and 20 years from now. Cyberspace Solarium Commission [1] created a robust and well documented roadmap for the Biden transition team to address some of these fundamental problems. IMHO, it is one of the better policy documents and has a number of really good recommendations that I believe would be extremely helpful. The #1 thing I think we could do is address accountability, who is responsible for the security of devices/software and what legal recourse should people have if the vendor doesn't adequately secure or support their products. I think that there are a bunch of issues and one of the biggest ones is that what we say vs what we do are 2 different things. We also have issues where many of the core business practices that are commonly accepted are incompatible with building a secure and resilient infrastructure. [1] https://www.solarium.gov/public-communications/transition-book https://www.solarium.gov/public-communications/transition-bo...
• JustSomeNobody 6y ago
  > Ubiquiti’s stock price has grown remarkably since the company’s breach disclosure Jan. 16. After a brief dip following the news, Ubiquiti’s shares have surged from $243 on Jan. 13 to $370 as of today. Why? Coincidence?
• rys 6y ago
  I’m willing to see what Ubiquiti will do to make it right before I switch away, because I have a local-only setup of EdgeRouter and UniFi APs that’s been absolutely great in the years I’ve had it, but this is really last chance saloon stuff now. I’m looking for a proper post-mortem and the steps to make sure it can’t happen again, recommitment to local-only users and respect of the customer, and a step back from the push to cloud everything.
• smileybarry 6y ago
  Yikes. I have a (Ubiquiti) EdgeRouter X that I previously used for a fiber setup (and it's shelved now because it doesn't like this ISP's modem), had planned to get a ER-4 later down the road. Been on the fence for any of their APs for months upon months, now I'm glad I bought neither. Technically EdgeRouter gear is unaffected as it's very cloud-optional, but I can't bring myself to trust any firmware from them at this point. It supports OpenWRT so I guess I'll install it and go back to OpenWRT. I see this thread already has people discussing alternatives, so I won't ask for ones -- just had to put it out there that if you own an EdgeRouter, chances are that OpenWRT has a build for it.
• lazyweb 6y ago
  Yeah my few Unifi devices (and the controller SW instance) are already restricted to their own VLAN, but I'm going to disable outgoing internet access as well.
• spockz 6y ago
  How can you see whether you have been effected or whether they have poked around your setup and maybe even left something behind? Theoretically you can’t really trust anything on your network anymore.
• gorgoiler 6y ago
  It seems naive to want to talk to the press under a pseudonym — Adam, in this case. When looking for leakers internal security auditors don’t need proof you are Adam in order to fire you. They just put enough pressure on the most likely Adams such that they quit. You will be one of them. If another Adam does so, so be it. Your actions likely flushed the other leaker when you thought you were the only one. You won’t be able to handle the pressure. Neither could she. Adieu, Adam, et al.
  • bombcar 6y ago
    I wouldn’t be surprised if Adam has already left the building.
• jbm 6y ago
  Say what you want but my cheap old Linksys router never leaked my passwords.
• okigan 6y ago
  Ran into this [1] issue with Ubiquiti and Stripe integration. Short story Ubiquiti integration insist on sending credit card numbers directly to Strip (vs using more secure method). The issue has been there for 2 years -- which is beyond odd. When I've reached out to tech support the issue was effectively closed as known issue. [1] https://community.ui.com/questions/Tokenization-for-Stripe-IS-A-MUST/c8683590-23d0-4395-acef-072cd06ea456 https://community.ui.com/questions/Tokenization-for-Stripe-I...
• elevation 6y ago
  I'll change my forum password and continue to avoid UBNT's cloud features like always. I'm still happy with the value, stability, and security updates (!!) of my UBNT hardware. I still won't buy gear from another vendor that wants $$$/device-year in support contracts and have unavoidable cloud controllers.
• eutropia 6y ago
  > Ubiquiti’s stock price has grown remarkably since the company’s breach disclosure Jan. 16. After a brief dip following the news, Ubiquiti’s shares have surged from $243 on Jan. 13 to $370 as of today. By market close Tuesday, UI had slipped to $349. Aaannd this is why we can't have nice things. Like trust in our vendors. Or security. Or consequences.
• H8crilA 6y ago
  By the way, reporting to krebsonsecurity is a giant waste of potential income. This is what the SEC whistleblower program is for. You get paid for submissions there that lead to successful enforcement actions, and the payouts can be very substantial. Furthermore because payouts exist, there's an industry of competent lawyers that will happily take cases with compensation coming exclusively from your payout. Also, how is this a securities case? The company did not disclose the scale of the breach to shareholders.
