4 ms·

I think it's great that they publicly took responsibility however it's not clear what controls they've put in place to not allow this to happen again.

genmud 3y ago
Hint: they haven't put controls in place, and it will happen again. Unifi is one of the companies with awesome potential but they just seem to whiff it constantly on security and software.
- gunapologist99 3y ago
  Agreed. It's very difficult, and sometimes impossible, to retrofit security, especially without a huge investment. If you just don't even care enough, then you'll never get it right. Not saying that Ubiquiti is that way, but there's a reason why some companies never seem to have significant security concerns and others have an unrelenting stream of them.
ta1243 3y ago
My unifi controller runs in a VM, The APs have no access to anything but that VM. Wondering if I should limit outgoing traffic from my controller.
- nullify88 3y ago
  I believe the controller can be configured to be accessible via the cloud UI, but it isn't the default. At least thats the behaviour when configured with a local user.
  - ta1243 3y ago
    Absolutely, but I do wonder if I should belt and braces it. Just because it shouldn't contact a cloud doesn't mean it doesn't.
- T3OU-736 3y ago
  If you have an easy way to do so, you should. Possibly even proxy the traffic via something able to do SSL strip/re-encrypt and monitor that traffic with an IDS.
  - ta1243 3y ago
    I always make an assumption that people writing nefarious communication will check SSL certificates and thus MITMing it would only work if I can load a root certificate (which typically is only doable on proper devices like phones and laptops, and I don't like the extra risk of having a wide open root that I've generated and have to keep secure on my devices as I don't trust myself enough) However speaking to some people at work who have had experience in the past, seems most malware (and that includes IOT devices) doesn't bother validating certificates or things like ESNI and (validated) DOH, so there's a lot you can find out without breaking TLS, due to the lazineess/incompetence of the malware writers.

genmud 3y ago

Hint: they haven't put controls in place, and it will happen again. Unifi is one of the companies with awesome potential but they just seem to whiff it constantly on security and software.

gunapologist99 3y ago
Agreed. It's very difficult, and sometimes impossible, to retrofit security, especially without a huge investment. If you just don't even care enough, then you'll never get it right. Not saying that Ubiquiti is that way, but there's a reason why some companies never seem to have significant security concerns and others have an unrelenting stream of them.

ta1243 3y ago

My unifi controller runs in a VM, The APs have no access to anything but that VM. Wondering if I should limit outgoing traffic from my controller.

nullify88 3y ago
I believe the controller can be configured to be accessible via the cloud UI, but it isn't the default. At least thats the behaviour when configured with a local user.
- ta1243 3y ago
  Absolutely, but I do wonder if I should belt and braces it. Just because it shouldn't contact a cloud doesn't mean it doesn't.
T3OU-736 3y ago
If you have an easy way to do so, you should. Possibly even proxy the traffic via something able to do SSL strip/re-encrypt and monitor that traffic with an IDS.
- ta1243 3y ago
  I always make an assumption that people writing nefarious communication will check SSL certificates and thus MITMing it would only work if I can load a root certificate (which typically is only doable on proper devices like phones and laptops, and I don't like the extra risk of having a wide open root that I've generated and have to keep secure on my devices as I don't trust myself enough) However speaking to some people at work who have had experience in the past, seems most malware (and that includes IOT devices) doesn't bother validating certificates or things like ESNI and (validated) DOH, so there's a lot you can find out without breaking TLS, due to the lazineess/incompetence of the malware writers.