12 ms·

This is about of straightforward as a "I screwed up, I own it, I apologize" Everyone makes mistakes. Some of the good work Krebs has done seems to be complete

This is about of straightforward as a "I screwed up, I own it, I apologize" Everyone makes mistakes. Some of the good work Krebs has done seems to be completely overshadowed by a mistake here. Granted, this is probably in response to some legal action either in progress or already settled, but what more do you want from the guy?

kspacewalk2 4y ago
> This is about of straightforward as a "I screwed up, I own it, I apologize" "A source provided info. Source is now discredited. I thus no longer trust the info." That's the gist of the apology. But that's neither here nor there, it does not show understanding of the fact that his reputation was deliberately used for criminal purposes.
- InTheArena 4y ago
  "This time, I missed the mark and, as a result, I would like to extend my sincerest apologies to Ubiquiti, and I have decided to remove those articles from my website." I think that's reasonable.
  - atyppo 4y ago
    That seems like a statement not written by a lawyer. It’s possible he’s concerned about legal ramifications
    - InTheArena 4y ago
      I would be too. Millions of dollars where lost because he was a unwitting accomplice to a extortion scheme. But lowering the bar to say "I'm sorry" when someone is obv incorrect is still a good thing.
    - flutas 4y ago
      He is being sued by them for $425,000 in damages. Last update on the court case was a request for an extension due to them trying to finalize a settlement, I suspect this was part of that settlement.
cthalupa 4y ago
>but what more do you want from the guy? By the time the December story was published, it seems that Krebs knew full well that his source was the person implicated in the crime to begin with. I would like to understand why he thought it was responsible to press forward while obfuscating this fact, and how he will handle similar situations moving forward. His thought process there will help inform me as to whether or not I can personally take him seriously on things of this nature in the future. As it stands, I don't know if he learned anything from this, or if he still thinks that people that very well might have perpetrated the crime he's reporting on are reputable sources that he should post information from without question or disclaimer and the only reason this is posted is because he settled in court.
- nibbleshifter 4y ago
  many of Krebs's sources are criminals, often dropping their competitors info in Brian's lap as a way to get ahead. Brian's a willing and witting participant in this behaviour, even encourages it, because it gives him more stories.
  - Werewolf255 4y ago
    Yeah, this reflects my views too. He's using the veneer or pretext of journalism and reporting the truth in order for him to cover sloppy sourcing.
    - JumpCrisscross 4y ago
      > sing the veneer or pretext of journalism and reporting the truth in order for him to cover sloppy sourcing Getting tips from criminals is not sloppy sourcing. There is verification that obviously failed here. We likely won't hear the full story until the prosecution and litigation cycles have turned.
      - cthalupa 4y ago
        To me, the issue isn't really that the source in question is a criminal - I think they might be a bit less reliable than the average person, but as others have noted, general people are pretty unreliable too. But the fact that the source was also the person who has allegedly perpetrated the crimes going unmentioned and not being disclaimed to me is sloppy - even if there was additional verification done, if you are mentioning this source as the cornerstone of your article, I want to know about the vested interests that source has. Obviously, being the person that allegedly did it means you have A LOT of vested interest in how it is covered and what is revealed. If you want to talk yourself up and brag about it (which seems to be a given if you are telling a journalist about something you allegedly perpetrated) it is totally reasonable for people to be suspicious about how much is fact and how much is fiction. Humans like to exaggerate when talking themselves up.
acoard 4y ago
>Everyone makes mistakes. Fully agree, which is why I said the same thing. :) >Granted, this is probably in response to some legal action either in progress or already settled, but what more do you want from the guy? As I said in my post, a stated awareness that he was used in a cyber blackmail scheme, and at least some nominal promise to try and be aware of that in the future. The difference here is between "I made an honest mistake" and "I was taken advantage of and used unwittingly in a scheme." I'm not interested in him self-flagellating and begging for forgiveness, as my concern is totally forward-looking. I believe this type of problem will come again, of people trying to unwittingly use his reputation to push certain agendas. If he isn't aware of that dimension of the problem then it's likely it will re-occur. That being said, your point about this post made in a legal context is totally fair and had slipped my mind. I can imagine any apology/statement/etc getting neutered by lawyers for perfectly rational reasons.
- oaiey 4y ago
  Saying that he was part of the blackmail scheme would make him maybe target of legal actions from Ubiquiti. So .. that you will not get. He has to do the same company-lingo like they all do after screwups.
