17 ms·

Security Issue: Cloud Site Manager presented me your consoles, not mine

295 points by amaccuish 3y ago

js2 3y ago
Also on r/Ubiquiti: https://old.reddit.com/r/Ubiquiti/comments/18hgpw1/security_problem/ https://old.reddit.com/r/Ubiquiti/comments/18hgpw1/security_... https://old.reddit.com/r/Ubiquiti/comments/18hs684/no_official_announcement_on_security_breaches/ https://old.reddit.com/r/Ubiquiti/comments/18hs684/no_offici...
- NelsonMinar 3y ago
  These are really bad, and both very recent. One post is a Reddit user who is seeing camera images from other Ubiquiti installations. The other is a general discussion about the lack of response from Ubiquiti so far.
  - jtriangle 3y ago
    Looks like they got it sorted now https://community.ui.com/questions/Bug-Fix-Cloud-Access-Misconfiguration/fe8d4479-e187-4471-bf95-b2799183ceb7 https://community.ui.com/questions/Bug-Fix-Cloud-Access-Misc...
teamspirit 3y ago
So the guy makes the initial post, within an hour UI team reaches out to him to gather more info and the next post is a criticism of their handling! What’s wrong with people? I think 1 hour response to a forum post isn’t unreasonable or am I wrong?
- jbverschoor 3y ago
  And nothing for 16hrs. So probably there is something wrong. And it’s seems pretty critical. Status page doesn’t show anything
  - WesolyKubeczek 3y ago
    I don't know if it's expected of status pages to signal security incidents and bugs if you technically can still use your (and other people's) console. (Putting on buck teeth and fidgeting with something) But but but akchyually, it's not an outage, you see.
    - PeterisP 3y ago
      If other people can access your console, then this feels like a case where it's negligent not to have an intentional outage, shutting down all remote access to all cloud consoles until this is fixed.
      - WesolyKubeczek 3y ago
        I don’t know, imagine relying on remote access and one day when you absolutely need to log in and do your thing you suddenly cannot because the breach and they turned it off for everyone. And to get on site it’s a 8-hour commute, or you have to cross a border or two, or you need a visa to get there. Or anything at all which necessitated remote access in the first place.
  - Petersipoi 3y ago
    Why would users want them to advertise a vulnerability on the status page before the issue is fixed? I would want them to keep this as quiet as possible until the issue is resolved.
    - x0x0 3y ago
      To enable workarounds and/or stop the bleeding. There's many places where no network is strongly preferable to network that could be open to hackers.
      - JAlexoid 3y ago
        I mean... It's not even "no network". Once the management connection is severed the network equipment doesn't stop operating at all.
- alsodumb 3y ago
  Nothing's wrong with people angry about this. What's wrong with the company letting it happen in the first place?
- bastardoperator 3y ago
  If someone was actively stealing your car, and 911 told you they're an hour out, would that be acceptable? Having carte blanche access to someone else's network equipment seems like the highest emergency a company like Ubiquity could have. I don't know if the time frame is acceptable, but I know I would have reached out to the customer versus waiting around for a DM once the alarm was rung.
  - wannacboatmovie 3y ago
    > If someone was actively stealing your car, and 911 told you they're an hour out, would that be acceptable? In Seattle they don't even show up anymore, they tell you to fill out a form online...
    - simfree 3y ago
      You have to search the streets yourself and be your own advocate if you want to recover your stolen car. In the last 8 years SPD has become completely unmotivated to do their job despite never having their budget cut. Adjacent police departments like Kirkland and Lake Forest Park are much more willing to do their job, but they fire officers who don't do their job, while SPD retains these caustic, non-performing officers. So long as we let our officers in Seattle getaway with billing fraudulent hours that weren't worked, ignoring core job duties, and slow rolling the duties that they do do, we will be stuck with an ineffective police force.
      - ImJamal 3y ago
        >In the last 8 years SPD has become completely unmotivated to do their job despite never having their budget cut The budget was absolutely cut. https://apnews.com/article/business-police-seattle-6730ec66ebc8ea9b5c443c0b1c34aa5b https://apnews.com/article/business-police-seattle-6730ec66e...
        Arnavion 3y ago
        >The Seattle City Council has approved a 2022 budget that cuts police department spending from previous years [...] 2022 was not 8 years ago.
- bdcravens 3y ago
  Update the status, and discuss it more in the open. Obviously with any security issue there's reasons to keep some discussions private, but it feels like they're attempting to minimize it, the same way a restaurant doesn't want their customers to hear about the mice in the kitchen. https://status.ui.com/#past-incidents https://status.ui.com/#past-incidents still says "no incidents reported today"
  - boilerupnc 3y ago
    Ubiquiti Statement: https://community.ui.com/questions/Bug-Fix-Cloud-Access-Misconfiguration/fe8d4479-e187-4471-bf95-b2799183ceb7 https://community.ui.com/questions/Bug-Fix-Cloud-Access-Misc...
    - bdcravens 3y ago
      If they're not going to update the status page, then it's a liability and should be taken down.
- alt227 3y ago
  I think you are missing the point. the point is this should never ever happen in whats considered to be SMB enterprise products. Peoples businesses and livelihoods are at stake. The fact that it did happen is bad enough, the rest is just the icing on the cake. you made the point about a 1 hour response, howewver 18 hours after that response there is still no update anywhere for lots of worried customers. If Ubiquiti was my company and this post was posted on my forum, I would be having status messages/emails out to all my customers, updates on status pages, warnings on website logins etc. Hiding this in a private DM with a single customer is terrible, and they even told the world thats what they were doing which was a kick in the nuts.
- tw04 3y ago
  If I reported to a vendor that I had unfettered access to other people's cloud console, and it was the fourth such report, I'd expect them to shut down access to the console until they figure out what's going wrong. Instead, they're "looking into it" or something? I guess they'll just hope nobody does anything nefarious like change the passwords on every switch/router/AP they have access to then get remote access?
  - deleted 3y ago
    [deleted]
  - emilyst 3y ago
    Imagine being able to shut off all Ubiquiti console access in the world instantly, by posting about a grave security issue (real or not) and having a few compatriots to do the same in a short amount of time. You could trivially block a business's access to its own security cameras on a moment's notice, among other things. If the response to an unverified issue were "just shut everything down" you effectively have implemented an exploitable DoS in your own incident policy.
    - cyral 3y ago
      I was typing exactly this when I saw your comment. This could very well be a real issue, but could also be a nefarious attack or even just incompetence. I've done support before and there are always users convinced that they are "hacked" or that we are doing something shady because they forgot their friend logged in on their device or forgot that they actually made two accounts in the past.
    - tw04 3y ago
      This was posted 18 hours ago. If you can't either verify the user has actual access to other people's consoles (at which point you should be immediately turning access off) in 18 hours, then you should probably just close up shop because you have no business providing remote access to a can of soup much less someone's firewall. If the user in question was making it up, you should also have posted within minutes of discovery that the user in question (and multiple other people) were making false claims. Again, they've chosen the "we're looking into it" route which is always reassuring.
- deleted 3y ago
  [deleted]
meltyness 3y ago
This place has quite a rap sheet. https://news.ycombinator.com/item?id=29411775 https://news.ycombinator.com/item?id=29411775 https://news.ycombinator.com/item?id=9331512 https://news.ycombinator.com/item?id=9331512 https://www.reddit.com/r/Ubiquiti/comments/t7br4a/since_the_software_update_at_4am_all_the_switch/ https://www.reddit.com/r/Ubiquiti/comments/t7br4a/since_the_...
magicmicah85 3y ago
Do they by any chance use a CDN for their cloud console? This has burned organizations so many times before where they cache the dynamic data and not static data.
- twisteriffic 3y ago
  I wouldn't expect to be able to administer the resources if this was just a caching issue. Seeing them yes, administer them no. Unless their authx design is tragically bad.
  - bink 3y ago
    "Full Access" could mean a lot of things. I don't see anything suggesting they could make changes (though I haven't read the entire thread). The user could just assume they have full access because they can see everything.
    - fotta 3y ago
      there was a comment in one of the reddit threads that someone was able to create a vlan on someone else's network
      - BHSPitMonkey 3y ago
        It's hard to be certain while we're just speculation, but a view caching bug could make it _look_ like you're making changes to the other user's console even if they're actually going to your own console.
        EE84M3i 3y ago
        It could also be caching something that contains a token that can perform other actions. The disparate reports of different pages and being able to navigate make it sound like this is at some API level, not literally caching the console page view.
cooljacob204 3y ago
I really wish they weren't forcing everything to their cloud services for exactly things like this.
- snom380 3y ago
  Are they forcing people to the cloud services? (I'm still running without cloud enabled.)
jbverschoor 3y ago
Remote access anything should be banned. Just use a VPN/wireguard. Reverse control is such a mess and the application is not the place to handle this
- bradyd 3y ago
  A VPN is remote access.
