22 ms·
Former Ubiquiti employee charged with stealing data and extorting company
- eatonphil 5y agoDid Ubiquiti have any statement on this? I haven't noticed it in any of the news articles nor on their site.
- oars 5y agoUbiquiti's stock price (NYSE: UI) dropped by over 25% from $380 to $290 during the week following news of its breach. That's almost $5 billion wiped off the company's market capitalisation because of this employee.
- hedora 5y agoI’m shocked it hasn’t bounced back yet!
- bitexploder 5y agoSome times these events (not security specifically) simply mask a market correction or trigger it. I have been in infosec a long time now and historically security incidents have rarely moved a stock price. Maybe temporarily, but it tends to bounce back after a year. Look at the massive Home Depot breaches from a while back for example. Perhaps consumers are less forgiving if it happens to a tech company.
- deleted 5y ago[deleted]
- InTheArena 5y agoSupply chain issues may be the bigger issue now.
- zamadatix 5y agoProbably could have been a lot less and/or recovered by now had Ubiquiti not also gone through great lengths to cover it up and actively avoid taking appropriate mitigation action. https://krebsonsecurity.com/2021/03/whistleblower-ubiquiti-breach-catastrophic/ https://krebsonsecurity.com/2021/03/whistleblower-ubiquiti-b... I mean Nick Sharp certainly took a chunk out of them but there is more to the story for why the market lost that much faith.
- scrollbar 5y agoBut the Krebs article was based off statements by an anonymous whistleblower “Adam” - Nick Sharp himself, to further extort the company. Hard to know what is actually true in that article at this point
- function_seven 5y agoWait, is Brian's source for that article Nick Sharp himself? If so, then I don't know what to take away from that article. Try re-reading it, but replacing every instance of "Adam", with "Nick" and see how it comes across. I'd love to see Krebs follow up on this.
- InTheArena 5y agoYou do realize that Brian Krebs source was Nick Sharp? At least according to the affidavit. And that he did this _after_ being investigated by the FBI? Krebs got played here.
- v77 5y agoLOL, this is literally covered in the article! Sharp was the source for this story! He was lying to try and cover his tracks! Krebs should probably take this story down.
- TedDoesntTalk 5y ago> SHARP used a virtual private network service that he subscribed to from a company named Surfshark to mask his Internet Protocol (“IP”) address when he accessed Company-1’s AWS and GitHub infrastructure without authorization. How did they know it was SurfShark?
- blitzar 5y agoWhich discount code did he use? Use CYBERWEEK19 for 85% your first years subscription.
- egberts1 5y agoPresumably with an IP log by a router/IDS/ENS at the corporate or ISP level.
- vytvy 5y agoFYI, the policy to delete logs, just deletes them from your aws account, but they are still accessable/recoverable from aws side if needed. So this guy, that worked as cloud lead in ubiquiti was stupid enough to think it will hide his traces by deleting logs :DD it might have worked if he deleted them in bare metal server itself,but in aws it just deletes from account/s3, but can be recovered by AWS support. so this is how they got all the logs and found that it was him that logged in with his own aws user, and ip address from surfshark.
- jimsparkman 5y agoWow, quite brazen. What an interesting read. Couple things that stood out to me was that the incident occurs in December and the raid ensues March 24th, so roughly 3 months. Building the case I presume. Then after the raid, the accused doubles down and seeds fake news stories.
- ocdtrekkie 5y agoIt sounds like he got caught because his VPN dropped during some sort of outage. It's funny because I feel like "don't do crime from your home network" should be an incredibly obvious concept.
- anonu 5y agoHe also used keys as the "attacker" that were known to be his as a regular employee. That seems like a n00b move.
- blitzar 5y agoSo he litterally signed the attack with his PGP key.
- kadoban 5y agoI can't imagine just using some random VPN is really going to help much anyway. When the cops come knocking they're just going to give you up right?
- djweis 5y agoPerhaps Ubiquiti could use those savings to operate a support department.
- fastball 5y agoWhich savings? They lost $4B in market cap.
- deleted 5y ago[deleted]
- maccolgan 5y agoMarket cap is monopoly money, it doesn't mean anything.
