5 ms·

Ubiquiti is trustworthy. Krebs jumped the gun on that accusation and apologized https://krebsonsecurity.com/2022/08/final-thoughts-on-ubiquiti/ https://krebso

Ubiquiti is trustworthy. Krebs jumped the gun on that accusation and apologized https://krebsonsecurity.com/2022/08/final-thoughts-on-ubiquiti/ https://krebsonsecurity.com/2022/08/final-thoughts-on-ubiqui...

bastardoperator 3y ago
If you're cool with the NSA backdoor that got leaked yesterday. https://news.ycombinator.com/item?id=37570407 https://news.ycombinator.com/item?id=37570407
- dylan604 3y ago
  Thanks. I thought I had recently seen the Ubiquity name in the headlines again after the Krebs debacle. I just didn't realize it was that recently.
- bbatha 3y ago
  That’s not ubiquity specific that’s all cavium based networking gear which is a substantial fraction of all networking gear. I’d be shocked if similar back doors aren’t present in other common network chips.
- criddell 3y ago
  For home security stuff? None of it will be exposed to the internet so I don't particularly care.
  - dylan604 3y ago
    Do you honestly believe that a now public NSA style backdoor will never be used by anyone that is not NSA? Of course goofy script kiddies will be using this to see what cameras are seeing and then do a range of things from posting embarrassing images to the web for the lulz or up to blackmailing people. that's with less than 3 seconds of thinking about what a vuln could do for non NSA types
    - criddell 3y ago
      I think having all of this stuff behind a firewall and not exposed to the internet makes a pretty big difference. If an attacker gets onto my LAN, it's game over. Mass produced consumer gear that is also perfectly secure probably doesn't exist. I assume everything I use has bugs and none of it will stand up to a dedicated attacker. As for blackmail, my cameras all point outward. I suppose they could threaten to report me to the HOA when my grass gets too long...
      - dylan604 3y ago
        and exactly what firewall hardware is being used so that you feel assured that it is also not prone to the same issue?
        criddell 3y ago
        I'm almost certain it does have the same issue. I don't believe there's any networking gear out there that is believed to be bug and exploit free now and expected to stay that way in the future. I believe a dedicated hacker could use the microphone and camera in my phone and laptop to spy on me. They could look at the street in front of my house. They could see my entire browser history, everything I've printed, every call I've made, everything I've said over email or text message.
- _jal 3y ago
  If you're not cool with it, where are you going to go? Cisco? https://www.tomshardware.com/news/cisco-backdoor-hardcoded-accounts-software,37480.html https://www.tomshardware.com/news/cisco-backdoor-hardcoded-a... Juniper? https://www.schneier.com/blog/archives/2021/09/more-detail-on-the-juniper-hack-and-the-nsa-prng-backdoor.html https://www.schneier.com/blog/archives/2021/09/more-detail-o... Huawei?
  - bastardoperator 3y ago
    I know OPNSense is using AMD Epyc(embedded) in their routers and that their software is open source. Maybe not enterprise enough, or too big for consumers, but I've been rocking the DEC3860 and it's been a really smooth ride. Is AMD compromised? It wouldn't surprise me...
- washadjeffmad 3y ago
  Since it's such an old report, it's most likely referring to Dual_EC_DRBG: https://en.wikipedia.org/wiki/Dual_EC_DRBG https://en.wikipedia.org/wiki/Dual_EC_DRBG So don't read the article as being about Unifi currently being backdoored by the NSA, but that the USG3 was one of the products using the Cavium/Marvell chips with the flaw that were being used globally in 2013 when the Snowden archive was released.
izacus 3y ago
Isn't that like 2nd or 3rd time he did that now?!

bastardoperator 3y ago

If you're cool with the NSA backdoor that got leaked yesterday. https://news.ycombinator.com/item?id=37570407 https://news.ycombinator.com/item?id=37570407

dylan604 3y ago
Thanks. I thought I had recently seen the Ubiquity name in the headlines again after the Krebs debacle. I just didn't realize it was that recently.
bbatha 3y ago
That’s not ubiquity specific that’s all cavium based networking gear which is a substantial fraction of all networking gear. I’d be shocked if similar back doors aren’t present in other common network chips.
criddell 3y ago
For home security stuff? None of it will be exposed to the internet so I don't particularly care.
- dylan604 3y ago
  Do you honestly believe that a now public NSA style backdoor will never be used by anyone that is not NSA? Of course goofy script kiddies will be using this to see what cameras are seeing and then do a range of things from posting embarrassing images to the web for the lulz or up to blackmailing people. that's with less than 3 seconds of thinking about what a vuln could do for non NSA types
  - criddell 3y ago
    I think having all of this stuff behind a firewall and not exposed to the internet makes a pretty big difference. If an attacker gets onto my LAN, it's game over. Mass produced consumer gear that is also perfectly secure probably doesn't exist. I assume everything I use has bugs and none of it will stand up to a dedicated attacker. As for blackmail, my cameras all point outward. I suppose they could threaten to report me to the HOA when my grass gets too long...
    - dylan604 3y ago
      and exactly what firewall hardware is being used so that you feel assured that it is also not prone to the same issue?
      - criddell 3y ago
        I'm almost certain it does have the same issue. I don't believe there's any networking gear out there that is believed to be bug and exploit free now and expected to stay that way in the future. I believe a dedicated hacker could use the microphone and camera in my phone and laptop to spy on me. They could look at the street in front of my house. They could see my entire browser history, everything I've printed, every call I've made, everything I've said over email or text message.
_jal 3y ago
If you're not cool with it, where are you going to go? Cisco? https://www.tomshardware.com/news/cisco-backdoor-hardcoded-accounts-software,37480.html https://www.tomshardware.com/news/cisco-backdoor-hardcoded-a... Juniper? https://www.schneier.com/blog/archives/2021/09/more-detail-on-the-juniper-hack-and-the-nsa-prng-backdoor.html https://www.schneier.com/blog/archives/2021/09/more-detail-o... Huawei?
- bastardoperator 3y ago
  I know OPNSense is using AMD Epyc(embedded) in their routers and that their software is open source. Maybe not enterprise enough, or too big for consumers, but I've been rocking the DEC3860 and it's been a really smooth ride. Is AMD compromised? It wouldn't surprise me...
washadjeffmad 3y ago
Since it's such an old report, it's most likely referring to Dual_EC_DRBG: https://en.wikipedia.org/wiki/Dual_EC_DRBG https://en.wikipedia.org/wiki/Dual_EC_DRBG So don't read the article as being about Unifi currently being backdoored by the NSA, but that the USG3 was one of the products using the Cavium/Marvell chips with the flaw that were being used globally in 2013 when the Snowden archive was released.

izacus 3y ago

Isn't that like 2nd or 3rd time he did that now?!