  - jbverschoor 3y ago
    Of course, but it's at a different layer and it works differently. It's also something that can be swapped.
- chunkyks 3y ago
  The hilarity that goes with this is that their VPN has been broken for years - android and iPhone both deprecated protocols that were considered insecure, but ubiquiti hasn't seen fit to add any others. It has been years. Their security posture is trash, which is unfortunate for a company that plays a central role in security
  - SparkyMcUnicorn 3y ago
    Yeah, I use Tailscale instead: https://github.com/SierraSoftworks/tailscale-udm https://github.com/SierraSoftworks/tailscale-udm
    - cmsj 3y ago
      I love Tailscale, but you are really then just substituting one company's remote access for another's. I'm quite certain that TS are more capable of creating a secure system than Ubiquiti are, but still, the principle of not trusting others with access to your network, is violated by TS.
      - SparkyMcUnicorn 3y ago
deleted 3y ago
[deleted]
ubiquitithrow 3y ago
Ex Ubiquiti employee here. I barely recognize the company any more. The company always had problems but we had a lot of smart and hard working peopl in the early days. People are always amazed when I tell them how small the company was when we made Ubiquiti and UniFi into household names among nerds. Some of those people remain. UI-Marcus in that link is a good person. The company went into a steady decline after the CEO started centering the company around the offices in Portland and China. Portland was home to the UX designers who wanted to redesign everything to look nicer but didn't understand how customers used our products. Portland was also home to Nick Sharp, the cloud lead who tried to extort the company and lied to the press about hacks. The favorite office in China made the FrontRow product, which failed so badly that I doubt anyone has heard of it. These people were supposed to be the future leaders of the company, but everything they did was a disaster. We could all see the writing on the wall and left. Well, almost everyone. I don't even know which Ubiquiti office owns the cloud any more because everyone working on cloud at Ubiquiti either quit or was laid off after the cloud lead went to prison for extorting the company. I hope the company can get back on track some day. It's sad to see all of our old work decay like this.
- aurareturn 3y ago
  I hooked my home up with 3 Unifi AC Pros + ERPOE5 in 2015/2016. They've been running for 8 straight years without ever restarting. Never had a problem. Granted, I never updated the firmware in the 8 years. Heck, I'm not even sure how I can get back to the web UI to control them.
  - wil421 3y ago
    Use the Unifi phone app to manage them. You can manage the APs themselves without logging into anything. I’d recommend updating the firmware after 8 years, you can always do a hard reset to get the original back.
    - SparkyMcUnicorn 3y ago
      Hard reset will not automatically downgrade the firmware. And I don't think it's a good idea to manage multiple APs using the app instead of from the controller. Managing a single AP from the app is ok, but I think you'll run into problems when you have multiple in a network.
syntaxing 3y ago
I really wish there was an open source equivalent that’s user friendly. I run OPNSense but the learning curve is steep and I wouldn’t recommend it to family because of it. I’ve been debating Firewalla but this same issue can happen since the control panel is cloud based.
- Arnavion 3y ago
  Well, since we're talking about delays in security responses, OPNsense is in the same boat. https://news.ycombinator.com/item?id=34839161 https://news.ycombinator.com/item?id=34839161
  - ojfkwai 3y ago
    I have a lot of complaints about OpnSense. But how exactly is that a similar security response? That wasn’t a security incident for OpnSense. It was a CVE for an optional package most users probably don’t have installed. Sounds like not-an-emergency to me. That user is completely unreasonable. Opnsense should refund their money (if any lol) and tell them to pop off.
    - Arnavion 3y ago
      >That wasn’t a security incident for OpnSense. It was a CVE for an optional package most users probably don’t have installed. First of all, the point is that the OS didn't release CVE fixes for the packages in its repositories even though it had already committed those fixes to version control. Notice that my comment specifically talks about "delay in security response", not that it was an "emergency". >That user is completely unreasonable. Opnsense should refund their money (if any lol) Second, I recommend reading the comment you respond to carefully before you rush to make an account to respond to it. "That user" is me. The GH thread has a clear comment from me that I did not pay them any money and do not have any expectation of support. Third, notice that the point of the GH thread was me asking what their policy of releasing CVE fixes was. You seem to think I was some Karen complaining that they hadn't released the fix. All I asked was a confirmation that they're aware that they're shipping a package with a CVE, that they've already fixed the package but just not published it, and what their policy is for releasing fixes in general. They could've responded with something like "We're aware of the CVE but we don't plan to release the fix in 23.1. Our policy is to only release bugfixes for non-critical packages in the next stable release, and we consider os-haproxy to be a non-critical package." Instead they got weirdly defensive about it, tried to lecture me about how OS releases generally work, called me "rude" (ironic), and locked the issue. The ultimate point is that OPNsense delays security fixes. Maybe you think it's okay because you think some OS packages are critical and this one wasn't. Maybe you think if an OS can't articulate its security fixes release policy without getting combative, then it's hard to take its security seriously. The decision is yours.
stusmall 3y ago
One possible explanation for this can be a mistake in caching. While it is tempting to log in and see if you can see other people's consoles... that just might put you in the cache for someone else to see. There is no way for us to know what is causing the bug and what will help without official word for Ubiquiti but logging in can only possibly hurt and won't help.
- SigmundA 3y ago
  Yeah seems like a caching issue where the cache isn't properly segmented by user.
tomkinstinch 3y ago
For anyone with a UDMP looking to disable remote access via UniFi servers, the setting isn't under the Network application, it's part of the higher level console management: Console Settings (menu on left) -> Advanced (heading) -> "Remote Access (checkbox)" Or via: https://$UDMP_IP/console-settings https://$UDMP_IP/console-settings (Hopefully the setting applies locally...)
- cmsj 3y ago
  And note that to see the Remote Access checkbox, you need to be logged into the console as a ui.com user, not a local user. If you have disabled Remote Access and instead want to use the phone app via a VPN, you may have to add it manually. There's a (+) button for that, and then a "Need help?" option, which contains a way to manually add by IP/user/password.
  - _rs 3y ago
    If only you could do this with the Protect app...
twisteriffic 3y ago
Had a "is this actually your local console?" Prompt from protect this morning. I'm getting a bad feeling about this.
awill 3y ago
I have a few unifi things at home, and for the most part, they've been good, and work well together. But this sort of stuff is very concerning, and forcing the cloud account on everyone is really stupid. But what are the alternatives. Firewalla seems to be a good alternative, but they don't do APs, leaving me with a mixed system.
- elteto 3y ago
  Using the cloud is not required, you can set everything up with local access. Certain products, like Protect, do require cloud access. But not the base networking stuff.
- latentcall 3y ago
  I use a Firewalla with TP-Link Omada AP’s, works great. Don’t really mind the mixed system aspect. Recommend!
  - awill 3y ago
    why not use an Omada gateway/router too?
- apearson 3y ago
  From I remember Firewalla (app only) is more dependent on the cloud than Unifi
- miles 3y ago
  > Firewalla seems to be a good alternative https://old.reddit.com/r/firewalla/comments/14gf1j1/major_security_breach_all_rules_ignored_and_all/ https://old.reddit.com/r/firewalla/comments/14gf1j1/major_se... https://old.reddit.com/r/firewalla/comments/177egzl/summary_of_firewalla_serious_security_bugs/ https://old.reddit.com/r/firewalla/comments/177egzl/summary_...
- zzzeek 3y ago
  im running unifi here and I've never dealt with any of this cloud stuff, there's a checkbox called "enable remote access" that defaulted to false for mine and I'd never check that box, so hopefully it's not actually "forced" ?
Macha 3y ago
My decision to not enable remote access feels vindicated now.
throwaway202312 3y ago
If I had to take a guess they might be using a CDN like Cloudflare and temporarily misconfigured a cache rule…
freedomben 3y ago
When people ask me why I don't use Ubiquiti products, and I tell them that I don't trust companies with closed/proprietary offerings with something as critical as this, I get a lot of skepticism and even eye-roll. Open source isn't a silver bullet, but if I were self-hosting my own "cloud" controls I wouldn't be worried about something like this.
- luckydata 3y ago
  honest question, who do you trust that provides either high end residential or SMB type networking gear that works well? The average residential stuff is all garbage and I was looking into unifi because seems to work better but I'm open to suggestions.
  - aftbit 3y ago
    I personally run a bunch of obsolete Aruba, Juniper, and Ruckus gear at home. It works pretty well, doesn't cost very much, generally doesn't require licenses or cloud, and supports every feature under the sun. The only problem is power consumption, but I don't mind burning ~200W on my whole house's network infrastructure.
    - freedomben 3y ago
      This is a great way to go if you don't mind the power consumption and/or learning how to administer them. You can buy used Juniper equipment that went for 4 to 5 figures when it was new, for dirt cheap (2 figures). Still plenty sufficient for home use. If you've never done Juniper before it can be a bit of a learning curve, but the equipment is really solid.