- fastball 5y agoAlas not true. The higher your market cap, the more money you can raise by printing more stocks.
- astrange 5y agoTheoretically it would go down if you did that. In practice it seems to go up if people like you.
- Thorrez 5y ago>Theoretically it would go down if you did that. Why? If a company prints a single stock then sells it for $100, I would expect the company's market cap to go up by $100 since it now has $100 more dollars in its bank account.
- xwolfi 5y agoBecause the company printing a single stock is already a signal it is worth a little bit less. If you have N stock for capital valuation $V, each stock is worth $V/N. If you emit one more, you basically need either to argue your company total valuation should rise or you dilluted all stock to be worth now $V/(N+1). The company valuation is not stock price * stock count, which is your confusion, it's more tangible asset + speculative future assets, so the more stock you emit the less they each is worth. Companies become popular by doing stock buyback (increasing each remaining stock individual value). Market cap, which is the stuff they do for amateur and children, to multiply stock count by stock price, is entirely meaningless because it ignores value when stocks were actually transacted and liquidity. If you emit a million stock at 0.1c and then create a marketing fad while locking the supply in the hands of a few and refuse to sell, you create a huge gap between low supply and high demand, increasing the individual price manyfold, arriving at a huge market cap... but you paid nothing for most stocks and a few people paid a LOT for a little. In investment banking we use volume weighted average price to try to get a view of what's the short term intraday value of a stock instead. Imagine, I dont know, a crypto asset with a market cap of a trillion and a single individual owning 1/21 of the entire asset pool, if this single individual signal just one token sale, the entire market starts selling to people who dont want to buy anymore: what is then the value of considering the market cap ? It can go to 0 tomorrow just if demand disappear. Basically you need to include liquidity, a metric of the stability of the supply and demand, that's why I prefer to look at earnings per share to evaluate a company, it is way more significative of what you just bought. For a crypto asset it's 0 for instance.
- xt00 5y agoYea quite the playbook there... ransom the company pretending to be a hacker, then pretend to be a whistleblower saying the company is burying the fact that the company is being ransomed..
- akersten 5y agoDamn. I remember reading about the original "hack" here and getting very concerned about the level of access ascertained by the attacker. I'm almost relieved it was a foolishly clumsy inside job and some of the initial hypotheses about rogue nation state root access to UI devices did not materialize. Brazen, indeed, for him to also have been on the team tasked with cleaning it up.
- phnofive 5y ago> At one point during the exfiltration of Company-1 data, SHARP’s home IP address became unmasked following a temporary internet outage at SHARP’s home. This seems to explain how this comes down after less than a year since the incident. Surfshark now supports an outage related kill switch, not sure if that's a new feature.
- rmahan 5y agoSeems like he probably would have been caught either way, but would have costed and taken longer if he didn’t drop his VPN. Being one person in a closed room of people knowing about the ransom, and using PayPal over crypto to pay for a VPN seems like it would leave a trail. Eventually would’ve narrowed it down, hopefully. Edit: oh, and using his own keys that were tied to him as an employee while he was being the attacker.
- stefan_ 5y agoWhen you ask for Bitcoin in the ransom note but paid your VPN with Paypal.
- mjamil 5y agoMr. Sharp is apparently not so sharp. He carried out the attack from his home network. He connected directly for enough time that his bare IP was logged. The rest of the time, he carried out the attack using a commercially purchased VPN solution that was trivial to trace back to him via the purchase record. He lied to the FBI. (I have yet to understand why people talk to law enforcement instead of staying silent so as to not implicate themselves.) And, for no apparently good reason (meaning, there's no claim of him shorting the stock), after the raid, he seeded fake news that drove the company's stock down 20%.
- 1cvmask 5y agoGuess he should have bought a VPN with cash or stole someone else’s if Mr. Sharp wanted to be more sharp about it.
