Ubiquiti accused of covering up ‘catastrophic’ breach– and it’s not denying it

I think the story here (at least my intent when I submitted it) was that Ubiquiti released a "statement" in response to the Krebs article and, distressingly, they don't seem to challenge any of the article's core assertions. Their response seems to be "Oh, um, yes...that happened. But hey! We don't think they accessed any customer information! So...please stop looking at this."

> Is anyone monitoring their Ubiquiti devices in their homelabs to watch for any suspicious traffic?

With modern software good luck filtering suspicious noise from signal.

The problem is that UBNT now requires you to cloud-enable many of their modern devices as part of the setup process. You can later disable that after setup, but I think it's safe to assume most people don't know that (they certainly don't go out of their way to tell you that), and even fewer people will go through the effort.

So, this hack also implies that a substantial number of devices out there now have their remote admin credentials leaked to an unknown, presumed malicious, third party.

Not to discount the threat, but 'vms spun up in their cloud' is ...exactly what coinminining attackers do. It's so frequent, it's even called out as a 'thing to watch your bill to notice' in amazon security talks/etc. Gain access, launch N VM's, where N is as many as your credential and the cloud account limits in place allow, mine coins 'for free', and move on.

>That doesn't look like someone just tooling around to me, that looks like someone recreating a build process.

This is quite the leap in logic.

While my controller is on 6.0.43 and APs (uap-ac-lite and uap-ac-hd and uap-pro gen1) are on the corresponding firmware.

I believe this controller version is December 2020 and predates the January issue disclosure date(though possibly not the incident).

I have suricata taps on my net that are clean. Aps and controller are predictably trying to get to their telemetry call homes but nothing more.

That said my Ubnt controller and aps have almost no internet access and haven’t for a long time. I only enable it when performing upgrades and disable it.

I’ll pull the firewall logs and see specifically the IPs they are attempting to hit.

What did you replace? With what?

MikroTik is always saying delayed shipping. Amazon has been the only place I’ve seen them in stock but from 3rd party sellers.

MikroTik isn’t even in the same league as UniFi. Their interfaces and docs are terrible. The only reason I ever considered buying something from them is because they had a good price for a 10gb switch. If you want a dumb device you can’t beat their price.

Check out a few of the reviews on Amazon. Seed and Don’s reviews are very critical.

https://www.amazon.com/dp/B07NFXN4SS

Are MikroTik access points still a royal pain to configure and maintain? I use their switches, but not their APs.

Decades ago, I was a network engineer working in production data centers. I’m used to setting up switches manually. But I have no professional experience with setting up meshed WiFi networks. I like that the Ubiquiti APs “just work” for the most part.

I’ve started to notice weird AP/client failures with my ubiquiti gear and debugging is a nightmare. It seems that ubiquiti has hidden a lot of useful information in an overzealous effort to streamline UX.

That's just MikroTik, their shipping is always wonky / not what we're used to with other consumer electronics.

> Yesteday I ordered new MicroTik gear to replace the last of my Ubiquiti gear only to find there's a two week wait for it to be shipped!

I've never seen any Mikrotik product available to ship, it's always on back order. I've even had resellers call me up and offer alternatives because my order was on back order.

I'm strongly considering OpenWRT on PC Engines hardware for my next AP.

Grab one of these:

https://www.amazon.com/dp/B01H2QJTM4/ref=cm_sw_r_cp_apa_glc_...

And put Opnsense on it.

Guaranteed security updates, clean GUI interface, open source. Set it up once then forget it.

If you want an AP there are many options on Amazon. For maximum security prevent the AP from being able to access the internet.

Did Cisco bother to launch proper replacement for ISR C1812/892J? Looks like there are ISR 900 series but not sure they’re worthy... In my country there are Yamaha NVR/RTX lines but not sure those are sold worldwide

Just make sure the rtl8125b NICs are actually supported by what you want to run; they're relatively new . And poor driver performance will be magnified by the low power CPU at those speeds.

I bought an H2+ sometime last year to use as a router but struggled to get acceptable networking performance, so moved onto something else.

They will get involved as much as they have with every other breach — i.e. not at all. Even Equifax only got an extremely minor dog and pony show for the complete disaster they created.

Agreed.

I often tell people when they ask for company/product recommendations that I can only really recommend somebody after they've screwed up.

Any company can deliver product without hassle, but the ones you want to trust are the ones who handle mistakes properly. In this case, I just lost all my confidence in Ubiquiti because they've done the worst thing when it comes to maintaining my trust, lie and deceive.

I'm in the same boat. I bought my Edge Router Lite probably 8 years ago and it's easily been the best $99 I ever spent on networking gear and it's still working amazingly well. Before the Edge Router I couldn't imagine having a home network that didn't need a router reboot once/week.

I've grown into many of the ER features over the years. Also fun fact - the storage is literally a USB flash drive plugged into a standard USB-A port under the cover! (which is totally upgradable). I will forever be impressed with this product.