  - freedomben 3y ago
    This is a really hard time to be in that market. I built my own "mesh" system by deploying 3 separate routers in bridge mode, connected via ethernet (lucky that house was pre-wired). We moved to a house that didn't have that and I used powerline adapters which worked well enough, but once wifi 6 came and the true mesh systems like Google Wifi and Eero put together a system that has much better handoff (by coordinating), open source really just hasn't kept up. The powerline solution kind of sucks because it caps out for me at 20 Mbps (which is very disappointing when scp-ing a file over the LAN!). I've heard people able to get 200 Mbps through powerline, but I haven't been successful. I built a system that just used three routers each with a slightly different SSID, and a script on my laptop that would switch it to the one with the most power once it hit a certain differential threshold. That was honestly my favorite system, and what I plan to do again once my current system retires. My current system is a Protectli 4-port firewall appliance that is running AlmaLinux. It gets CGNATed by my ISP (Starlink) but I set up Tailscale (Headscale) and don't really have any issues now from CGNAT. Cockpit plus plugins provides me a good GUI, although I prefer to just SSH and use the CLI. I have two "wireless access points", one is a Linksys WRT3200ACM: AC3200 (open source edition). It's good, not great. The other is a (swallow) Google wifi. The Google wifi adds a layer of NAT in order to provide mesh. You can avoid that by putting it in hub mode but you lose wireless handoff if you use that. I've been pretty happy with that system for several years, but I'm still on the lookout for something more open that isn't a major downgrade on speed/reliability. I can more or less hot swap any WAP into place since most of the brains/config is in my Almalinux router.
tokamak 3y ago
Feels like the issue Steam had with caching https://securityaffairs.com/43189/security/steam-users-data-exposed.html https://securityaffairs.com/43189/security/steam-users-data-...
cmsj 3y ago
The real question here for me is: why is my data not flowing through Ubiquiti's servers end-to-end encrypted? They should be able to accidentally send my data to another user and have it merely result in a decryption failure.
- smcleod 3y ago
  I think you mean encrypted at rest (data) with you holding the decryption key not e2e (https/tls) which is from your network to their network.
- rekoil 3y ago
  I have been hoping for them to go this route for a while now, maybe eventually they will.
calamari4065 3y ago
I built a UniFi network 6 or 7 years ago. I was pretty excited, as the hardware seemed properly solid. A touch expensive, but I was expecting it to run forever, essentially. The hardware was actually really good from what I could tell. Not a single issue that wasn't caused by my own misconfiguration. But the software, woof. The software was designed to do exactly one thing: look impressive to execs in a board meeting. It was nearly unusable for me. I don't recall any specifics, but all you really need to know is that it took multiple days to get a simple home network with a single AP and a single router set up. It was so much effort just to log in to the damn thing. I went into this project excited at the prospect of all the cool monitoring and analytics I could do. Fancy security and remote access and whatnot. After I finally got everything configured, I never touched it again. There were a few times when I needed or wanted to get into it, but I couldn't remember the specific incantation and combination of software needed to access it, so I just didn't. I'd love to have a solid system built on quality hardware. UniFi is notionally exactly what I want, and exactly what a lot of hackers and tinkerers want. But the quality of your hardware is pretty much irrelevant if your software wasn't designed to be used by humans. So I'm stuck using consumer routers with open firmware. It's fine I guess.
- riley_dog 3y ago
  I run OPNsense, but use UniFi hardware. I rarely ever have to interact with the UniFi software as it's only there to configure the hardware.
  - aftbit 3y ago
    OPNsense can target UniFi gear? Does it manage the switching and APs too?
    - JAlexoid 3y ago
      You use OPNsense as the router, but the rest of the equipment is managed separately. I don't know of a system that works across multiple SDN solutions.
    - teekert 3y ago
justhumanthings 3y ago
[flagged]
boeingUH60 3y ago
Random fact: Ubiquiti is publicly traded, yet Pera owns 90%+ of it, meaning shareholders virtually have no power to push for changes. You might as well call it a privately held company, lol.
barbazoo 3y ago
Easy to host the console yourself: https://help.ui.com/hc/en-us/articles/360012282453 https://help.ui.com/hc/en-us/articles/360012282453. There's even a docker image for those who have trust: https://github.com/linuxserver/docker-unifi-controller https://github.com/linuxserver/docker-unifi-controller
- jonathantf2 3y ago
  Not if you use their "Dream Machine" line of products - you have to use the controller that's self hosted on the box. I'm currently trying to figure out how to disable the cloud connection on these and go back to good ol' open ports to manage the thing.
  - erupt7893 3y ago
    I haven't tried yet but looks like this was posted above with how to disable cloud connection https://news.ycombinator.com/item?id=38644073 https://news.ycombinator.com/item?id=38644073
    - cpburns2009 3y ago
      I have a Dream Machine Pro (UDM-Pro), and disabling remote access is as simple as finding the setting and turning it off. I disabled it on mine a while ago as an extra security measure.
- Rudism 3y ago
  It should be noted that the repo you linked is for a deprecated image that's losing support at the end of this year: https://info.linuxserver.io/issues/2023-09-06-unifi-controller/ https://info.linuxserver.io/issues/2023-09-06-unifi-controll... The note I link above discusses its replacement and how to upgrade.
  - Khaine 3y ago
    Thanks. I didn't know about this.
sschueller 3y ago
Ah the beauty of cloud connected networks management. A hackers delight... And then I am the one that gets chastised for not wanting cloud connected router/switches in my networks.
MenhirMike 3y ago
Does anyone have a recommendation for a replacement? After the requirement to create a cloud account on their so-called "Pro" Dream Machine I already felt something is wrong, and after "Please don't use shielded Ethernet cables with our so-called "Professional" WiFi Access Points, they can randomly reboot"[1] and now this nonsense, I'm just simply done with them. But I really like the hardware of the Dream Machine Pro (Router, Switch with 10G uplink) and the overall view of clients and connected devices, so I don't just want to buy some random Router and pair it with random WiFi APs - though I guess that's the best choice? [1] https://help.ui.com/hc/en-us/articles/8823742725015-UniFi-6-Access-Point-Professional-U6-Pro-Advisory https://help.ui.com/hc/en-us/articles/8823742725015-UniFi-6-...
- InTheArena 3y ago
  There is no requirement to create a cloud account on the Pro machine.
  - MenhirMike 3y ago
    There used to be a mandatory ui.com account when it came out. If they finally got rid of that nonsense, that's great news. And yeah, looks like the v1.1 update removed it (https://community.ui.com/releases/UniFi-OS-Dream-Machines-1-11-0/eef95803-6976-499b-9169-bf6dfbbcc209 https://community.ui.com/releases/UniFi-OS-Dream-Machines-1-...): "Allow to set up a console without an SSO account." The fact that they decided to release a "Pro" product with that requirement initially still counts heavily against them: What were they thinking, and why should I trust them if they are making such decisions?
cogogo 3y ago
Odd coincidence in that I had the same problem with Ubiquity the 401k provider several years ago. Could see most of my colleagues 401k accounts. Never good.
xyst 3y ago
UI just can’t catch a break. Earlier this year, some tech tabloid (krebsonsecurity?) reported how bad security was at UI. I think it was ultimately determined to be a bad story and UI sued for defamation. Now we are here again with another possible leak.
- InTheArena 3y ago
  This was multiple years ago at this point. this is why smear attacks work. Someone on a different hacker news thread today was stating that the car that blew up at the Canadian border was a Tesla (It was a bently). I've seen these types of bugs before. I think they introduced a very bad credentials or session bug. The good news is you can turn cloud off for all of these, and they work just fine.
  - fragmede 3y ago
    Or how the one fire in a Tesla in Florida following a hurricane became a whole fleet of every EV in Florida spontaneously combusting. A lie can travel halfway around the world while the truth is putting on it's shoes.
op00to 3y ago
It’s unlikely that simply seeing things in the main console means you’ll be able to change things if this is a caching issue. It can still expose passwords and other internal information you don’t want to get out.
arcza 3y ago
Nice, yet another breach that doesn't affect me self hosting my Unifi controller.
everdrive 3y ago
I feel very vindicated for avoiding the cloud solution when everyone was praising Ubiquiti back in 2016 or so.
hk1337 3y ago
I tried the AmpliFi mesh router several years ago and hated it. It didn't seem any better than the Arris gateway that ATT sent me. Why would you have a central console that has the potential for accessing all the routers with a single login though? Why wouldn't this be just local to the network with remote access?
InTheArena 3y ago
https://community.ui.com/questions/Bug-Fix-Cloud-Access-Misconfiguration/fe8d4479-e187-4471-bf95-b2799183ceb7 https://community.ui.com/questions/Bug-Fix-Cloud-Access-Misc...
aetherspawn 3y ago
So what’s the alternative for SMB… Cisco? Where can we buy this stuff cheap without going through an IT company..?
BrianHutch 3y ago
https://community.ui.com/questions/Bug-Fix-Cloud-Access-Misconfiguration/fe8d4479-e187-4471-bf95-b2799183ceb7 https://community.ui.com/questions/Bug-Fix-Cloud-Access-Misc...
zzyzxd 3y ago