- trhway 5y ago>SHARP falsely stated, in part and substance, that someone else must have used his PayPal account to make the purchase. and to me it looks like somebody intentionally left breadcrumb trail leading to the guy. With cloud paying so nice these days nobody is going to risk that way for the paltry $2M (ie. less than 3-4 years earnings in Bay Area for the people like this). It looks like the stock price drop is the real "follow the money" trailhead, and that doesn't lead to the guy. And given that it were about Ubiquiti customer databases - the value of [stealth] access to those customers may possibly dwarf those few billions of valuation drop - so even the stock drop may have been a smoke screen. I mean Ubiquiti as a target reminds me of SolarWinds. Those comments back then is also interestingly predictive https://news.ycombinator.com/item?id=26692987 https://news.ycombinator.com/item?id=26692987 - having a fall back guy kind of absolves the company from architectural and operational sins which allowed the hack and pacifies the customers who otherwise would feel unease of being possibly hacked by somebody serious.
- 1cvmask 5y agoYes your point is valid. It doesn’t seem that they did find any unusual shorting activity though as is or used to be how they went about it in the old days.
- eganist 5y agoTangential: there's a James Margolin listed as one of the contacts, and he looks vaguely like he could be a parent or uncle of one Grant Margolin, and they're both roughly local to NYC-ish based on James' LinkedIn. I wonder if there's any relation. Grant Margolin being one of the co-conspirators behind Fyre fest, along with Billy McFarland. I had the dubious privilege of interacting with the two in DC alongside Ja Rule as part of a Magnises event.
- LiquidPolymer 5y agoI've always been fascinated by the idea that intelligence lies within a spectrum. Someone might be incredibly smart about a narrow topic or field, yet be blind to their own stupidity within another realm. To me, this seems like a classic example. To quote the press release: "During the execution of that search, SHARP made numerous false statements to FBI agents, including, among other things, in substance, that he was not the perpetrator of the Incident and that he had not used Surfshark VPN prior to the discovery of the Incident. When confronted with records demonstrating that SHARP purchased the Surfshark VPN service in July 2020, approximately six months prior to the Incident, SHARP falsely stated, in part and substance, that someone else must have used his PayPal account to make the purchase." This man was a senior developer yet this quote sounds like it comes from a nine year-old. Not to mention "hire a lawyer, don't talk to the police" has always been pretty solid advice. He now faces significant prison time, and the strong potential for a dismal life.
- rodgerd 5y ago> This man was a senior developer yet this quote sounds like it comes from a nine year-old. Tech has a contempt culture problem, and this can be one manifestation of it: feeling that being moderately bright about getting computers to do things makes you a tremendous intellect, and everyone else around you an easily hoodwinked moron. Perhaps the most extreme example was Hans Reiser. Anyone who followed the twists and turns of the case against him for murdering his wife will remember how many trivially disproved lies he told, apparently under the illusion that he was a mastermind who could put one over on the courts based on his faulty understanding of ideas like reasonable doubt.
- SilasX 5y agoYes, and I remember Reiser having rejected a plea deal whereby he'd only serve 3 years, which is just about winning the lottery when it comes to being prosecuted for murder: https://www.theregister.com/2008/07/10/reiser_rejected_voluntary_manslaughter_plea/ https://www.theregister.com/2008/07/10/reiser_rejected_volun...
- devonkim 5y ago
- bithavoc 5y agoA quick search revealed a LinkedIn profile[0] of a previous Ubiquiti employee, he seemed to have left the company in March 2021. I wonder what was first, he quitting his job at Ubiquiti or the FBI Raid. [0] https://www.linkedin.com/in/nickolassharp https://www.linkedin.com/in/nickolassharp
- z80x86 5y agoBrian Krebs’ article interviewing the whistleblower took this to DEFCON 1 for Ubiquiti. It’s really crazy how Mr. Sharp was able to trick all of his victims. https://krebsonsecurity.com/2021/03/whistleblower-ubiquiti-breach-catastrophic https://krebsonsecurity.com/2021/03/whistleblower-ubiquiti-b...
- InTheArena 5y agoBrian Kreb's role in this is, at best, unwitting accomplice. Not victim.
- Ice_cream_suit 5y ago" SHARP subsequently re-victimized his employer by causing the publication of misleading news articles about the company’s handling of the breach that he perpetrated, which were followed by a significant drop in the company’s share price associated with the loss of billions of dollars in its market capitalization."