  • LilBytes 6y ago
    https://finance.yahoo.com/news/shareholder-alert-ubiquiti-inc-investigated-184800904.html?guccounter=1 https://finance.yahoo.com/news/shareholder-alert-ubiquiti-in... It's already started. 'SHAREHOLDER ALERT: Ubiquiti, Inc. Investigated for Possible Securities Laws Violations by Block & Leviton LLP; Investors Should Contact the Firm'
    • H8crilA 6y ago
      The point is that if you deliver useful securities case to the SEC you can get paid. But it must be something the authorities don't already know. And yes, when the truth comes out about something like there will be a securities case.
  • beervirus 6y ago
    > how is this a securities case? Everything is securities fraud.[0] [0] https://www.bloomberg.com/opinion/articles/2019-06-26/everything-everywhere-is-securities-fraud https://www.bloomberg.com/opinion/articles/2019-06-26/everyt...
    • vxNsr 6y ago
      OP was asking a rhetorical question.
      • beervirus 6y ago
        Oh I know. And he already answered it anyway.
• dandare 6y ago
  Why is the blog not adopted to mobile screen readability?
• mrslave 6y ago
  What is good cheap consumer gear for putting OpenWRT on? Similar to WRT54G was, back in the day.
  • bogwog 6y ago
    T-mobile sold a bunch of rebranded asus routers a couple of years back that are still excellent today and can be had for pretty cheap. Comes with some shitty tmobile spyware I think, but you can flash openwrt on it. Speed tests are pretty unreliable, but the peak unobstructed wifi speeds I've gotten from that have been better than what I get from my Unifi 6 lite, which supports wifi 6, even on wifi 6 devices. (couple hundred mbps on a home gigabit plan from Nazi Germany I mean Comcast) EDIT: it's called the T-Mobile AC-1900
    • mrslave 6y ago
      Thanks for the tip. This is a rebranded Asus RT-AC68U and in the $200 sweet spot. Unfortunately it's a Broadcom-based device which means OpenWRT support is limited, but apparently DD-WRT has better support[0]: > DD-WRT has a license agreement and NDA in place with Broadcom that allow usage of better, proprietary, closed source wireless drivers (binary blobs) which they are not allowed to redistribute freely. [0] https://openwrt.org/toh/asus/rt-ac68u https://openwrt.org/toh/asus/rt-ac68u
  • bmurphy1976 6y ago
    I have a TP-Link Archer C7, a Linksys WRT3200ACM, and a Netgear R7800. I've used all 3 as my primary device on my network running OpenWRT. I bought the TP-Link first. It worked, but it's an underpowered device and it was struggling to keep up with all the devices on my network. It also has a MIPS chip so it couldn't some ARM only software I wanted to use. I replaced it with the Linksys. I had nothing but problems with it. It was fast and reliable using the Linksys firmware (but functionality was severely limited). When running OpenWRT it was a buggy disaster. One example problem, it would randomly start dropping bonjour packets for no explicable reason thus preventing my wife from being able to print from her iPhone. It had to go. I was about ready to give up on my OpenWRT dream, but I took one last chance and bought the Netgear for cheap off of eBay. It's great. It's fast, it's reliable, and so far it just works (been running it for a year now). So the C7 is good if your needs are limited, but I really do recommend the R7800. It's a very nice device and you can probably find it for cheap on eBay like I did.
• accountofme 6y ago
  OK, well ubiquiti is dead to me now. Good news for me, their unifi line of aps is supported by openwrt... :)
• electro_blah 6y ago
  LOL fuck that company.
• TristanBall 6y ago
  This, plus the advertising thing, plus their weak firewall & wan feature set means they've lost me as both a customer and an advocate.
• nemesisdesign 6y ago
  For those using OpenWRT looking for a central controller which can be installed on-premise: https://openwisp.org/ https://openwisp.org/
• buildbot 6y ago
  Wow went from probably not buying their hardware again to immediately needing to remove it in like a single day!
• cmurf 6y ago
  It's not just incompetency, it's malice, to treat your own customers in this fashion. But this is what happens when there is consistently no consequences for these kinds of breaches. Neither government nor market punishes these kinds of events in any meaningful (cost penalty) way. All the cost is shouldered disproportionately by victims.
• commonoddity 6y ago
  DrayTek!! why haven't they been mentioned yet? All the comments are openwrt, Mikrotik, Linksys...
  • andremedeiros 6y ago
    They’re super hard to find in NA, I think. Love their products tho.
• GekkePrutser 6y ago
  Wow I'm glad I'm not using their cloud option at all. I still have one of the old USGs. So I never had to.
• busymom0 6y ago
  > Ubiquiti’s stock price has grown remarkably since the company’s breach disclosure Jan. 16. After a brief dip following the news, Ubiquiti’s shares have surged from $243 on Jan. 13 to $370 as of today. By market close Tuesday, UI had slipped to $349. Until these companies are held massively accountable for such negligence, nothing will change. Similar to what happened to Facebook and all they had to do was pay chump change fines.