Ubiquiti has always been pushing the remote management feature pretty hard. But recently they are also making some really nice VPN features. I hope incident like this would further change their standpoint and actually make local account access nicer. There are tons of dark pattern in the Protect app that prevents you from using a local account. And when you finally learned to workaround all of them, you realized that there's no push notification without remote access. (I understand the difficulty to push message straight from console to mobile device, but many selfhostable software offer a centralized, managed push notification relay over internet. I am not sure if this is too much to ask for)
netsharc 3y ago
Put it on the cloud they say... Reminds me of that time someone at Dropbox pushed a change onto production that ignored your password, so you could login as anyone with any password...
- malfist 3y ago
  Reminds me when Dropbox pushed a change to production that opted folks into sending their files to OpenAI
- mavhc 3y ago
  Got a source? Can't see anything with a quick search
  - netsharc 3y ago
    https://techcrunch.com/2011/06/20/dropbox-security-bug-made-passwords-optional-for-four-hours/ https://techcrunch.com/2011/06/20/dropbox-security-bug-made-... DDG and Google were useless and mostly returned pages from dropbox.com, I had to exclude results from there: https://www.google.com/search?q=dropbox+security+issue+password+check+-site%3Adropbox.com&hl=en https://www.google.com/search?q=dropbox+security+issue+passw...
- yonatan8070 3y ago
  Reminds me of this old talk by Tom Scott https://youtube.com/watch?v=y4GB_NDU43Q https://youtube.com/watch?v=y4GB_NDU43Q
tmikaeld 3y ago
Considering all of the shit that goes on with routers, maybe it's time to say that OpenWRT is the (only) safe-ish option at this point?
nottorp 3y ago
Hmm I should upgrade my wifi next year. Right now I have an old ish Ubiquiti AP that does its job without bothering me, but it's from before the cloud insanity. Have they seen the light and made their devices usable without ever logging into their servers? Last time I asked this question the 'cloud' was unavoidable during the initial set up but could be turned off later. This doesn't look like enough to me. I want a damn access point that doesn't talk to anything outside my network.
- neilalexander 3y ago
  UniFi APs can be set up in standalone mode with the help of the UniFi Network mobile apps. https://help.ui.com/hc/en-us/articles/12594679474071-Standalone-Access-Points-without-UniFi- https://help.ui.com/hc/en-us/articles/12594679474071-Standal...
  - nottorp 3y ago
    Interesting info. Why does it say in step 3: 'Log in to the UniFi Mobile App (iOS / Android)' ? Log in to what? If they moved the 'cloud' requirement from the AP to the management app it doesn't mean they got rid of it.
  - bouke 3y ago
    You’ll have to setup the APs individually and you’ll be missing out on various features like quick roaming.
- beaviskhan 3y ago
  You can keep it non-cloud as far as I know. I just bought a gen2 cloud key to replace the [persistently crappy] gen1 cloud key that I've had for ~5 years and I was able to skip the cloud login during initial setup. Of course, the devices reach out to fetch updates and whatnot, but all auth/config is held locally.
- yencabulator 3y ago
  > Have they seen the light and made their devices usable without ever logging into their servers? I run the management software in a VM and don't even have an account on ui.com. My firewall doesn't let the management software talk to the internet (I allow NTP and the couple of pings it wants to do, reject phone home; I temporarily allow phone home when I want to check for firmware updates).
boilerupnc 3y ago
Ubiquiti Statement: https://community.ui.com/questions/Bug-Fix-Cloud-Access-Misconfiguration/fe8d4479-e187-4471-bf95-b2799183ceb7 https://community.ui.com/questions/Bug-Fix-Cloud-Access-Misc...
- mousetree 3y ago
  I think it's great that they publicly took responsibility however it's not clear what controls they've put in place to not allow this to happen again.
  - genmud 3y ago
    Hint: they haven't put controls in place, and it will happen again. Unifi is one of the companies with awesome potential but they just seem to whiff it constantly on security and software.
    - gunapologist99 3y ago
      Agreed. It's very difficult, and sometimes impossible, to retrofit security, especially without a huge investment. If you just don't even care enough, then you'll never get it right. Not saying that Ubiquiti is that way, but there's a reason why some companies never seem to have significant security concerns and others have an unrelenting stream of them.
  - ta1243 3y ago
    My unifi controller runs in a VM, The APs have no access to anything but that VM. Wondering if I should limit outgoing traffic from my controller.
    - nullify88 3y ago
      I believe the controller can be configured to be accessible via the cloud UI, but it isn't the default. At least thats the behaviour when configured with a local user.
boilerupnc 3y ago
Ubiquiti Statement: https://community.ui.com/questions/Bug-Fix-Cloud-Access-Misconfiguration/fe8d4479-e187-4471-bf95-b2799183ceb7 https://community.ui.com/questions/Bug-Fix-Cloud-Access-Misc...
gunapologist99 3y ago
The cloud is still just someone else's computer. (Or camera.)
farmdve 3y ago
The cloud is like those portable toilets in public. They are private, but there are also people around you at all times. Sometimes you forget to lock the door and someone else opens it.
- driverdan 3y ago
  I like this analogy. They're full of shit and you only use them if you have absolutely no alternatives.
- sebazzz 3y ago
  Are you meaning to say that a big accident in a public cloud like AWS or Azure is waiting to happen? I did have something weird the other day in AWS. I was accessing a K8S hosted website in my clients tenant, and I got an SSL handshake issue. Turns out the certificate served wasn't of my clients website, but of some dev-xxxx.polar.com. That environment wasn't externally accessible as the domain cannot be resolved in public DNS and I assume that the environment itself is also shielded. After refreshed, the issue was gone and I could access the client site again.
  - inemesitaffia 3y ago
    Azure in particular
cturner 3y ago
My parents live in another country, and I want to set up some network equipment at their house so that I can coordinate their network if they get into trouble, and to support cameras as one of them has become high-care. My dad also has some complex data. I intend to install a rackmount server for him so that I can help him with data problems from time to time. For network equipment, I have a fair bit of experience with datacentre grade equipment, but none in the consumer space. I think I want this, 1. Good quality. 2. Fanless 3. Drives multi-node wifi APs 4. Control cameras 5. Web interface that parents can use. 6. Cisco-like CLI that I can use. 7. No cloud. The unifi equipment seems to fit all criteria above except the last two points. Seems you cannot make permanent changes from the console, and their offering is oriented towards cloud configuration. Would someone who knows the segment be happy to offer advice? (thanks in advance)
- qsi 3y ago
  I run my own Docker image for the Unifi server, no cloud needed. The CLI is limited though but I can ssh into my switches and router. I haven't used their camera offerings though.
- wpm 3y ago
  I have a UniFi AP and a 24-port 10G switch from Ubiquiti. As far as 6. goes, you are sadly correct. It’s all Linux underneath so there are plenty of changes you can make in the CLI, but the middleware will happily stomp all over it at the next upgrade or reboot. For no cloud, it’s quite easy to avoid. The middleware can be spun up in a container or installed on any Linux VM and have no access to Ubiquiti’s servers at all and it’ll work fine (you’ll have to upload updates yourself). However, the product will be full of little nagging notices coaxing you into going to the cloud, or as in my case, getting mad you aren’t using a UDM for your router/firewall and turn off a bunch of the L3 features. The software is meme-level in how many bad patterns and form-over-function decisions are in it. Cloud or no, it’s frankly kinda crap. The APs are solid, but I’ll likely not buy another switch from them if I can help it. Depending on your needs, there is plenty of used enterprise gear to be had for quite cheap on eBay. But, I’m in the market for a fat 48-port switch with a huge PoE budget and they have one that’s all 2.5G. I don’t know that anyone else makes one, and if they do, it’s three times the price, or I have to call some sales person to talk about it, or the actual existence of the product is impossible to surmise through thick marketing wank datasheets.
LeifCarrotson 3y ago
Navigate to your router's IP, go to Console Settings, scroll to Advanced and un-check Remote Access: https://i.imgur.com/RzXpT6Q.png https://i.imgur.com/RzXpT6Q.png After doing that, you can't access your router remotely from The Cloud, (well, you can log in over the VPN, remote into a computer on-site, and access the router from that computer) but you're secure against a whole class of bugs and errors in Someone Else's Computer.
- a_subsystem 3y ago
  I set up nginx to point to my UDMP's 443 port via a subdomain of mine. Unsure if this is horrible security but I don't have 'Remote Access' turned on. I guess at worst it relies on UniFi OS security and auth to be solid?
  - wil421 3y ago
    I setup a domain from name cheap and pointed a subdomain towards my routers IP. Then I VPN using Unifi to control it. I cancelled the domain and use the IP but I’ve found it does change from time to time. Unifi’s firewall blocks a ton of IPs whenever I open a port for plex or whatever. I’ve tried to fight back against US providers letting anyone with a VM run port scans but they only care about getting paid.
- millzlane 3y ago
  Before all this cloud stuff you could just run the ubiquiti protect suite on a linux box. But then they discontinued it and the ios app to push their cloud offerings on people.
- keep_reading 3y ago
  If you're running UniFi on FreeBSD/OpenBSD it won't even allow cloud access because their Java websocket library for it doesn't include support for anything but Mac/Win/Linux
28304283409234 3y ago
Mikrotik is the way.

