6 ms·

So the guy makes the initial post, within an hour UI team reaches out to him to gather more info and the next post is a criticism of their handling! What’s wro

So the guy makes the initial post, within an hour UI team reaches out to him to gather more info and the next post is a criticism of their handling! What’s wrong with people? I think 1 hour response to a forum post isn’t unreasonable or am I wrong?

jbverschoor 3y ago
And nothing for 16hrs. So probably there is something wrong. And it’s seems pretty critical. Status page doesn’t show anything
- WesolyKubeczek 3y ago
  I don't know if it's expected of status pages to signal security incidents and bugs if you technically can still use your (and other people's) console. (Putting on buck teeth and fidgeting with something) But but but akchyually, it's not an outage, you see.
  - PeterisP 3y ago
    If other people can access your console, then this feels like a case where it's negligent not to have an intentional outage, shutting down all remote access to all cloud consoles until this is fixed.
    - WesolyKubeczek 3y ago
      I don’t know, imagine relying on remote access and one day when you absolutely need to log in and do your thing you suddenly cannot because the breach and they turned it off for everyone. And to get on site it’s a 8-hour commute, or you have to cross a border or two, or you need a visa to get there. Or anything at all which necessitated remote access in the first place.
- Petersipoi 3y ago
  Why would users want them to advertise a vulnerability on the status page before the issue is fixed? I would want them to keep this as quiet as possible until the issue is resolved.
  - x0x0 3y ago
    To enable workarounds and/or stop the bleeding. There's many places where no network is strongly preferable to network that could be open to hackers.
    - JAlexoid 3y ago
      I mean... It's not even "no network". Once the management connection is severed the network equipment doesn't stop operating at all.
  - Ekaros 3y ago
    All users should be informed so they can decide if to pull the plug or not on their devices...
- boilerupnc 3y ago
  Ubiquiti Statement: https://community.ui.com/questions/Bug-Fix-Cloud-Access-Misconfiguration/fe8d4479-e187-4471-bf95-b2799183ceb7 https://community.ui.com/questions/Bug-Fix-Cloud-Access-Misc...
alsodumb 3y ago
Nothing's wrong with people angry about this. What's wrong with the company letting it happen in the first place?
bastardoperator 3y ago
If someone was actively stealing your car, and 911 told you they're an hour out, would that be acceptable? Having carte blanche access to someone else's network equipment seems like the highest emergency a company like Ubiquity could have. I don't know if the time frame is acceptable, but I know I would have reached out to the customer versus waiting around for a DM once the alarm was rung.
- wannacboatmovie 3y ago
  > If someone was actively stealing your car, and 911 told you they're an hour out, would that be acceptable? In Seattle they don't even show up anymore, they tell you to fill out a form online...
  - simfree 3y ago
    You have to search the streets yourself and be your own advocate if you want to recover your stolen car. In the last 8 years SPD has become completely unmotivated to do their job despite never having their budget cut. Adjacent police departments like Kirkland and Lake Forest Park are much more willing to do their job, but they fire officers who don't do their job, while SPD retains these caustic, non-performing officers. So long as we let our officers in Seattle getaway with billing fraudulent hours that weren't worked, ignoring core job duties, and slow rolling the duties that they do do, we will be stuck with an ineffective police force.
    - ImJamal 3y ago
      >In the last 8 years SPD has become completely unmotivated to do their job despite never having their budget cut The budget was absolutely cut. https://apnews.com/article/business-police-seattle-6730ec66ebc8ea9b5c443c0b1c34aa5b https://apnews.com/article/business-police-seattle-6730ec66e...
      - Arnavion 3y ago
        >The Seattle City Council has approved a 2022 budget that cuts police department spending from previous years [...] 2022 was not 8 years ago.
bdcravens 3y ago
Update the status, and discuss it more in the open. Obviously with any security issue there's reasons to keep some discussions private, but it feels like they're attempting to minimize it, the same way a restaurant doesn't want their customers to hear about the mice in the kitchen. https://status.ui.com/#past-incidents https://status.ui.com/#past-incidents still says "no incidents reported today"
- boilerupnc 3y ago
  Ubiquiti Statement: https://community.ui.com/questions/Bug-Fix-Cloud-Access-Misconfiguration/fe8d4479-e187-4471-bf95-b2799183ceb7 https://community.ui.com/questions/Bug-Fix-Cloud-Access-Misc...
  - bdcravens 3y ago
    If they're not going to update the status page, then it's a liability and should be taken down.
alt227 3y ago
I think you are missing the point. the point is this should never ever happen in whats considered to be SMB enterprise products. Peoples businesses and livelihoods are at stake. The fact that it did happen is bad enough, the rest is just the icing on the cake. you made the point about a 1 hour response, howewver 18 hours after that response there is still no update anywhere for lots of worried customers. If Ubiquiti was my company and this post was posted on my forum, I would be having status messages/emails out to all my customers, updates on status pages, warnings on website logins etc. Hiding this in a private DM with a single customer is terrible, and they even told the world thats what they were doing which was a kick in the nuts.
tw04 3y ago
If I reported to a vendor that I had unfettered access to other people's cloud console, and it was the fourth such report, I'd expect them to shut down access to the console until they figure out what's going wrong. Instead, they're "looking into it" or something? I guess they'll just hope nobody does anything nefarious like change the passwords on every switch/router/AP they have access to then get remote access?
- deleted 3y ago
  [deleted]
- emilyst 3y ago
  Imagine being able to shut off all Ubiquiti console access in the world instantly, by posting about a grave security issue (real or not) and having a few compatriots to do the same in a short amount of time. You could trivially block a business's access to its own security cameras on a moment's notice, among other things. If the response to an unverified issue were "just shut everything down" you effectively have implemented an exploitable DoS in your own incident policy.
  - cyral 3y ago
    I was typing exactly this when I saw your comment. This could very well be a real issue, but could also be a nefarious attack or even just incompetence. I've done support before and there are always users convinced that they are "hacked" or that we are doing something shady because they forgot their friend logged in on their device or forgot that they actually made two accounts in the past.
  - tw04 3y ago
    This was posted 18 hours ago. If you can't either verify the user has actual access to other people's consoles (at which point you should be immediately turning access off) in 18 hours, then you should probably just close up shop because you have no business providing remote access to a can of soup much less someone's firewall. If the user in question was making it up, you should also have posted within minutes of discovery that the user in question (and multiple other people) were making false claims. Again, they've chosen the "we're looking into it" route which is always reassuring.
deleted 3y ago
[deleted]

