16 ms·
Ubiquiti developer charged with extortion, causing 2020 “breach”
- lukeholder 5y agoThe funny thing is that krebsonsecurity.com are the ones that published the false information in the first place. Good summary of the whole saga by Crosstalk youtube channel which covers mostly Ubiquiti: https://www.youtube.com/watch?v=paLm0tP5GbI https://www.youtube.com/watch?v=paLm0tP5GbI
- kyrra 5y agoI give Krebs a little credit here because the "whistleblower" from his original article was really an insider that was part of the investigation into the breach. Obviously this source was also the hacker, but knowing that was impossible. Now, I believe Krebs should at least acknowledge he made this mistake, sadly he hasn't here yet.
- someperson 5y agoFrom my cursory reading of Brian Krebs' blog, most posts seem written by a ghostwriter.
- unfolding 5y agowhat makes you think that?
- scoopertrooper 5y agoAll the references to ectoplasm.
- someperson 5y agoKrebs uses the word 'I' a lot, but the ghostwriter(s) do not.
- thesausageking 5y agoWait. So his big "whistleblower" source for this article in April was actually the hacker? https://krebsonsecurity.com/2021/04/ubiquiti-all-but-confirms-breach-response-iniquity/ https://krebsonsecurity.com/2021/04/ubiquiti-all-but-confirm... Bad on Krebs for not at least mentioning this.
- xwolfi 5y agoHe obv didnt know
- mynameisvlad 5y agoHe can still post a retraction/update on the original article. I mean, he added an update already from later in the month, and he clearly knows now.
- asymmetric 5y agoNot surprised TBH. Brian Krebs has a history of questionable ethical behavior, like doxxing people who leave negative reviews on his book[0]. [0]: https://itwire.com/security/infosec-researchers-slam-ex-wapo-man-krebs-over-doxxing.html https://itwire.com/security/infosec-researchers-slam-ex-wapo...
- travoc 5y agoIs identifying a real person by their internet pseudonym really doxxing?
- idealmedtech 5y agoPractically by definition, yes.
- SEJeff 5y agoKrebbs doxxed one of my friends who happens to be a gay hacker in a country where both being gay and being a hacker are illegal. Krebbs doesn’t take kindly to any sort of bad reviews or even the hint that he’s not perfect FYI.
- taf2 5y agoDamn that’s a really bad hire.
- deleted 5y ago[deleted]
- nottorp 5y agoSo... do the ubiquity things work again without being tied to their 'cloud'? Fake vulnerability or not, this is the worst part about their devices these days. Speaking of which, are there any semi-pro APs that still work without going through the vendor's servers?
- joelhaasnoot 5y agoMikrotik
- nklmilojevic 5y agoTP-Link EAP are decent for WiFi and for routers - Mikrotik.
- gvb 5y ago> So... do the ubiquity things work again without being tied to their 'cloud'? Ubiquity works without their "cloud" if you install their management software on your computer (I use a VM on my server). In my experience, you don't even have to run their management software once you have the network configured. If you are paranoid, install their s/w on a VM, set up your network, and then shut down the VM. You should bring up the management VM periodically for software updates, but otherwise it runs fine.
- rb666 5y agoNote that this also has the chance to be a security issue, the management software can run nightly software updates on your AP's, possibly closing flaws before your "periodical" manual efforts.
- nottorp 5y agoIt does? I have a UniFi and the old admin software just started up and let me admin the boxes. The new one wants me to register somewhere... Mind, I haven't checked in 6+ months. I just use the old software I still have on an older machine.
- chrisfinazzo 5y agoHmm, where have I seen this before... Oh, I know. Sergey Aleynikov says "Hi." His case was less about extortion, and more just grabbing what he could on the way out the door, but it was sloppy. Sharp obviously never learned Goldman Corp. Comm. Rule #1: "Don't talk to the press"
- throwoutway 5y agoHopefully this gets upvoted more but it somewhat repairs my view of Ubiquiti's brand now that more details have come out about what actually happened. I hope the courts will determine the full extent of the truth
- jolux 5y agoAren't they still serial and uncaring GPL violators?
- colechristensen 5y agoJust being practical here: who isn’t? That is companies that sell hardware with gpl code that actually respect the gpl well.
- jolux 5y agoMy $50 TP-Link router came with a card in the box explaining their GPL compliance and giving me a link to their changes. I would think if I'm going to blow hundreds on Ubiquiti gear, they could at least match TP-Link when it comes to actually following the law.
- bogwog 5y agoSource for this?
- jolux 5y agoLatest I can find is this thread: https://news.ycombinator.com/item?id=21450944 https://news.ycombinator.com/item?id=21450944 I’m not sure if it’s still ongoing, that’s why I asked if it was.