295 points by amaccuish 3y ago

js2 3y ago

Also on r/Ubiquiti: https://old.reddit.com/r/Ubiquiti/comments/18hgpw1/security_problem/ https://old.reddit.com/r/Ubiquiti/comments/18hgpw1/security_... https://old.reddit.com/r/Ubiquiti/comments/18hs684/no_official_announcement_on_security_breaches/ https://old.reddit.com/r/Ubiquiti/comments/18hs684/no_offici...

NelsonMinar 3y ago
These are really bad, and both very recent. One post is a Reddit user who is seeing camera images from other Ubiquiti installations. The other is a general discussion about the lack of response from Ubiquiti so far.
- jtriangle 3y ago
  Looks like they got it sorted now https://community.ui.com/questions/Bug-Fix-Cloud-Access-Misconfiguration/fe8d4479-e187-4471-bf95-b2799183ceb7 https://community.ui.com/questions/Bug-Fix-Cloud-Access-Misc...

teamspirit 3y ago

So the guy makes the initial post, within an hour UI team reaches out to him to gather more info and the next post is a criticism of their handling! What’s wrong with people? I think 1 hour response to a forum post isn’t unreasonable or am I wrong?

jbverschoor 3y ago
And nothing for 16hrs. So probably there is something wrong. And it’s seems pretty critical. Status page doesn’t show anything
- WesolyKubeczek 3y ago
  I don't know if it's expected of status pages to signal security incidents and bugs if you technically can still use your (and other people's) console. (Putting on buck teeth and fidgeting with something) But but but akchyually, it's not an outage, you see.
  - PeterisP 3y ago
    If other people can access your console, then this feels like a case where it's negligent not to have an intentional outage, shutting down all remote access to all cloud consoles until this is fixed.
    - WesolyKubeczek 3y ago
      I don’t know, imagine relying on remote access and one day when you absolutely need to log in and do your thing you suddenly cannot because the breach and they turned it off for everyone. And to get on site it’s a 8-hour commute, or you have to cross a border or two, or you need a visa to get there. Or anything at all which necessitated remote access in the first place.
- Petersipoi 3y ago
  Why would users want them to advertise a vulnerability on the status page before the issue is fixed? I would want them to keep this as quiet as possible until the issue is resolved.
  - x0x0 3y ago
    To enable workarounds and/or stop the bleeding. There's many places where no network is strongly preferable to network that could be open to hackers.
    - JAlexoid 3y ago
      I mean... It's not even "no network". Once the management connection is severed the network equipment doesn't stop operating at all.
alsodumb 3y ago
Nothing's wrong with people angry about this. What's wrong with the company letting it happen in the first place?
bastardoperator 3y ago
If someone was actively stealing your car, and 911 told you they're an hour out, would that be acceptable? Having carte blanche access to someone else's network equipment seems like the highest emergency a company like Ubiquity could have. I don't know if the time frame is acceptable, but I know I would have reached out to the customer versus waiting around for a DM once the alarm was rung.
- wannacboatmovie 3y ago
  > If someone was actively stealing your car, and 911 told you they're an hour out, would that be acceptable? In Seattle they don't even show up anymore, they tell you to fill out a form online...
  - simfree 3y ago
    You have to search the streets yourself and be your own advocate if you want to recover your stolen car. In the last 8 years SPD has become completely unmotivated to do their job despite never having their budget cut. Adjacent police departments like Kirkland and Lake Forest Park are much more willing to do their job, but they fire officers who don't do their job, while SPD retains these caustic, non-performing officers. So long as we let our officers in Seattle getaway with billing fraudulent hours that weren't worked, ignoring core job duties, and slow rolling the duties that they do do, we will be stuck with an ineffective police force.
    - ImJamal 3y ago
      >In the last 8 years SPD has become completely unmotivated to do their job despite never having their budget cut The budget was absolutely cut. https://apnews.com/article/business-police-seattle-6730ec66ebc8ea9b5c443c0b1c34aa5b https://apnews.com/article/business-police-seattle-6730ec66e...
      - Arnavion 3y ago
        >The Seattle City Council has approved a 2022 budget that cuts police department spending from previous years [...] 2022 was not 8 years ago.
bdcravens 3y ago
Update the status, and discuss it more in the open. Obviously with any security issue there's reasons to keep some discussions private, but it feels like they're attempting to minimize it, the same way a restaurant doesn't want their customers to hear about the mice in the kitchen. https://status.ui.com/#past-incidents https://status.ui.com/#past-incidents still says "no incidents reported today"
- boilerupnc 3y ago
  Ubiquiti Statement: https://community.ui.com/questions/Bug-Fix-Cloud-Access-Misconfiguration/fe8d4479-e187-4471-bf95-b2799183ceb7 https://community.ui.com/questions/Bug-Fix-Cloud-Access-Misc...
  - bdcravens 3y ago
    If they're not going to update the status page, then it's a liability and should be taken down.
alt227 3y ago
I think you are missing the point. the point is this should never ever happen in whats considered to be SMB enterprise products. Peoples businesses and livelihoods are at stake. The fact that it did happen is bad enough, the rest is just the icing on the cake. you made the point about a 1 hour response, howewver 18 hours after that response there is still no update anywhere for lots of worried customers. If Ubiquiti was my company and this post was posted on my forum, I would be having status messages/emails out to all my customers, updates on status pages, warnings on website logins etc. Hiding this in a private DM with a single customer is terrible, and they even told the world thats what they were doing which was a kick in the nuts.
tw04 3y ago
If I reported to a vendor that I had unfettered access to other people's cloud console, and it was the fourth such report, I'd expect them to shut down access to the console until they figure out what's going wrong. Instead, they're "looking into it" or something? I guess they'll just hope nobody does anything nefarious like change the passwords on every switch/router/AP they have access to then get remote access?
- deleted 3y ago
  [deleted]
- emilyst 3y ago
  Imagine being able to shut off all Ubiquiti console access in the world instantly, by posting about a grave security issue (real or not) and having a few compatriots to do the same in a short amount of time. You could trivially block a business's access to its own security cameras on a moment's notice, among other things. If the response to an unverified issue were "just shut everything down" you effectively have implemented an exploitable DoS in your own incident policy.
  - cyral 3y ago
    I was typing exactly this when I saw your comment. This could very well be a real issue, but could also be a nefarious attack or even just incompetence. I've done support before and there are always users convinced that they are "hacked" or that we are doing something shady because they forgot their friend logged in on their device or forgot that they actually made two accounts in the past.
  - tw04 3y ago
    This was posted 18 hours ago. If you can't either verify the user has actual access to other people's consoles (at which point you should be immediately turning access off) in 18 hours, then you should probably just close up shop because you have no business providing remote access to a can of soup much less someone's firewall. If the user in question was making it up, you should also have posted within minutes of discovery that the user in question (and multiple other people) were making false claims. Again, they've chosen the "we're looking into it" route which is always reassuring.
deleted 3y ago
[deleted]

meltyness 3y ago

This place has quite a rap sheet. https://news.ycombinator.com/item?id=29411775 https://news.ycombinator.com/item?id=29411775 https://news.ycombinator.com/item?id=9331512 https://news.ycombinator.com/item?id=9331512 https://www.reddit.com/r/Ubiquiti/comments/t7br4a/since_the_software_update_at_4am_all_the_switch/ https://www.reddit.com/r/Ubiquiti/comments/t7br4a/since_the_...

magicmicah85 3y ago

Do they by any chance use a CDN for their cloud console? This has burned organizations so many times before where they cache the dynamic data and not static data.

twisteriffic 3y ago
I wouldn't expect to be able to administer the resources if this was just a caching issue. Seeing them yes, administer them no. Unless their authx design is tragically bad.
- bink 3y ago
  "Full Access" could mean a lot of things. I don't see anything suggesting they could make changes (though I haven't read the entire thread). The user could just assume they have full access because they can see everything.
  - fotta 3y ago
    there was a comment in one of the reddit threads that someone was able to create a vlan on someone else's network
    - BHSPitMonkey 3y ago
      It's hard to be certain while we're just speculation, but a view caching bug could make it _look_ like you're making changes to the other user's console even if they're actually going to your own console.
      - EE84M3i 3y ago
        It could also be caching something that contains a token that can perform other actions. The disparate reports of different pages and being able to navigate make it sound like this is at some API level, not literally caching the console page view.

cooljacob204 3y ago

I really wish they weren't forcing everything to their cloud services for exactly things like this.

snom380 3y ago
Are they forcing people to the cloud services? (I'm still running without cloud enabled.)