  - tssva 4y ago
    He was/is the target of legal action from Ubiquiti. I assume this statement is part of some settlement he has reached with them regarding the legal action.
    - asdfasgasdgasdg 4y ago
      Complaint: https://storage.courtlistener.com/recap/gov.uscourts.vaed.521759/gov.uscourts.vaed.521759.1.0.pdf https://storage.courtlistener.com/recap/gov.uscourts.vaed.52... I remember at the time we were discussing the misreporting I noted that Krebs’ lack of retraction could come back and bite him. It’s interesting to see it now. It’s also interesting to note that it is referenced in point 11 of the lawsuit. A little remorse goes a long way, and pride can be expensive.
stickfigure 4y ago
> what more do you want from the guy? He's a guy who writes about hacks. He got "hacked". At the very least I am curious to know more of the story.
- encryptluks2 4y ago
  If you can call it that. Seems more like a convenient excuse.
  - tunap 4y ago
    He was duped by a con man. Everyone is susceptible to SE, even smart guys like Brian. A case can be made that it is the most difficult challenge/vector in cyber security. https://en.wikipedia.org/wiki/Social_engineering_(security) https://en.wikipedia.org/wiki/Social_engineering_(security)
    - encryptluks2 4y ago
      Seems more like he was willfully played and that Ubiquiti lawyers can show negligence on his part which would not be a good look for a security researcher.
fnordpiglet 4y ago
If I were ubiquiti management or shareholder I would want a pound of flesh, and I expect their lawyers will be pursuing that.
- sxates 4y ago
  They are: https://www.courtlistener.com/docket/63197557/ubiquiti-inc-v-krebs/ https://www.courtlistener.com/docket/63197557/ubiquiti-inc-v...
ineptech 4y ago
> what more do you want from the guy? "This has taught me that my platform can be weaponized by any bad actor who can fool or manipulate me. One column from me could get a CISO fired or move a Fortune 500 company's stock price. That's a heavy responsibility that I wasn't really accounting for, but now that I understand it, I've put some thought in to it and I have made some changes that I hope will harden me and my platform against this kind of social engineering attack."
- fomine3 4y ago
  I'd like to see this, like a tech corps security incident explaination. Though I don't expect such statements from journalists.
ajross 4y ago
The timing doesn't support that take, though. Nikolas Sharp (the sole source for these stories) was arrested almost a year ago. Krebs knew then that his source was tainted, and he did nothing. Instead he waited until he was months into litigation with Ubiquity (which he's almost sure to lose) to try to backpedal. That's just a straight up violation of journalistic ethics. I think it's very reasonable to demand that our reporters in the security community be clear about their sourcing and prompt about corrections. A "what more do you want from the guy" implies that we shouldn't hold his past actions to account. And... we should. We absolutely should.
danso 4y ago
I would've like to see some explanation for how Krebs fell for this ruse, such as why this single-sourced claim was convincing enough to him to do a series of articles that apparently did serious material harm to Ubiquiti. And at least a few specifics of the key information that Krebs now believes to be faked. Just because his source has been indicted for alleged false info to the press doesn't mean that everything this source gave Krebs is automatically fake. In other words, what claims in the indictment, relating to which evidence the source gave to Krebs, leads Krebs to believe that that evidence is completely unreliable -- and how much, if any, doubt/scrutiny did Krebs give that evidence before this indictment? It doesn't have to be written in the tone of CYA excuses. The angle is: this is how I got fooled, and these are the lessons I've learned going forward. As Krebs writes in his mea culpa: "I always endeavor to ensure that my articles are properly sourced and factual." Okay, so why didn't that happen here? Is it one-time bespoke situation, i.e. a perfect storm of mistakes? Or was it because of standard practices that he now sees as insufficient for these kinds of stories going forward?
- system2 4y ago
  I agree, maybe "how he fell for this" part is related to some legal constrictions. I personally dislike this type of apologies which is very commonly used by corporates.
Hamuko 4y ago
I'm not really sure if he's owning it. This post has not made it to his Twitter feed, unlike most of the other recent stories. They're probably not automated, so I wouldn't expect it to be there immediately, but I kinda feel like he wants it to just quietly go away if he doesn't mention it there as well. https://twitter.com/briankrebs https://twitter.com/briankrebs
initplus 4y ago
Brian is a journalist more than he is a security researcher, anything he publishes as a journalist should be held to held to a higher standard than an random person just speaking their mind. He had ample opportunity to get out ahead and issue a retraction of the story when it was known to be false, well before the Ubiquiti lawsuit.

kspacewalk2 4y ago

> This is about of straightforward as a "I screwed up, I own it, I apologize" "A source provided info. Source is now discredited. I thus no longer trust the info." That's the gist of the apology. But that's neither here nor there, it does not show understanding of the fact that his reputation was deliberately used for criminal purposes.