jbverschoor 3y ago

And nothing for 16hrs. So probably there is something wrong. And it’s seems pretty critical. Status page doesn’t show anything

WesolyKubeczek 3y ago
I don't know if it's expected of status pages to signal security incidents and bugs if you technically can still use your (and other people's) console. (Putting on buck teeth and fidgeting with something) But but but akchyually, it's not an outage, you see.
- PeterisP 3y ago
  If other people can access your console, then this feels like a case where it's negligent not to have an intentional outage, shutting down all remote access to all cloud consoles until this is fixed.
  - WesolyKubeczek 3y ago
    I don’t know, imagine relying on remote access and one day when you absolutely need to log in and do your thing you suddenly cannot because the breach and they turned it off for everyone. And to get on site it’s a 8-hour commute, or you have to cross a border or two, or you need a visa to get there. Or anything at all which necessitated remote access in the first place.
Petersipoi 3y ago
Why would users want them to advertise a vulnerability on the status page before the issue is fixed? I would want them to keep this as quiet as possible until the issue is resolved.
- x0x0 3y ago
  To enable workarounds and/or stop the bleeding. There's many places where no network is strongly preferable to network that could be open to hackers.
  - JAlexoid 3y ago
    I mean... It's not even "no network". Once the management connection is severed the network equipment doesn't stop operating at all.
- Ekaros 3y ago
  All users should be informed so they can decide if to pull the plug or not on their devices...
boilerupnc 3y ago
Ubiquiti Statement: https://community.ui.com/questions/Bug-Fix-Cloud-Access-Misconfiguration/fe8d4479-e187-4471-bf95-b2799183ceb7 https://community.ui.com/questions/Bug-Fix-Cloud-Access-Misc...

alsodumb 3y ago

Nothing's wrong with people angry about this. What's wrong with the company letting it happen in the first place?