jbverschoor 3y ago

Remote access anything should be banned. Just use a VPN/wireguard. Reverse control is such a mess and the application is not the place to handle this

bradyd 3y ago
A VPN is remote access.
- jbverschoor 3y ago
  Of course, but it's at a different layer and it works differently. It's also something that can be swapped.
chunkyks 3y ago
The hilarity that goes with this is that their VPN has been broken for years - android and iPhone both deprecated protocols that were considered insecure, but ubiquiti hasn't seen fit to add any others. It has been years. Their security posture is trash, which is unfortunate for a company that plays a central role in security
- SparkyMcUnicorn 3y ago
  Yeah, I use Tailscale instead: https://github.com/SierraSoftworks/tailscale-udm https://github.com/SierraSoftworks/tailscale-udm
  - cmsj 3y ago
    I love Tailscale, but you are really then just substituting one company's remote access for another's. I'm quite certain that TS are more capable of creating a secure system than Ubiquiti are, but still, the principle of not trusting others with access to your network, is violated by TS.
    - SparkyMcUnicorn 3y ago

deleted 3y ago

[deleted]

ubiquitithrow 3y ago

Ex Ubiquiti employee here. I barely recognize the company any more. The company always had problems but we had a lot of smart and hard working peopl in the early days. People are always amazed when I tell them how small the company was when we made Ubiquiti and UniFi into household names among nerds. Some of those people remain. UI-Marcus in that link is a good person. The company went into a steady decline after the CEO started centering the company around the offices in Portland and China. Portland was home to the UX designers who wanted to redesign everything to look nicer but didn't understand how customers used our products. Portland was also home to Nick Sharp, the cloud lead who tried to extort the company and lied to the press about hacks. The favorite office in China made the FrontRow product, which failed so badly that I doubt anyone has heard of it. These people were supposed to be the future leaders of the company, but everything they did was a disaster. We could all see the writing on the wall and left. Well, almost everyone. I don't even know which Ubiquiti office owns the cloud any more because everyone working on cloud at Ubiquiti either quit or was laid off after the cloud lead went to prison for extorting the company. I hope the company can get back on track some day. It's sad to see all of our old work decay like this.

aurareturn 3y ago
I hooked my home up with 3 Unifi AC Pros + ERPOE5 in 2015/2016. They've been running for 8 straight years without ever restarting. Never had a problem. Granted, I never updated the firmware in the 8 years. Heck, I'm not even sure how I can get back to the web UI to control them.
- wil421 3y ago
  Use the Unifi phone app to manage them. You can manage the APs themselves without logging into anything. I’d recommend updating the firmware after 8 years, you can always do a hard reset to get the original back.
  - SparkyMcUnicorn 3y ago
    Hard reset will not automatically downgrade the firmware. And I don't think it's a good idea to manage multiple APs using the app instead of from the controller. Managing a single AP from the app is ok, but I think you'll run into problems when you have multiple in a network.

syntaxing 3y ago

I really wish there was an open source equivalent that’s user friendly. I run OPNSense but the learning curve is steep and I wouldn’t recommend it to family because of it. I’ve been debating Firewalla but this same issue can happen since the control panel is cloud based.

Arnavion 3y ago
Well, since we're talking about delays in security responses, OPNsense is in the same boat. https://news.ycombinator.com/item?id=34839161 https://news.ycombinator.com/item?id=34839161
- ojfkwai 3y ago
  I have a lot of complaints about OpnSense. But how exactly is that a similar security response? That wasn’t a security incident for OpnSense. It was a CVE for an optional package most users probably don’t have installed. Sounds like not-an-emergency to me. That user is completely unreasonable. Opnsense should refund their money (if any lol) and tell them to pop off.
  - Arnavion 3y ago
    >That wasn’t a security incident for OpnSense. It was a CVE for an optional package most users probably don’t have installed. First of all, the point is that the OS didn't release CVE fixes for the packages in its repositories even though it had already committed those fixes to version control. Notice that my comment specifically talks about "delay in security response", not that it was an "emergency". >That user is completely unreasonable. Opnsense should refund their money (if any lol) Second, I recommend reading the comment you respond to carefully before you rush to make an account to respond to it. "That user" is me. The GH thread has a clear comment from me that I did not pay them any money and do not have any expectation of support. Third, notice that the point of the GH thread was me asking what their policy of releasing CVE fixes was. You seem to think I was some Karen complaining that they hadn't released the fix. All I asked was a confirmation that they're aware that they're shipping a package with a CVE, that they've already fixed the package but just not published it, and what their policy is for releasing fixes in general. They could've responded with something like "We're aware of the CVE but we don't plan to release the fix in 23.1. Our policy is to only release bugfixes for non-critical packages in the next stable release, and we consider os-haproxy to be a non-critical package." Instead they got weirdly defensive about it, tried to lecture me about how OS releases generally work, called me "rude" (ironic), and locked the issue. The ultimate point is that OPNsense delays security fixes. Maybe you think it's okay because you think some OS packages are critical and this one wasn't. Maybe you think if an OS can't articulate its security fixes release policy without getting combative, then it's hard to take its security seriously. The decision is yours.

stusmall 3y ago

One possible explanation for this can be a mistake in caching. While it is tempting to log in and see if you can see other people's consoles... that just might put you in the cache for someone else to see. There is no way for us to know what is causing the bug and what will help without official word for Ubiquiti but logging in can only possibly hurt and won't help.

SigmundA 3y ago
Yeah seems like a caching issue where the cache isn't properly segmented by user.

tomkinstinch 3y ago

For anyone with a UDMP looking to disable remote access via UniFi servers, the setting isn't under the Network application, it's part of the higher level console management: Console Settings (menu on left) -> Advanced (heading) -> "Remote Access (checkbox)" Or via: https://$UDMP_IP/console-settings https://$UDMP_IP/console-settings (Hopefully the setting applies locally...)

cmsj 3y ago
And note that to see the Remote Access checkbox, you need to be logged into the console as a ui.com user, not a local user. If you have disabled Remote Access and instead want to use the phone app via a VPN, you may have to add it manually. There's a (+) button for that, and then a "Need help?" option, which contains a way to manually add by IP/user/password.
- _rs 3y ago
  If only you could do this with the Protect app...

twisteriffic 3y ago

Had a "is this actually your local console?" Prompt from protect this morning. I'm getting a bad feeling about this.

awill 3y ago

I have a few unifi things at home, and for the most part, they've been good, and work well together. But this sort of stuff is very concerning, and forcing the cloud account on everyone is really stupid. But what are the alternatives. Firewalla seems to be a good alternative, but they don't do APs, leaving me with a mixed system.

elteto 3y ago
Using the cloud is not required, you can set everything up with local access. Certain products, like Protect, do require cloud access. But not the base networking stuff.
latentcall 3y ago
I use a Firewalla with TP-Link Omada AP’s, works great. Don’t really mind the mixed system aspect. Recommend!
- awill 3y ago
  why not use an Omada gateway/router too?
apearson 3y ago
From I remember Firewalla (app only) is more dependent on the cloud than Unifi
miles 3y ago
> Firewalla seems to be a good alternative https://old.reddit.com/r/firewalla/comments/14gf1j1/major_security_breach_all_rules_ignored_and_all/ https://old.reddit.com/r/firewalla/comments/14gf1j1/major_se... https://old.reddit.com/r/firewalla/comments/177egzl/summary_of_firewalla_serious_security_bugs/ https://old.reddit.com/r/firewalla/comments/177egzl/summary_...
zzzeek 3y ago
im running unifi here and I've never dealt with any of this cloud stuff, there's a checkbox called "enable remote access" that defaulted to false for mine and I'd never check that box, so hopefully it's not actually "forced" ?

Macha 3y ago

My decision to not enable remote access feels vindicated now.

throwaway202312 3y ago

If I had to take a guess they might be using a CDN like Cloudflare and temporarily misconfigured a cache rule…

freedomben 3y ago

When people ask me why I don't use Ubiquiti products, and I tell them that I don't trust companies with closed/proprietary offerings with something as critical as this, I get a lot of skepticism and even eye-roll. Open source isn't a silver bullet, but if I were self-hosting my own "cloud" controls I wouldn't be worried about something like this.