InTheArena 4y ago
"This time, I missed the mark and, as a result, I would like to extend my sincerest apologies to Ubiquiti, and I have decided to remove those articles from my website." I think that's reasonable.
- atyppo 4y ago
  That seems like a statement not written by a lawyer. It’s possible he’s concerned about legal ramifications
  - InTheArena 4y ago
    I would be too. Millions of dollars where lost because he was a unwitting accomplice to a extortion scheme. But lowering the bar to say "I'm sorry" when someone is obv incorrect is still a good thing.
  - flutas 4y ago
    He is being sued by them for $425,000 in damages. Last update on the court case was a request for an extension due to them trying to finalize a settlement, I suspect this was part of that settlement.

cthalupa 4y ago

>but what more do you want from the guy? By the time the December story was published, it seems that Krebs knew full well that his source was the person implicated in the crime to begin with. I would like to understand why he thought it was responsible to press forward while obfuscating this fact, and how he will handle similar situations moving forward. His thought process there will help inform me as to whether or not I can personally take him seriously on things of this nature in the future. As it stands, I don't know if he learned anything from this, or if he still thinks that people that very well might have perpetrated the crime he's reporting on are reputable sources that he should post information from without question or disclaimer and the only reason this is posted is because he settled in court.

nibbleshifter 4y ago
many of Krebs's sources are criminals, often dropping their competitors info in Brian's lap as a way to get ahead. Brian's a willing and witting participant in this behaviour, even encourages it, because it gives him more stories.
- Werewolf255 4y ago
  Yeah, this reflects my views too. He's using the veneer or pretext of journalism and reporting the truth in order for him to cover sloppy sourcing.
  - JumpCrisscross 4y ago
    > sing the veneer or pretext of journalism and reporting the truth in order for him to cover sloppy sourcing Getting tips from criminals is not sloppy sourcing. There is verification that obviously failed here. We likely won't hear the full story until the prosecution and litigation cycles have turned.
    - cthalupa 4y ago
      To me, the issue isn't really that the source in question is a criminal - I think they might be a bit less reliable than the average person, but as others have noted, general people are pretty unreliable too. But the fact that the source was also the person who has allegedly perpetrated the crimes going unmentioned and not being disclaimed to me is sloppy - even if there was additional verification done, if you are mentioning this source as the cornerstone of your article, I want to know about the vested interests that source has. Obviously, being the person that allegedly did it means you have A LOT of vested interest in how it is covered and what is revealed. If you want to talk yourself up and brag about it (which seems to be a given if you are telling a journalist about something you allegedly perpetrated) it is totally reasonable for people to be suspicious about how much is fact and how much is fiction. Humans like to exaggerate when talking themselves up.

acoard 4y ago

>Everyone makes mistakes. Fully agree, which is why I said the same thing. :) >Granted, this is probably in response to some legal action either in progress or already settled, but what more do you want from the guy? As I said in my post, a stated awareness that he was used in a cyber blackmail scheme, and at least some nominal promise to try and be aware of that in the future. The difference here is between "I made an honest mistake" and "I was taken advantage of and used unwittingly in a scheme." I'm not interested in him self-flagellating and begging for forgiveness, as my concern is totally forward-looking. I believe this type of problem will come again, of people trying to unwittingly use his reputation to push certain agendas. If he isn't aware of that dimension of the problem then it's likely it will re-occur. That being said, your point about this post made in a legal context is totally fair and had slipped my mind. I can imagine any apology/statement/etc getting neutered by lawyers for perfectly rational reasons.