- MertsA 5y agoMy comment from back then stands. https://news.ycombinator.com/item?id=21451666 https://news.ycombinator.com/item?id=21451666 There's also some random community post here: https://community.amplifi.com/topic/3296/gpl-source-code-availability https://community.amplifi.com/topic/3296/gpl-source-code-ava... They're still in flagrant violation of the license for all the software they're stealing.
- cbsks 5y ago> Investigators say they were able to tie the downloads to Sharp and his work-issued laptop because his Internet connection briefly failed on several occasions while he was downloading the Ubiquiti data. Those outages were enough to prevent Sharp’s Surfshark VPN connection from functioning properly — thus exposing his Internet address as the source of the downloads. Ouch! Opsec is very easy to screw up.
- 41b696ef1113 5y agoWhat is the proper way to ensure 100% bulletproof VPN connections without leakage?
- artificialLimbs 5y agoIf you're going to commit multiple felonies: using coffee shop wifi instead of your home connection.
- sgjohnson 5y agoWhile wearing a hoodie and a face mask and probably some other accessories
- gruez 5y agolike this? https://www.freepik.com/free-photo/hacker-with-anonymous-mask_3361166.htm https://www.freepik.com/free-photo/hacker-with-anonymous-mas...
- JohnJamesRambo 5y agoNo like this. https://i.ytimg.com/vi/KEkrWRHCDQU/maxresdefault.jpg https://i.ytimg.com/vi/KEkrWRHCDQU/maxresdefault.jpg
- bigmattystyles 5y agoAnd don't buy a latte with a credit card
- niros_valtos 5y agoI wonder why the developer had access to so many resources on AWS and GitHub? Can’t these excessive permissions be removed? Why it was undetected for such long time?
- colechristensen 5y agoHe wasn’t just any dev but the cloud lead.
- LilBytes 5y agoAccounts and actions like this are easily managed in AWS GuardDuty since they were so foreign from the user benchmarks. Outside of the normal security standards you'd expect of next level monitoring from companies such as CrowdStrike. It took Ubiquiti weeks to notice these issues and he used the AWS root account, this account should be actively secured and alerted for abuse using AWS GuardDuty or similar. I've made my own top level comment raising where I have more questions than answers from this announcement.
- gruez 5y agoBut who configures AWS GuardDuty and who does it report to? Presumably the root account owner? In that case, wouldn't that be the cloud lead?
- deadbunny 5y agoAs a "cloud lead" equivalent I make sure I have as a little access as possible and all my (and everyone else's) actions are logged in an (as much as possible) immutable way. And if anyone managed to log into any AWS account with root credentials (MFA token stored in a safe) we get alerts in GuardDuty, Slack, and email within a couple of minutes. AWS provides all the tools to do this and it does not take that much work to implement. There is zero excuse for a company to allow cowboy shit like this.
- duxup 5y ago> Investigators say they were able to tie the downloads to Sharp and his work-issued laptop because his Internet connection briefly failed on several occasions while he was downloading the Ubiquiti data. Those outages were enough to prevent Sharp’s Surfshark VPN connection from functioning properly — thus exposing his Internet address as the source of the downloads. Not the first time I’ve read about a VPN unable to mask someone’s ip when they were on a wonky connection.
- NullPrefix 5y agoThis doesn't sound too good for VPN users
- XorNot 5y agoIt's an operating system issue. OS's are really difficult to give absolute invariants that you can trust. If network connectivity security is vital, then the only real solution is to setup your environment in a VPN or on a separate box that will lose the adapter routing info if it goes down.
- thakoppno 5y agoThere’s a huge gap in operational security for a hack of this size. At minimum, use a burner IP address and hardware from Craigslist.
- karmajunkie 5y agoit sounds like a misconfigured VPN to me, like he didn’t have the interface set to block traffic on failure.
- kobalsky 5y agoif a security tool lets the user shoot themselves on the foot it's a problem of the security tool not of the user.
- 5y ago
- gorgoiler 5y ago> Investigators say they were able to [subvert the attacker’s VPN] because his Internet connection briefly failed on several occasions while he was downloading the Ubiquiti data. Those outages were enough to expose his real address. Ahem, how convenient! Call me a paranoid Internet-forum dwelling cyber-loon, but that smells an awful lot like parallel construction. When the authorities log the start and end times of every TCP session at both ends they don’t need a VPN leak to correlate traffic corresponding to “GET /secrets” from the client with a response from the server. It feels like a disgruntled and sophisticated Ubiquiti employee is the last person who get caught out by a DNS leak while waiting for their VPN to come back up after a flap. On the other hand, I guess if you’re crazy enough to behave this criminally, you can be forgiven at least for not thinking straight in terms of opsec.