luckydata 3y ago
honest question, who do you trust that provides either high end residential or SMB type networking gear that works well? The average residential stuff is all garbage and I was looking into unifi because seems to work better but I'm open to suggestions.
- aftbit 3y ago
  I personally run a bunch of obsolete Aruba, Juniper, and Ruckus gear at home. It works pretty well, doesn't cost very much, generally doesn't require licenses or cloud, and supports every feature under the sun. The only problem is power consumption, but I don't mind burning ~200W on my whole house's network infrastructure.
  - freedomben 3y ago
    This is a great way to go if you don't mind the power consumption and/or learning how to administer them. You can buy used Juniper equipment that went for 4 to 5 figures when it was new, for dirt cheap (2 figures). Still plenty sufficient for home use. If you've never done Juniper before it can be a bit of a learning curve, but the equipment is really solid.
- freedomben 3y ago
  This is a really hard time to be in that market. I built my own "mesh" system by deploying 3 separate routers in bridge mode, connected via ethernet (lucky that house was pre-wired). We moved to a house that didn't have that and I used powerline adapters which worked well enough, but once wifi 6 came and the true mesh systems like Google Wifi and Eero put together a system that has much better handoff (by coordinating), open source really just hasn't kept up. The powerline solution kind of sucks because it caps out for me at 20 Mbps (which is very disappointing when scp-ing a file over the LAN!). I've heard people able to get 200 Mbps through powerline, but I haven't been successful. I built a system that just used three routers each with a slightly different SSID, and a script on my laptop that would switch it to the one with the most power once it hit a certain differential threshold. That was honestly my favorite system, and what I plan to do again once my current system retires. My current system is a Protectli 4-port firewall appliance that is running AlmaLinux. It gets CGNATed by my ISP (Starlink) but I set up Tailscale (Headscale) and don't really have any issues now from CGNAT. Cockpit plus plugins provides me a good GUI, although I prefer to just SSH and use the CLI. I have two "wireless access points", one is a Linksys WRT3200ACM: AC3200 (open source edition). It's good, not great. The other is a (swallow) Google wifi. The Google wifi adds a layer of NAT in order to provide mesh. You can avoid that by putting it in hub mode but you lose wireless handoff if you use that. I've been pretty happy with that system for several years, but I'm still on the lookout for something more open that isn't a major downgrade on speed/reliability. I can more or less hot swap any WAP into place since most of the brains/config is in my Almalinux router.

tokamak 3y ago

Feels like the issue Steam had with caching https://securityaffairs.com/43189/security/steam-users-data-exposed.html https://securityaffairs.com/43189/security/steam-users-data-...

cmsj 3y ago

The real question here for me is: why is my data not flowing through Ubiquiti's servers end-to-end encrypted? They should be able to accidentally send my data to another user and have it merely result in a decryption failure.

smcleod 3y ago
I think you mean encrypted at rest (data) with you holding the decryption key not e2e (https/tls) which is from your network to their network.
rekoil 3y ago
I have been hoping for them to go this route for a while now, maybe eventually they will.

calamari4065 3y ago

I built a UniFi network 6 or 7 years ago. I was pretty excited, as the hardware seemed properly solid. A touch expensive, but I was expecting it to run forever, essentially. The hardware was actually really good from what I could tell. Not a single issue that wasn't caused by my own misconfiguration. But the software, woof. The software was designed to do exactly one thing: look impressive to execs in a board meeting. It was nearly unusable for me. I don't recall any specifics, but all you really need to know is that it took multiple days to get a simple home network with a single AP and a single router set up. It was so much effort just to log in to the damn thing. I went into this project excited at the prospect of all the cool monitoring and analytics I could do. Fancy security and remote access and whatnot. After I finally got everything configured, I never touched it again. There were a few times when I needed or wanted to get into it, but I couldn't remember the specific incantation and combination of software needed to access it, so I just didn't. I'd love to have a solid system built on quality hardware. UniFi is notionally exactly what I want, and exactly what a lot of hackers and tinkerers want. But the quality of your hardware is pretty much irrelevant if your software wasn't designed to be used by humans. So I'm stuck using consumer routers with open firmware. It's fine I guess.

riley_dog 3y ago
I run OPNsense, but use UniFi hardware. I rarely ever have to interact with the UniFi software as it's only there to configure the hardware.
- aftbit 3y ago
  OPNsense can target UniFi gear? Does it manage the switching and APs too?
  - JAlexoid 3y ago
    You use OPNsense as the router, but the rest of the equipment is managed separately. I don't know of a system that works across multiple SDN solutions.
  - teekert 3y ago

justhumanthings 3y ago

[flagged]

boeingUH60 3y ago

Random fact: Ubiquiti is publicly traded, yet Pera owns 90%+ of it, meaning shareholders virtually have no power to push for changes. You might as well call it a privately held company, lol.

barbazoo 3y ago

Easy to host the console yourself: https://help.ui.com/hc/en-us/articles/360012282453 https://help.ui.com/hc/en-us/articles/360012282453. There's even a docker image for those who have trust: https://github.com/linuxserver/docker-unifi-controller https://github.com/linuxserver/docker-unifi-controller

jonathantf2 3y ago
Not if you use their "Dream Machine" line of products - you have to use the controller that's self hosted on the box. I'm currently trying to figure out how to disable the cloud connection on these and go back to good ol' open ports to manage the thing.
- erupt7893 3y ago
  I haven't tried yet but looks like this was posted above with how to disable cloud connection https://news.ycombinator.com/item?id=38644073 https://news.ycombinator.com/item?id=38644073
  - cpburns2009 3y ago
    I have a Dream Machine Pro (UDM-Pro), and disabling remote access is as simple as finding the setting and turning it off. I disabled it on mine a while ago as an extra security measure.
Rudism 3y ago
It should be noted that the repo you linked is for a deprecated image that's losing support at the end of this year: https://info.linuxserver.io/issues/2023-09-06-unifi-controller/ https://info.linuxserver.io/issues/2023-09-06-unifi-controll... The note I link above discusses its replacement and how to upgrade.
- Khaine 3y ago
  Thanks. I didn't know about this.

sschueller 3y ago

Ah the beauty of cloud connected networks management. A hackers delight... And then I am the one that gets chastised for not wanting cloud connected router/switches in my networks.

MenhirMike 3y ago

Does anyone have a recommendation for a replacement? After the requirement to create a cloud account on their so-called "Pro" Dream Machine I already felt something is wrong, and after "Please don't use shielded Ethernet cables with our so-called "Professional" WiFi Access Points, they can randomly reboot"[1] and now this nonsense, I'm just simply done with them. But I really like the hardware of the Dream Machine Pro (Router, Switch with 10G uplink) and the overall view of clients and connected devices, so I don't just want to buy some random Router and pair it with random WiFi APs - though I guess that's the best choice? [1] https://help.ui.com/hc/en-us/articles/8823742725015-UniFi-6-Access-Point-Professional-U6-Pro-Advisory https://help.ui.com/hc/en-us/articles/8823742725015-UniFi-6-...

InTheArena 3y ago
There is no requirement to create a cloud account on the Pro machine.
- MenhirMike 3y ago
  There used to be a mandatory ui.com account when it came out. If they finally got rid of that nonsense, that's great news. And yeah, looks like the v1.1 update removed it (https://community.ui.com/releases/UniFi-OS-Dream-Machines-1-11-0/eef95803-6976-499b-9169-bf6dfbbcc209 https://community.ui.com/releases/UniFi-OS-Dream-Machines-1-...): "Allow to set up a console without an SSO account." The fact that they decided to release a "Pro" product with that requirement initially still counts heavily against them: What were they thinking, and why should I trust them if they are making such decisions?

cogogo 3y ago

Odd coincidence in that I had the same problem with Ubiquity the 401k provider several years ago. Could see most of my colleagues 401k accounts. Never good.

xyst 3y ago

UI just can’t catch a break. Earlier this year, some tech tabloid (krebsonsecurity?) reported how bad security was at UI. I think it was ultimately determined to be a bad story and UI sued for defamation. Now we are here again with another possible leak.

InTheArena 3y ago
This was multiple years ago at this point. this is why smear attacks work. Someone on a different hacker news thread today was stating that the car that blew up at the Canadian border was a Tesla (It was a bently). I've seen these types of bugs before. I think they introduced a very bad credentials or session bug. The good news is you can turn cloud off for all of these, and they work just fine.
- fragmede 3y ago
  Or how the one fire in a Tesla in Florida following a hurricane became a whole fleet of every EV in Florida spontaneously combusting. A lie can travel halfway around the world while the truth is putting on it's shoes.

op00to 3y ago

It’s unlikely that simply seeing things in the main console means you’ll be able to change things if this is a caching issue. It can still expose passwords and other internal information you don’t want to get out.

arcza 3y ago

Nice, yet another breach that doesn't affect me self hosting my Unifi controller.

everdrive 3y ago

I feel very vindicated for avoiding the cloud solution when everyone was praising Ubiquiti back in 2016 or so.

hk1337 3y ago

I tried the AmpliFi mesh router several years ago and hated it. It didn't seem any better than the Arris gateway that ATT sent me. Why would you have a central console that has the potential for accessing all the routers with a single login though? Why wouldn't this be just local to the network with remote access?

InTheArena 3y ago

https://community.ui.com/questions/Bug-Fix-Cloud-Access-Misconfiguration/fe8d4479-e187-4471-bf95-b2799183ceb7 https://community.ui.com/questions/Bug-Fix-Cloud-Access-Misc...

aetherspawn 3y ago

So what’s the alternative for SMB… Cisco? Where can we buy this stuff cheap without going through an IT company..?