I'm hoping this spurs the board to oust the CEO who seems to be the one getting the blame for Ubiquiti's shift in recent years away from making highly reliable prosumer focused products to pushing half-baked cash grabs out the door.

You can also imagine an executive team trying to shift suspicion towards the whistleblower, who happens to be an individual with intricate knowledge of their cloud infrastructure.

I've looked, haven't found anything clearly better. Just got a Unifi Wifi-6 LR AP. Seems reasonable to just block APs from internet traffic and run the AP management software locally (also with traffic blocked from the internet).

If you find something better, please post.

You really will likely need multiple APs. one of the consume mesh setups like eero or orbi or whatever will help

I'm going to agree with ehutch on this. Don't try to cover a multi story house with a single AP. Would you attempt to cover the house with one music radio? No, it would be way to loud near the stereo and way too quite far away. Also you spill signal into neighbour's location and blast excess noise into the spectrum.

3 APs on a lower setting would give you much better performance.

Last year, I installed an Orbi Wifi 6 system in my parent's three-storey house. And I'm using the older RBK50 version myself with an ethernet backhaul. For consumer products, both are pretty good and offer fast and stable wifi. I'm not running a complex home network so consumer-grade hardware is good enough for me. That said, I've no idea if Netgear is better than Ubiquiti at a company level. I've noticed that many people here are usually fairly critical of Netgear.

I'm in a multi-level home. Previously I had 1 centrally located Ruckus AP. Its signal was strong everywhere (solid RX signal strength), but devices could not transmit strongly enough back to the AP.

In the end I went with 3 Unifi APs + a controller. You can use wired or wireless for backhaul. The main thing is that the APs have to be able to communicate with each other.

There isn't a great way to test out the wireless backhaul without buying the equipment. I suppose you could use a scanner to test the RX signal strength with your AP in varying places. If the 2.4/5ghz signal is strong in the (AP, scanner location) pairs then you know the APs might be able to talk to each other.

If you're looking for a less work setup, the Amplifi line, or Eeros might work.

I don't use their cloud. I have a router, 2 switches, and 2 APs from the Unifi line. I run the controller software on one of my servers and nothing phones home out of my LAN. The APs have good coverage, everything is very reliable (as long as you don't upgrade to new firmware), and there single pane of glass management console provided by the controller software is awesomely convenient with just enough options and features for my needs. but all of this hardware is a few years old now and no longer what they want to sell.

Ubiquiti doesn't have to go to the cloud. I manage my Ubiquiti stuff locally. The reason I bought Ubiquiti is because they offered pro-ish level quality and reliability at closer to consumer prices. At a time when the only consumer options were pretty crappy, Ubiquiti offered higher quality at a small premium without having to go all the way to Cisco APs, for example. I haven't really bought any new gear for several years, so I don't know if the landscape has changed.

Ubiquiti works fine without the cloud, the cloud key/cloud management stuff seems to have a fair bit of user demand. Especially for consultants helping network trailer parks/motels/universities, etc.

I like ubiquiti because it's pretty flexible, powerful, I can keep config files in git, IPv6 support is good (I have a /64 per router port), and I can separate router and APs, and handle multiple APs well (without mesh/forwarding).

For me the cloud is a selling point. Though one that I'm now reconsidering after all this news.

I have been a Ubiquiti customer and proponent for a few reasons:

1. I have two houses, and the cloud feature lets me easily connect to and manage my devices at the other house when I'm not there. Not a frequent use case, but it does happen, and this just makes it easier. Sure I could setup some other remote access options, but this just works out of the box. I also have their security cams and I can easily monitor those remotely, though the video is stored locally at that location.

2. They occupy a middle between consumer gear and enterprise gear. Giving you flexibility and features that you can't really find in consumer gear.They have a fairly wide and frequently updated product line. One house has ethernet jacks in every room, and for a couple of rooms, I replaced those jacks with Unifi In-Wall HD access points. These are great because they are out of the way, you don't notice them, and they still provide wired ethernet ports. So my office has strong Wifi but I also connect my desktop PC to Gig ethernet via the in-wall AP.

At the other house I use the Flex HD access points connected to MOCA adaptors (the one part of my network not made by Ubiquiti) and just tuck them out of the way.

3. They have a fairly well integrated set of products. I have routers, gateways, switches, and APs, all discrete devices, but managed from the same interface. Managed on the web or on my phone. If I add a new AP to a location, I can just adopt it into the network using the app on my phone, the firmware gets updated and it becomes fully managed, taking on the default settings for that site.

All that said, I still really like their product lines, but this episode made me lose a lot of trust.

I have an Archer which stops handling non-VPN traffic multiple times a month and seems to drop telnet packets. I'm done with TP-Link.

I think part of the problem is that effectively everybody has flaws, so you're forced to choose who has the least-broken approach for your needs...and you can't do that without a lot of research.