- dane-pgp 5y agoThat doesn't sound paranoid to me, especially as the US government has relied on the old "he made a mistake with his VPN" explanation before (against a target that is much better funded): https://www.wired.com/story/guccifer-elite-hackers-mistakes/ https://www.wired.com/story/guccifer-elite-hackers-mistakes/
- dannyw 5y agohe literally used his personal PayPal to pay for surfshark. no parallel construction imo.
- MertsA 5y agoI'm generally quite suspicious of lying law enforcement covering up evidence collected via illegal and inadmissible methods, but I doubt that's the case here. Rather than use Tor he decided to just wing it and use his personal consumer VPN that was paid for with his own PayPal account. He used his own credentials for the "hack" and didn't even come up with an excuse for how that could have plausibly happened other than "lol it was AWS that got hacked". >It feels like a disgruntled and sophisticated Ubiquiti employee is the last person who get caught out by a DNS leak while waiting for their VPN to come back up after a flap. If it was An-Cheng or Stig I'd agree but given a lot of what Ubiquiti puts out... the bar isn't all that high. Given all of the dumb moves we know he made, it doesn't really surprise me that he would screw up guarding against a VPN dropout. It wouldn't even surprise me if Surfshark screwed up blocking while reconnecting, especially if it was DNS I can see someone making a boneheaded decision to switch name resolution back to the local network while trying to reconnect to lookup the address of the VPN endpoint. It's a consumer VPN, they only really care about hiding from DMCA notices and evading geo-blocks. Now the Silk Road arrest of Ross Ulbricht on the other hand, that was a travesty of justice. Not that I think he was innocent or shouldn't be in prison, just that in a perfect world many of the prosecutors and federal agents involved would be in a cell beside him.
- LilBytes 5y agoFor me a company of their size and, what I would expect, maturity, this new announcement does not satisfy me or provide me much assurance. Consequently I am still happy I have been recommending people against Ubiquiti since the original announcement from Krebs. * Why was it so easy for a lead engineer to get access to a root AWS user without anyone else being notified? I.e. AWS GuardDuty provides FREE alerting for when an AWS root IAM account is logged in or used, this account should be under lock and key and when used, confirmed and audited by relevant persons or teams. Start edit/ * Furthermore on the root account being easily accessed, the root account in the companies I've worked at had MFA enabled, and the QR code is locked in a safe only accessible by two people agreeing it needs to be accessed in a break glass situation, where warranted. /End edit * Why was he also able to delete critical CloudTrail logs and reduce their retention to 1 day? I.e. These logs should be in a S3 bucket or other environment where such changes cannot be made. Alternatively, they should be shipped to a redundant service that manages this risk to prevent data deletion * Why did Ubiquti not announce they were compromised sooner? The hack started in early December, Ubiquiti noticed the compromise on Dec. 28. Ubiquiti told the market on January 11th. Is that a satisfactory turn around? Giving them some credit for the XMas break I'll say this partially understandable. All the AWS configuration I'm speaking of above, I would describe as Security 101. Most of these settings can be set and managed from AWS Organisations for free, and backed up with alarming and alerts for Guard Duty trivially. That a company of Ubiquiti's size and maturity had such basic risks not managed is still a concern. I understand AWS Organisations can be difficult to set up for legacy AWS accounts, but even with that said, setting the alarms and monitoring up that would help manage the risk associated to the questions above is not difficult and should have been in place. That Ubiqitui would only find relief ultimately from the developers poor OpSec rather than Ubiquiti's own security policies and procedures provides a commending perspective of their internal security posture.
- techdragon 5y agoWhile I agree this is demonstrative of overall less than adequate security practices, I’m unsurprised that a company that started with making hardware and only later added cloud functionality beyond a website/store was not initially setup as you described. What you described is the sort of setup I’ve been involved in the transition from what Ubiquiti has and what you just described, and it can be quite a lot of work to make that transition, if the industry involved didn’t have regulatory risk management drives, it’s entirely possible that it would have been considered more expensive than it was worth. Ubiquiti now has public evidence their security posture is inadequate and there will be pressure for them to demonstrate they have changed this situation. It’s very difficult to completely prevent malicious actors engaging in deliberate efforts to infiltrate and plan actions like this once they have any measure of access and trust. What matters now is how they respond to it.
- deleted 5y ago[deleted]
- paulpauper 5y agolol so much wrong with this: using surfshark talking to FBI being a terrible extortionist devising such a terrible way to make money
- paulpauper 5y agoIf he wanted 20 btc all he had to do was put up one of those shitty livestream YouTube scam videos that you always see (Elon Musk was a 2020 favorite). And he would not have been arrested either.