bastardoperator 3y ago

If someone was actively stealing your car, and 911 told you they're an hour out, would that be acceptable? Having carte blanche access to someone else's network equipment seems like the highest emergency a company like Ubiquity could have. I don't know if the time frame is acceptable, but I know I would have reached out to the customer versus waiting around for a DM once the alarm was rung.

wannacboatmovie 3y ago
> If someone was actively stealing your car, and 911 told you they're an hour out, would that be acceptable? In Seattle they don't even show up anymore, they tell you to fill out a form online...
- simfree 3y ago
  You have to search the streets yourself and be your own advocate if you want to recover your stolen car. In the last 8 years SPD has become completely unmotivated to do their job despite never having their budget cut. Adjacent police departments like Kirkland and Lake Forest Park are much more willing to do their job, but they fire officers who don't do their job, while SPD retains these caustic, non-performing officers. So long as we let our officers in Seattle getaway with billing fraudulent hours that weren't worked, ignoring core job duties, and slow rolling the duties that they do do, we will be stuck with an ineffective police force.
  - ImJamal 3y ago
    >In the last 8 years SPD has become completely unmotivated to do their job despite never having their budget cut The budget was absolutely cut. https://apnews.com/article/business-police-seattle-6730ec66ebc8ea9b5c443c0b1c34aa5b https://apnews.com/article/business-police-seattle-6730ec66e...
    - Arnavion 3y ago
      >The Seattle City Council has approved a 2022 budget that cuts police department spending from previous years [...] 2022 was not 8 years ago.

bdcravens 3y ago

Update the status, and discuss it more in the open. Obviously with any security issue there's reasons to keep some discussions private, but it feels like they're attempting to minimize it, the same way a restaurant doesn't want their customers to hear about the mice in the kitchen. https://status.ui.com/#past-incidents https://status.ui.com/#past-incidents still says "no incidents reported today"

boilerupnc 3y ago
Ubiquiti Statement: https://community.ui.com/questions/Bug-Fix-Cloud-Access-Misconfiguration/fe8d4479-e187-4471-bf95-b2799183ceb7 https://community.ui.com/questions/Bug-Fix-Cloud-Access-Misc...
- bdcravens 3y ago
  If they're not going to update the status page, then it's a liability and should be taken down.

alt227 3y ago

I think you are missing the point. the point is this should never ever happen in whats considered to be SMB enterprise products. Peoples businesses and livelihoods are at stake. The fact that it did happen is bad enough, the rest is just the icing on the cake. you made the point about a 1 hour response, howewver 18 hours after that response there is still no update anywhere for lots of worried customers. If Ubiquiti was my company and this post was posted on my forum, I would be having status messages/emails out to all my customers, updates on status pages, warnings on website logins etc. Hiding this in a private DM with a single customer is terrible, and they even told the world thats what they were doing which was a kick in the nuts.

tw04 3y ago

If I reported to a vendor that I had unfettered access to other people's cloud console, and it was the fourth such report, I'd expect them to shut down access to the console until they figure out what's going wrong. Instead, they're "looking into it" or something? I guess they'll just hope nobody does anything nefarious like change the passwords on every switch/router/AP they have access to then get remote access?

deleted 3y ago
[deleted]
emilyst 3y ago
Imagine being able to shut off all Ubiquiti console access in the world instantly, by posting about a grave security issue (real or not) and having a few compatriots to do the same in a short amount of time. You could trivially block a business's access to its own security cameras on a moment's notice, among other things. If the response to an unverified issue were "just shut everything down" you effectively have implemented an exploitable DoS in your own incident policy.
- cyral 3y ago
  I was typing exactly this when I saw your comment. This could very well be a real issue, but could also be a nefarious attack or even just incompetence. I've done support before and there are always users convinced that they are "hacked" or that we are doing something shady because they forgot their friend logged in on their device or forgot that they actually made two accounts in the past.
- tw04 3y ago
  This was posted 18 hours ago. If you can't either verify the user has actual access to other people's consoles (at which point you should be immediately turning access off) in 18 hours, then you should probably just close up shop because you have no business providing remote access to a can of soup much less someone's firewall. If the user in question was making it up, you should also have posted within minutes of discovery that the user in question (and multiple other people) were making false claims. Again, they've chosen the "we're looking into it" route which is always reassuring.

deleted 3y ago

[deleted]