BrianHutch 3y ago

https://community.ui.com/questions/Bug-Fix-Cloud-Access-Misconfiguration/fe8d4479-e187-4471-bf95-b2799183ceb7 https://community.ui.com/questions/Bug-Fix-Cloud-Access-Misc...

zzyzxd 3y ago

Ubiquiti has always been pushing the remote management feature pretty hard. But recently they are also making some really nice VPN features. I hope incident like this would further change their standpoint and actually make local account access nicer. There are tons of dark pattern in the Protect app that prevents you from using a local account. And when you finally learned to workaround all of them, you realized that there's no push notification without remote access. (I understand the difficulty to push message straight from console to mobile device, but many selfhostable software offer a centralized, managed push notification relay over internet. I am not sure if this is too much to ask for)

netsharc 3y ago

Put it on the cloud they say... Reminds me of that time someone at Dropbox pushed a change onto production that ignored your password, so you could login as anyone with any password...

malfist 3y ago
Reminds me when Dropbox pushed a change to production that opted folks into sending their files to OpenAI
mavhc 3y ago
Got a source? Can't see anything with a quick search
- netsharc 3y ago
  https://techcrunch.com/2011/06/20/dropbox-security-bug-made-passwords-optional-for-four-hours/ https://techcrunch.com/2011/06/20/dropbox-security-bug-made-... DDG and Google were useless and mostly returned pages from dropbox.com, I had to exclude results from there: https://www.google.com/search?q=dropbox+security+issue+password+check+-site%3Adropbox.com&hl=en https://www.google.com/search?q=dropbox+security+issue+passw...
yonatan8070 3y ago
Reminds me of this old talk by Tom Scott https://youtube.com/watch?v=y4GB_NDU43Q https://youtube.com/watch?v=y4GB_NDU43Q

tmikaeld 3y ago

Considering all of the shit that goes on with routers, maybe it's time to say that OpenWRT is the (only) safe-ish option at this point?

nottorp 3y ago

Hmm I should upgrade my wifi next year. Right now I have an old ish Ubiquiti AP that does its job without bothering me, but it's from before the cloud insanity. Have they seen the light and made their devices usable without ever logging into their servers? Last time I asked this question the 'cloud' was unavoidable during the initial set up but could be turned off later. This doesn't look like enough to me. I want a damn access point that doesn't talk to anything outside my network.

neilalexander 3y ago
UniFi APs can be set up in standalone mode with the help of the UniFi Network mobile apps. https://help.ui.com/hc/en-us/articles/12594679474071-Standalone-Access-Points-without-UniFi- https://help.ui.com/hc/en-us/articles/12594679474071-Standal...
- nottorp 3y ago
  Interesting info. Why does it say in step 3: 'Log in to the UniFi Mobile App (iOS / Android)' ? Log in to what? If they moved the 'cloud' requirement from the AP to the management app it doesn't mean they got rid of it.
- bouke 3y ago
  You’ll have to setup the APs individually and you’ll be missing out on various features like quick roaming.
beaviskhan 3y ago
You can keep it non-cloud as far as I know. I just bought a gen2 cloud key to replace the [persistently crappy] gen1 cloud key that I've had for ~5 years and I was able to skip the cloud login during initial setup. Of course, the devices reach out to fetch updates and whatnot, but all auth/config is held locally.
yencabulator 3y ago
> Have they seen the light and made their devices usable without ever logging into their servers? I run the management software in a VM and don't even have an account on ui.com. My firewall doesn't let the management software talk to the internet (I allow NTP and the couple of pings it wants to do, reject phone home; I temporarily allow phone home when I want to check for firmware updates).

boilerupnc 3y ago

Ubiquiti Statement: https://community.ui.com/questions/Bug-Fix-Cloud-Access-Misconfiguration/fe8d4479-e187-4471-bf95-b2799183ceb7 https://community.ui.com/questions/Bug-Fix-Cloud-Access-Misc...

mousetree 3y ago
I think it's great that they publicly took responsibility however it's not clear what controls they've put in place to not allow this to happen again.
- genmud 3y ago
  Hint: they haven't put controls in place, and it will happen again. Unifi is one of the companies with awesome potential but they just seem to whiff it constantly on security and software.
  - gunapologist99 3y ago
    Agreed. It's very difficult, and sometimes impossible, to retrofit security, especially without a huge investment. If you just don't even care enough, then you'll never get it right. Not saying that Ubiquiti is that way, but there's a reason why some companies never seem to have significant security concerns and others have an unrelenting stream of them.
- ta1243 3y ago
  My unifi controller runs in a VM, The APs have no access to anything but that VM. Wondering if I should limit outgoing traffic from my controller.
  - nullify88 3y ago
    I believe the controller can be configured to be accessible via the cloud UI, but it isn't the default. At least thats the behaviour when configured with a local user.

boilerupnc 3y ago

Ubiquiti Statement: https://community.ui.com/questions/Bug-Fix-Cloud-Access-Misconfiguration/fe8d4479-e187-4471-bf95-b2799183ceb7 https://community.ui.com/questions/Bug-Fix-Cloud-Access-Misc...

gunapologist99 3y ago

The cloud is still just someone else's computer. (Or camera.)

farmdve 3y ago

The cloud is like those portable toilets in public. They are private, but there are also people around you at all times. Sometimes you forget to lock the door and someone else opens it.

driverdan 3y ago
I like this analogy. They're full of shit and you only use them if you have absolutely no alternatives.
sebazzz 3y ago
Are you meaning to say that a big accident in a public cloud like AWS or Azure is waiting to happen? I did have something weird the other day in AWS. I was accessing a K8S hosted website in my clients tenant, and I got an SSL handshake issue. Turns out the certificate served wasn't of my clients website, but of some dev-xxxx.polar.com. That environment wasn't externally accessible as the domain cannot be resolved in public DNS and I assume that the environment itself is also shielded. After refreshed, the issue was gone and I could access the client site again.
- inemesitaffia 3y ago
  Azure in particular

cturner 3y ago

My parents live in another country, and I want to set up some network equipment at their house so that I can coordinate their network if they get into trouble, and to support cameras as one of them has become high-care. My dad also has some complex data. I intend to install a rackmount server for him so that I can help him with data problems from time to time. For network equipment, I have a fair bit of experience with datacentre grade equipment, but none in the consumer space. I think I want this, 1. Good quality. 2. Fanless 3. Drives multi-node wifi APs 4. Control cameras 5. Web interface that parents can use. 6. Cisco-like CLI that I can use. 7. No cloud. The unifi equipment seems to fit all criteria above except the last two points. Seems you cannot make permanent changes from the console, and their offering is oriented towards cloud configuration. Would someone who knows the segment be happy to offer advice? (thanks in advance)

qsi 3y ago
I run my own Docker image for the Unifi server, no cloud needed. The CLI is limited though but I can ssh into my switches and router. I haven't used their camera offerings though.
wpm 3y ago
I have a UniFi AP and a 24-port 10G switch from Ubiquiti. As far as 6. goes, you are sadly correct. It’s all Linux underneath so there are plenty of changes you can make in the CLI, but the middleware will happily stomp all over it at the next upgrade or reboot. For no cloud, it’s quite easy to avoid. The middleware can be spun up in a container or installed on any Linux VM and have no access to Ubiquiti’s servers at all and it’ll work fine (you’ll have to upload updates yourself). However, the product will be full of little nagging notices coaxing you into going to the cloud, or as in my case, getting mad you aren’t using a UDM for your router/firewall and turn off a bunch of the L3 features. The software is meme-level in how many bad patterns and form-over-function decisions are in it. Cloud or no, it’s frankly kinda crap. The APs are solid, but I’ll likely not buy another switch from them if I can help it. Depending on your needs, there is plenty of used enterprise gear to be had for quite cheap on eBay. But, I’m in the market for a fat 48-port switch with a huge PoE budget and they have one that’s all 2.5G. I don’t know that anyone else makes one, and if they do, it’s three times the price, or I have to call some sales person to talk about it, or the actual existence of the product is impossible to surmise through thick marketing wank datasheets.

LeifCarrotson 3y ago

Navigate to your router's IP, go to Console Settings, scroll to Advanced and un-check Remote Access: https://i.imgur.com/RzXpT6Q.png https://i.imgur.com/RzXpT6Q.png After doing that, you can't access your router remotely from The Cloud, (well, you can log in over the VPN, remote into a computer on-site, and access the router from that computer) but you're secure against a whole class of bugs and errors in Someone Else's Computer.

a_subsystem 3y ago
I set up nginx to point to my UDMP's 443 port via a subdomain of mine. Unsure if this is horrible security but I don't have 'Remote Access' turned on. I guess at worst it relies on UniFi OS security and auth to be solid?
- wil421 3y ago
  I setup a domain from name cheap and pointed a subdomain towards my routers IP. Then I VPN using Unifi to control it. I cancelled the domain and use the IP but I’ve found it does change from time to time. Unifi’s firewall blocks a ton of IPs whenever I open a port for plex or whatever. I’ve tried to fight back against US providers letting anyone with a VM run port scans but they only care about getting paid.
millzlane 3y ago
Before all this cloud stuff you could just run the ubiquiti protect suite on a linux box. But then they discontinued it and the ios app to push their cloud offerings on people.
keep_reading 3y ago
If you're running UniFi on FreeBSD/OpenBSD it won't even allow cloud access because their Java websocket library for it doesn't include support for anything but Mac/Win/Linux

28304283409234 3y ago

Mikrotik is the way.