- Crazyontap 5y agoAlso 25 btc ransom. That's like 50k usd for such a big risk. Sort of like how they show a person trying to make enough to pay some medical bills or something.
- LordDragonfang 5y ago>Also 25 btc ransom. That's like 50k usd Uh, you might want to take another look at the current price of bitcoin. Even at the time, that was around 750k to 1mm USD.
- shbooms 5y agothe total amount he was asking for was actually 50 BTC, so around 2m USD. 25 for the data not be release and 25 for him to tell them about the "backdoor" he used to access their system.
- omnibrain 5y agoMakes me wonder if (at least some of) the posts dunking at the company leadership and the engineering in various comments around the internet had also been him.
- rainonmoon 5y agoI think there's a fair chance that whatever someone's mental/emotional state, if a workplace could motivate someone to act as extremely as he did, there are others similarly disenfranchised.
- rmbyrro 5y agoNo work culture is excuse to turning oneself into a criminal
- moooo99 5y agoIt may not be an excuse, but it could very well be an explanation
- rainonmoon 5y agoPlenty of whistleblowers would disagree.
- cjrp 5y agoWhistleblowing isn't a crime though?
- oleg_antonyan 5y ago2M - is this that much for a senior developer in well-known American company to risk his entire career?
- cjrp 5y agoNot to mention freedom
- deleted 5y ago[deleted]
- scandox 5y agoGiven how often we've seen people shooting the messenger in our field, we probably should save our commentary until the outcome of the trial. A lot of corporate leadership are extremely paranoid and that's why whistle blowing is such a dangerous activity. How strong do we all feel most digital evidence gathered really is? How much faith do we have in the technical knowledge of the investigators? Or the courts to parse this type of evidence?
- belter 5y agoThe indictment: https://www.justice.gov/usao-sdny/press-release/file/1452706/download https://www.justice.gov/usao-sdny/press-release/file/1452706... Side note: Free suggestion for a new startup. Make indictments pretty! What is it with all these fonts? Looks they really type this on a typewriter. Are all court clerks just frustrated novelists?
- mysterydip 5y agoI'm waiting for them to follow the footsteps of recipe writers. "It was a frosty December morning, much like the ones I spent with my grandfather up north in my childhood" Just show me the deposition!
- saalweachter 5y agoJust as long as they don't make you click through fifty digressing interstitials to get to the actual deposition.
- credittw2021 5y ago10 reasons the defendant is not guilty. You won't believe number 6!
- s_dev 5y ago>Free suggestion for a new startup. Not sure anything more than a browser extension would be needed.
- unfocused 5y agoAs someone who worked (still do) with the legal community and hundreds of lawyers, they are the hardest to change in order to modernize. It's slowly changing, but the older generation would use a bottle of ink and a feather to write if you gave them that. I'm not from the US, but have met folks from the US. Essentially, the law firms change and digitize, the older institutions such as the courts, will be the last as they are full of people that are much older (judges) than the general workforce, and to them, there is no incentive to change what works, and what is comfortable to them. Also, they are trained to argue. So you can't just go in there and easily change their mind. EDIT: They still love to print paper.
- afrcnc 5y agoduplicate: https://news.ycombinator.com/item?id=29411775 https://news.ycombinator.com/item?id=29411775
- biglost 5y agoBuy a really cheap smartphone, with a new sim card, go to some where without cameras (hard to find) and then use the vpn
- napkin 5y agoIf anyone is looking for the alternative to Ubiquiti since their fall from grace in recent years, I've found it to be HP Aruba. I always use more open source stuff for personal projects, but Aruba Instant On is what I commonly recommend/integrate for other people, whereas it used to be Ubiquiti. Solid design across hardware and software. It finds that unique balance in quality/usability between cheap/unreliable, and overcomplicated enterprise.
- jaywalk 5y agoDoes Aruba Instant On have anything comparable to the UniFi Dream Machine Pro?
- kyrra 5y agoMost pro's I watch (like: Lawrence Systems) don't like the UDM all that much due to lack of features. While you get a single pane-of-glass for managing the Wifi and Router, having some other product for a router tends to be better (PFSense or OpnSense). I've been running both for for 6+ years now and like it.
- jaywalk 5y agoThe only thing I've ever wished the UDM could do was change it's WAN MAC address, because I wanted to keep the same IP I'd had for years when I got it. No particular reason other than sheer nerdiness, but I got over it. Other than that, I've never wanted it to do something that it can't do.
- gonehome 5y agoIf convicted, I hope this guy spends a long time in prison - what an incredible ass. As a long time user of ubiquiti devices, I’m glad this was the actual story. It actually makes me feel a lot better since this kind of risk is extremely hard to defend against and unrelated to their hardware. Maybe a good time to buy some 2yr leaps.