3 ms·

Don’t have time to dig into this right now, but I have a Ubiquiti WiFi AP at my home behind a NAT; does this breach mean my home network is vulnerable/effective

Don’t have time to dig into this right now, but I have a Ubiquiti WiFi AP at my home behind a NAT; does this breach mean my home network is vulnerable/effectively exposed to the Internet? Do I need to log off HN and deal with this now, or can it wait?

aaomidi 6y ago
I mean, yes, it does. However hopefully the hackers aren't in their system anymore - so if you were at risk it's already probably over. I guess just change your password and reset your 2FA?
- neartheplain 6y ago
  Ugh. Guess I’ll just go wired for now and unplug the AP. Hopefully I’m only paranoid, but I really don’t like the feeling of a hole in the network with my family’s NAS and IoT devices. Never again with the cloud-connected network appliances. Time to build a router from scratch, I guess.
  - geephroh 6y ago
    You can run the AP locally with the standalone controller appliance in a container or VM[1]. Pretty simple, and doesn't require a UNBT login. Probably still worth doing a factory reset on your AP first, if you're paranoid like me... 1. https://help.ui.com/hc/en-us/articles/360012282453-UniFi-Set-up-a-UniFi-Network-Controller#h_01EPDDV86GTK4M229TJHQK93MR https://help.ui.com/hc/en-us/articles/360012282453-UniFi-Set...
xoa 6y ago
It depends. How do you manage said AP? The leaked credentials issue here is specifically in SSO Cloud authentication to Controllers, which are used to administer all the actual hardware devices. However, the devices themselves aren't affected. So depending on how, or for that matter if, you manage them you may be unaffected as well which has always been a major touted advantage of UniFi and has indeed proved true right with this very incident. Your post seems to imply you have just that AP and that's it? If you set it up initially (putting the controller on one of your own computers temporarily maybe), and then just left it standalone from there on out you're fine. There is no need to have an active Controller for all the hardware to work as configured, a Controller is just needed to change configuration, collect real time statistics/send notifications, and do necessarily active things like run a guest portal. If you are running a Controller, but you're doing entirely standalone on your own hardware (or your own cloud service for that matter), and haven't enabled Ubiquiti SSO cloud access, you're unaffected. That's how I've always run since I don't trust 3rd party cloud stuff for something like this, ever. It's """only""" an issue for their cloud service, and apparently their "Cloud Keys" and "Dream Machines" as well since they pushed it on people some recent firmware. Which granted covers a lot of surface area, and Ubiquiti has pushed very, very hard (see advertising outrage from just a few days ago). But it's thankfully still not everything.
- neartheplain 6y ago
  Thanks the detailed reply. As you correctly inferred, this is my situation: >Your post seems to imply you have just that AP and that's it? I recently moved to a house with a preexisting network, so I have only the AP itself set up with the Ubiquiti router/network controller still in storage. I use the mobile app to configure the AP. It sounds like the AP won’t phone home or open tunnels to their cloud by itself, so I’ll turn it back on for now.
- h0l0gr4ph1c 6y ago
  If they got in this far, what else did they get access to? How long have they had access? Saying its only a db *that they know of*. What about the software repositories that they host somewhere?? Did the admin have access to that? This is pretty major....

aaomidi 6y ago

I mean, yes, it does. However hopefully the hackers aren't in their system anymore - so if you were at risk it's already probably over. I guess just change your password and reset your 2FA?

neartheplain 6y ago
Ugh. Guess I’ll just go wired for now and unplug the AP. Hopefully I’m only paranoid, but I really don’t like the feeling of a hole in the network with my family’s NAS and IoT devices. Never again with the cloud-connected network appliances. Time to build a router from scratch, I guess.
- geephroh 6y ago
  You can run the AP locally with the standalone controller appliance in a container or VM[1]. Pretty simple, and doesn't require a UNBT login. Probably still worth doing a factory reset on your AP first, if you're paranoid like me... 1. https://help.ui.com/hc/en-us/articles/360012282453-UniFi-Set-up-a-UniFi-Network-Controller#h_01EPDDV86GTK4M229TJHQK93MR https://help.ui.com/hc/en-us/articles/360012282453-UniFi-Set...

xoa 6y ago

It depends. How do you manage said AP? The leaked credentials issue here is specifically in SSO Cloud authentication to Controllers, which are used to administer all the actual hardware devices. However, the devices themselves aren't affected. So depending on how, or for that matter if, you manage them you may be unaffected as well which has always been a major touted advantage of UniFi and has indeed proved true right with this very incident. Your post seems to imply you have just that AP and that's it? If you set it up initially (putting the controller on one of your own computers temporarily maybe), and then just left it standalone from there on out you're fine. There is no need to have an active Controller for all the hardware to work as configured, a Controller is just needed to change configuration, collect real time statistics/send notifications, and do necessarily active things like run a guest portal. If you are running a Controller, but you're doing entirely standalone on your own hardware (or your own cloud service for that matter), and haven't enabled Ubiquiti SSO cloud access, you're unaffected. That's how I've always run since I don't trust 3rd party cloud stuff for something like this, ever. It's """only""" an issue for their cloud service, and apparently their "Cloud Keys" and "Dream Machines" as well since they pushed it on people some recent firmware. Which granted covers a lot of surface area, and Ubiquiti has pushed very, very hard (see advertising outrage from just a few days ago). But it's thankfully still not everything.

neartheplain 6y ago
Thanks the detailed reply. As you correctly inferred, this is my situation: >Your post seems to imply you have just that AP and that's it? I recently moved to a house with a preexisting network, so I have only the AP itself set up with the Ubiquiti router/network controller still in storage. I use the mobile app to configure the AP. It sounds like the AP won’t phone home or open tunnels to their cloud by itself, so I’ll turn it back on for now.
h0l0gr4ph1c 6y ago
If they got in this far, what else did they get access to? How long have they had access? Saying its only a db *that they know of*. What about the software repositories that they host somewhere?? Did the admin have access to that? This is pretty major....