3 ms·

Am I alone in thinking better of Ubiquiti through this? I remember when the original post came out and I was worried about having compromised gear at home. The

• izacus 5y ago
  No, you're not alone. In times where so-called journalists consistently churn out lying unverified articles we'd be well served if more of them faced any kind of consequences of publishing lies knowingly.
  • deleted 5y ago
    [deleted]
• joveian 5y ago
  Why do you think it means it was a non-issue? The employee could have sold credentials just as easily as anyone else.
  • zeagle 5y ago
    Thanks for making my defend my viewpoint. This isn't my field but my rationale in saying this is because their system was not externally breached and they also said no customer data was accessed or even targeted. That's reassuring in that I don't think my (home) hardware is in danger. I do have the log in from cloud with credentials feature turned off from that I recall and changed my local password. I think it's hard defend against an internal bad actor but you are right he could have sold hashes or left a backdoor or something. I do agree with the anti-SLAPP comments having read more about this since I posted that.
    • joveian 5y ago
      Thanks for describing your thinking. I'm also not an expert but read more about this stuff than most people. If you read carefully, Ubiquiti did not say that no customer data was accessed, they said they have no evidence that customer data was accessed. The first article Krebs wrote quotes the employee (likely the person arrested) saying that this was because they didn't keep logs long enough (this fact was confirmed in Ubiquiti's complaint). That it was the person accessing the data who was able get rid of logs showing the data accessed doesn't change the lack of logs. It was externally breached in the sense that an empoloyee downloaded the data from outside the company and could have done anything with it prior to being caught (and could potentially have it stashed somewhere for later use). Ubiquiti also never denied that legal overrode technical considerations in not forcing all accounts to be reset. The initial reporting was substantially correct and the post was updated when new information was available. https://krebsonsecurity.com/2021/03/whistleblower-ubiquiti-breach-catastrophic/ https://krebsonsecurity.com/2021/03/whistleblower-ubiquiti-b... One thing that might be slightly comforting for customers is that Ubiquiti claims in the March 31 update (linked from the first article and quoted in the last comment on that article) that customer data was never mentioned in negotiations, although that is a specific detail not just who accessed the data. There are potentially some theoretical reasons someone attempting economic sabatage as an empoloyee might be less likely to access customer data (e.g. the average attacker might be more likely to be in a legal jurisdiction where they are unlikely to ever face a judge while an employee in the US may want to be able to tell a judge that they didn't access customer data if they get caught), but I wouldn't count on that at all or make any distinction about what to do based on the employment status of the person who accessed the data (if employees stealing data were less likely to release customer data in gerneral they might decide to do so for no other reason than to look less like an employee stealing data). Sounds like you took reasonable steps. Most if not all companies are breached at times, a company that has no disclosed breaches almost certainly just has a policy of never disclosing them.