- ex_ubiquiti 5y agoEx-Ubiquiti employee here. Nick Sharp wasn't just a senior software engineer. He was the Cloud Lead and ran the whole cloud team. His LinkedIn profile will confirm it. This is why he had access to everything. Nick had his hands in everything from GitHub to Slack and we could never understand why or how. He rose to power in the company by claiming to find a vulnerability that let him access the CEO's personal system, but nobody I spoke to ever knew what the vulnerability was. I discussed this with another ex-Ubiquiti person in an old thread [1] Now I'm positive he faked the security issue as a power move, just as he faked this attack for extortion purposes. He would also harass people and use his control over Slack and GitHub against the people he didn't like. Many people left around this time partially because Nick made everything so difficult at the company. What a terribly depressing series of events. [1] https://news.ycombinator.com/item?id=26694945 https://news.ycombinator.com/item?id=26694945
- baskethead 5y agoIs this why Ubiquiti quality has fallen over the last ~2 years? I went all-in on Ubiquiti almost 3 years ago and I’ve been less than thrilled with the quality and level of support. This chaos that you say happened seems to line up with what I was seeing as a customer but everyone has been shocked at how UI has dropped in terms of quality.
- iYanderz 5y agoA lot of tech is suffering from quality issues in the past 2 years: We're in the middle of a global pandemic. Components are being stripped out left and right to meet demand, especially in the automotive sector. Ubiquiti is no different, and their store being constantly out of stock is a clear indicator of that. Personally, I would argue that Ubiquiti handled the pandemic much better than other companies. Take the Cloud Key firmware: Back when it was first released, the thing was so unstable it had to be reset every few weeks. Every firmware update required a factory reset. Nowadays, it's solid. Even flashing beta builds is a smooth, issue-free process. Features like person and vehicle detection in their Protect lineup are a much welcome addition, as is the revamp of the Protect app. All of this happened during the pandemic. I know people whine about how Ubiquiti unified everything under a global login, but come on.. if it works, it works. It's hardly a reason to bash Ubiquiti because you're upset you temporarily have to sign into ui.com. Now, maybe they are putting more effort into Protect than they are into the network side of things. I don't know, because I primarily use them for Protect. With that being said, I'm fairly satisfied.
- wnevets 5y agoSo that "hack" from a few months ago really wasn't a hack at all, it was an inside job?
- jeroenhd 5y agoHe could've prevent all of this by a) making sure his traffic was blackholed when the VPN went down and b) adding another layer from a free service (like TOR or a proxy or another VPN). He also should've been actively using the VPN so his traffic patterns wouldn't stand out as much, and so his purchase would be justifiable. If he really did buy the VPN 6 months ahead then he was a fool to leave the subscription dormant. If he wanted a fire and forget VPN subscription, he also could've bought the subscription with stolen credit cards. He would've had to make sure to only connect to the VPN through something like TOR, but credit card fraud is pretty difficult to trace if you do it right. Had he put in a little more thought and preparation then I still don't know if he would've gotten away with it, but at least he'd be in a better position. He wouldn't have to lie to the FBI agents and they probably would've had to catch him by going after the source of the place where the data was leaked instead. Opsec is hard, but this is just embarrassing for someone in the know trying to steal 50 bitcoin. I'm also not sure why he did it. Suddenly owning a few million in crypto would be noticed, unless he didn't spend any of it, ever. What was his plan, just quit his job and move away right after the hack?
- stef25 5y ago> he also could've bought the subscription with stolen credit cards Now they're looking at you from two angels. Instead of all this jumping through hoops with anonymous VPN and payment methods, why not just do it from Starbucks?
- blitzar 5y agoBecause the youtube videos I watch / podcasts I listen to say I NEED a VPN to keep my IP safe from being spied on. But also starbucks / any shop / cafe / restraunt / apple store - or going for a drive and finding an open WiFi. Kinda wondering now how these places all handle their wifi being abused for crimes ...
- adrr 5y agoWhy a stolen credit card? Just buy gift visa card with cash.
