4 ms·
These blanket statements don’t apply to everyone. It depends which Ubiquiti hardware you own and how you’ve configured it. For example, I run the UniFi control
by js2 6y ago
These blanket statements don’t apply to everyone. It depends which Ubiquiti hardware you own and how you’ve configured it.
For example, I run the UniFi controller on my FreeNAS server. There are no forced updates to it. It doesn’t update unless I update it. The firmware on my APs doesn’t update unless I update them from my controller.
- ncphil 6y agoAgreed. My only gear is an EdgeRouter-4. Unlike the Mikrotik it replaced you have go up, find the latest fw file, download and install (that Mikrotik router wasn't designed to handle 1 Gbps and at the time the next step up cost more than the ER).
- lucb1e 6y agoSo unless it hits news channels major enough that you hear about it or there is a bug that you isolate to be due to outdated firmware, you probably won't ever patch security issues in your edge (outside-facing) router?
- ncphil 6y agoI've got a recurring calendar item that prompts me to go up and check for updates every week, and I do what it says because after over 25 years in sysadmin I _know_ that the first time I ignore it I'm going to get stung. With Mikrotik I originally had auto update turned on, but later had a script that emailed me when an update was available (so I could schedule a manual update a couple of days later after checking the forums for anything apocalyptic).
- izacus 6y agoUnless you're manually verifying the content of your AP firmware updates (which is a bit hard since they're closedsource), I don't understand what you're trying to say. The firmware could be compromised at the source so your FreeNAS doesn't help at all when you download and apply a compromised firmware update. Unless you're not updating your APs and keeping them vulnerable in that way :)
- js2 6y agoI was addressing "attackers might have gained control of the update infrastructure allowing them to push out malicious firmware to your devices." In my case, no, they cannot push anything to my devices. Obviously, I could pull down compromised firmware. But that's always a risk with software that I don't personally verify, which is like 99.9% of software. As a side note: obviously this security incident doesn't give me a whole lot of confidence in how they run their systems, but at no point has it been alleged that Ubquiti's firmware updates have been tampered with.
- lucb1e 6y agoSo it's a game of luck, depending on whether you updated your firmware? I would call that "affected" rather than "unaffected". Just because not everyone installs security patches within a few months after they come out (it says the breach had been ongoing for two months) doesn't mean that therefore it doesn't apply to everyone. In the strict sense, indeed not everyone will have been compromised, but it totally applies to you in the sense that through business as usual (assuming that includes installing security updates), you can be compromised.