• xyst 6y ago
  I was looking at upgrading my home networking equipment with Ubiquiti, but with the breach and the hidden advertisements in their products. I have ultimately decided against it. They have lost $1000s of dollars in potential sales (from me anyways). Guess I will just have to go bargain hunting on the used enterprise market, or just ask my BigCorp networking team to see if they sell or give away any of their equipment and try to repair it myself. My only concern would be noise generation and power consumption since they were built for use in data centers.
• skeletonjelly 6y ago
  Interesting to see what Troy Hunt does next considering they send him free stuff[1] and he speaks highly of them. He's so far only said it's "obviously a really bad look"[2] 1. https://www.troyhunt.com/friends-dont-let-friends-use-dodgy-wifi-introducing-ubiquitis-dream-machine-and-flexhd/ https://www.troyhunt.com/friends-dont-let-friends-use-dodgy-... 2. https://twitter.com/troyhunt/status/1376998711318863880 https://twitter.com/troyhunt/status/1376998711318863880
  • koluna 6y ago
    I’m not holding my breath. Troy is a consultant. If they sent him that much free gear, what, he’s gonna backpedal and say “I’m removing everything UBNT out of my network”? Definitely not. “That’s a bad look” is a understatement for the giant cluster that this is.
• zelon88 6y ago
  Also interesting and noteworthy is it appears that today, just 7 hours prior to this Krebs article, an investigation was launched into Ubiquity for potential securities fraud. http://www.globenewswire.com/news-release/2021/03/30/2201903/23044/en/SHAREHOLDER-ALERT-Ubiquiti-Inc-Investigated-for-Possible-Securities-Laws-Violations-by-Block-Leviton-LLP-Investors-Should-Contact-the-Firm.html http://www.globenewswire.com/news-release/2021/03/30/2201903...
• sterlinm 6y ago
  The description of the incident in their quarterly financial statement seems to match this description. It doesn't downplay it quite as much as the email they sent customers. > For example, in January 2021, we became aware that certain of our information technology systems hosted by a third party cloud provider were improperly accessed and certain of our source code and the credentials used to access the information technology systems themselves had been compromised. We received a threat to publicly release these materials unless we made a payment, which we have not done. As a result, it is possible that the source code and other information could be publicly disclosed or made available to our competitors. Due to the nature of the source code and the other information that we believe was improperly accessed, we at this time do not believe that any public disclosure will have a material adverse effect on our business or operations, but it is impossible to gauge the precise impact of any such disclosure. We have taken, and will continue to take, steps to remediate access controls to our information technology systems. http://ir.ui.com/sites/default/files/2021-02/ui-10q-12-31-20.pdf http://ir.ui.com/sites/default/files/2021-02/ui-10q-12-31-20...
• greggman3 6y ago
  Is there a market for good networking equipment? If Ubiquiti was it and it's gone, and reading this thread there are no good alternatives, then it sounds like there is an opportunity for a new company.
• esaym 6y ago
  I looked into Ubiquiti years ago while trying to find a decent access point. Couldn't stand the thought of having to configure stuff "in the cloud" or running the then giant Java based controller locally. Floundered some with random enterprise access points used off of ebay that either drew too much power or was still buggy (netgear was the worst). Then I came across Mikrotik. Their hardware and conformance is somewhat dated, but I've never had anything run so stable. Haven't looked back and been going on 4 years now.
• rrauenza 6y ago
  What's your exposure if you had a cloud key enabled for remote access, but now disabled? Sounds like anything is possible if they compromised the cloud key (which is a device, not a "key")
• kuon 6y ago
  I have some unifi camera and unified video on a Linux box, and they are phasing out unified video. I don't want to move to the cloud offering. Is there a way to use the hardware with open source software?
• hda111 6y ago
  I just wanted to replace all my UniFi APs at home with the new UniFi-6 series. But this won’t happen after reading this article.
• qwerty456127 6y ago
  IMHO there should be a default paragraph text font size specified in the browser settings and all the other styles should be derived from it given just coefficients specified in the page CSS.
• Tabular-Iceberg 6y ago
  Are you affected even if you never pressed the "Add to UNMS Cloud" button? I never did because I thought it looked like asking to get pwned.
• crocsarecool 6y ago
  I reached out to Ubiquiti because we never got an email to rotate our passwords, and they told me I wouldn’t get an email unless I was using “Ubiquiti verified SSO.”
• samcat116 6y ago
  This whole thing shows how tech such as passwordless, device trust, approval flows, should be in place at basically any company. And your cloud accounts need to be hooked up to your SSO with said features.
• potatoman2 6y ago
  For those who don't remember, this is the same company that was bilked $46 million in an email spoof attack. https://www.theregister.com/2015/08/09/ubiquiti_stung_by_email_spoofing_fraud/ https://www.theregister.com/2015/08/09/ubiquiti_stung_by_ema... They're used as a bad example in my annual corporate infosec compliance training.