- teeray 5y ago> At one point during the exfiltration of Company-1 data, SHARP’s home IP address became unmasked following a temporary internet outage at SHARP’s home It’s interesting that that was what brought him down. I was going to guess a rogue log from the VPN provider until I got to that point.
- InTheArena 5y agoI do that that the media that breathlessly amplified this persons attack should learn from it. In particular, As much as I like and appreciate his reporting, Brian Krebs was the key person amplifying this message - which makes him a unwitting accomplice to many billions of dollars of damage to ubiquiti shareholders. Responsible disclosure exists for a reason.
- sneak 5y agoBrian Krebs isn't a good reporter or a good person. He has a history of doxxing people without basis (or for the basis of leaving bad reviews on his books). It disappoints me that he has the audience he does.
- BeefWellington 5y agoThis provides an excellent case study as well, as his original post on this doesn't seem to produce any corroboration at all, so the "reporting" boils down to: "I got an e-mail from someone making a bunch of claims, so I'll regurgitate those." Including an update/follow-up that was added later, by the same person. At best, it's shoddy journalism. He was taken for a ride and should bear some public shame for that. I doubt he'll get sued for it but a lot of people lost money because of him, so I wouldn't be surprised if someone tried.
- stef25 5y agoSource?
- tptacek 5y agoHe's a reporter. "Doxxing" isn't a thing in journalism, even though it upsets people on message boards to hear it.
- InTheArena 5y agodoxxing is doxxing. Don't care if the media think they are special.
- egberts1 5y agoNot the sharpest knife in the drawers.
- fencepost 5y agoThe things that really jumped at me looking at his LinkedIn profile were 1) job hopper and 2) lots of overlapping - perhaps it was all part time gigs but some of the overlap surprised me. I was shocked at the number of sub-year positions.
- blitzar 5y agoSame thing - and yet still in demand from some decent names in there. I thought it was meant to be hard out there in tech valley ?
- awill88 5y agoWhat an idiot
- bborud 5y agoAs a customer, the one thing I really want to know is whether or not the company is dealing with this in a manner that helps me decide if I should continue being a customer. Do they understand that they may need to fire the CEO given that the CEO probably is the weakest link here? Do they have sufficient liquidity and capital to invest in resetting the culture and hiring people who can turn this around?
- southerntofu 5y agoSo what's a good alternative to Ubiquiti hardware? Is there some guides/community for standard x86_64/arm64 computers and PCIe cards to be used as professional-grade routers and wifi access point at a low price range? Turris Omnia looks pretty cool but it's really too expensive for non-profits. Is OpenWRT or OPNSense the way to go? Or is there some more generic web dashboard you can run on any GNU/Linux or BSD system?
- virogenesis 5y agoHow about mikrotik, https://mikrotik.com/ https://mikrotik.com/ I am a satisfied user of their software (and hardware) for the past 10years. If you don't mind the rather rustic interface, it should be as closest to a professional grade cisco as you can get.
- southerntofu 5y agoI've successfully used Microtik hardware, but they are pushing for their own non-free software stack (RouterOS) and while they support pfSense, it seems pfSense itself has some shady practices. OPNSense only works on x86 so far and Microtik hardware is mostly ARM. I'd personally be interested in a hardware vendor supporting a free-software stack (but with an accessible price range), or an established software vendor (ideally a workers coop) maintaining an administration dashboard to setup on commodity hardware.
- iso1631 5y agoCertainly better than Juniper SRXs and Cisco Firepowers, however if you have a lot of mangle rules you'll run into issues. Had a large amounts of drops and even more reorders with just 600M going through a 1036 with c.200 mangle rules. Haven't run into any issues with Fortigates, yet. Time will tell. Thats for Firewall/nat/router style devices, for wireless we've got a large number of unify flying saucers. I've use mikrotik wireless in the past, but it's not on the same level at all.
- southerntofu 5y ago> Fortigates Are these running a free-software stack? Couldn't find info about it since fortinet website blocks Tor traffic.
- Maxburn 5y agoThis is why I think it is important to self host things and I applaud Ubiquiti for allowing UNMS/UISP to be self hosted for free. As far as I understand it our UNMS was never at risk from this problem.