oaiey 4y ago
Saying that he was part of the blackmail scheme would make him maybe target of legal actions from Ubiquiti. So .. that you will not get. He has to do the same company-lingo like they all do after screwups.
- tssva 4y ago
  He was/is the target of legal action from Ubiquiti. I assume this statement is part of some settlement he has reached with them regarding the legal action.
  - asdfasgasdgasdg 4y ago
    Complaint: https://storage.courtlistener.com/recap/gov.uscourts.vaed.521759/gov.uscourts.vaed.521759.1.0.pdf https://storage.courtlistener.com/recap/gov.uscourts.vaed.52... I remember at the time we were discussing the misreporting I noted that Krebs’ lack of retraction could come back and bite him. It’s interesting to see it now. It’s also interesting to note that it is referenced in point 11 of the lawsuit. A little remorse goes a long way, and pride can be expensive.

stickfigure 4y ago

> what more do you want from the guy? He's a guy who writes about hacks. He got "hacked". At the very least I am curious to know more of the story.

encryptluks2 4y ago
If you can call it that. Seems more like a convenient excuse.
- tunap 4y ago
  He was duped by a con man. Everyone is susceptible to SE, even smart guys like Brian. A case can be made that it is the most difficult challenge/vector in cyber security. https://en.wikipedia.org/wiki/Social_engineering_(security) https://en.wikipedia.org/wiki/Social_engineering_(security)
  - encryptluks2 4y ago
    Seems more like he was willfully played and that Ubiquiti lawyers can show negligence on his part which would not be a good look for a security researcher.

fnordpiglet 4y ago

If I were ubiquiti management or shareholder I would want a pound of flesh, and I expect their lawyers will be pursuing that.

sxates 4y ago
They are: https://www.courtlistener.com/docket/63197557/ubiquiti-inc-v-krebs/ https://www.courtlistener.com/docket/63197557/ubiquiti-inc-v...

ineptech 4y ago

> what more do you want from the guy? "This has taught me that my platform can be weaponized by any bad actor who can fool or manipulate me. One column from me could get a CISO fired or move a Fortune 500 company's stock price. That's a heavy responsibility that I wasn't really accounting for, but now that I understand it, I've put some thought in to it and I have made some changes that I hope will harden me and my platform against this kind of social engineering attack."

fomine3 4y ago
I'd like to see this, like a tech corps security incident explaination. Though I don't expect such statements from journalists.

ajross 4y ago

The timing doesn't support that take, though. Nikolas Sharp (the sole source for these stories) was arrested almost a year ago. Krebs knew then that his source was tainted, and he did nothing. Instead he waited until he was months into litigation with Ubiquity (which he's almost sure to lose) to try to backpedal. That's just a straight up violation of journalistic ethics. I think it's very reasonable to demand that our reporters in the security community be clear about their sourcing and prompt about corrections. A "what more do you want from the guy" implies that we shouldn't hold his past actions to account. And... we should. We absolutely should.

danso 4y ago

I would've like to see some explanation for how Krebs fell for this ruse, such as why this single-sourced claim was convincing enough to him to do a series of articles that apparently did serious material harm to Ubiquiti. And at least a few specifics of the key information that Krebs now believes to be faked. Just because his source has been indicted for alleged false info to the press doesn't mean that everything this source gave Krebs is automatically fake. In other words, what claims in the indictment, relating to which evidence the source gave to Krebs, leads Krebs to believe that that evidence is completely unreliable -- and how much, if any, doubt/scrutiny did Krebs give that evidence before this indictment? It doesn't have to be written in the tone of CYA excuses. The angle is: this is how I got fooled, and these are the lessons I've learned going forward. As Krebs writes in his mea culpa: "I always endeavor to ensure that my articles are properly sourced and factual." Okay, so why didn't that happen here? Is it one-time bespoke situation, i.e. a perfect storm of mistakes? Or was it because of standard practices that he now sees as insufficient for these kinds of stories going forward?

system2 4y ago
I agree, maybe "how he fell for this" part is related to some legal constrictions. I personally dislike this type of apologies which is very commonly used by corporates.

Hamuko 4y ago

I'm not really sure if he's owning it. This post has not made it to his Twitter feed, unlike most of the other recent stories. They're probably not automated, so I wouldn't expect it to be there immediately, but I kinda feel like he wants it to just quietly go away if he doesn't mention it there as well. https://twitter.com/briankrebs https://twitter.com/briankrebs

initplus 4y ago

Brian is a journalist more than he is a security researcher, anything he publishes as a journalist should be held to held to a higher standard than an random person just speaking their mind. He had ample opportunity to get out ahead and issue a retraction of the story when it was known to be false, well before the Ubiquiti lawsuit.