Ubiquiti is suing Brian Krebs for his reporting on their breach

https://krebsonsecurity.com/2021/12/ubiquiti-developer-charg...

What part of that update is incorrect? Naming that update is not going to help their case, at all.

This lawsuit is likely doing the exact opposite of what Ubiquiti expected.

Before the lawsuit, I had some sympathy that they got jerked around by an ex-employee with major access and took it in the shins. I'm kind of in the glass houses and stones camp ... I doubt very many companies could withstand a high-level technical person going rogue. They found the problem. Now they're pursuing charges against him and that's rattling through the legal system. Sure, there's lots of reputational damage, but that's the kind of thing that happens when you centralize management of things--it makes them a high profile target (see: Solarwinds).

However, the lawsuit against a reporter is causing me to pause and think "Wow. Maybe they're actually institutionally incapable of recovering from this, worried that something else might get exposed and really do suck."

The lawsuit moved me from slightly sympathetic to Ubiquiti into "What kind of idiots think this is a good idea?" and looking for alternatives.

I'd entirely forgotten about the Ubiquiti breach until today.

From my perspective this lawsuit looks like they've Streisand Effected the fact that they let their internal security be even worse than the initial accusations.

It's like finding out your financial advisor had all your money stolen, which is bad enough, and then it turns out it's because they gave their gardener the password to your bank account.

Genuine question.

It seems to me that Krebs might be in a position to claim:

1. He honestly reported the facts as were made available to him.

2. Either:

A. He didn't know his original source was Sharp (quite feasible that Sharp disguised this)

Or

B. He did know his original source was Sharp, but felt compelled to continue to protect his source despite charges having been brought (innocent until proven guilty).

3. He took the view was that nothing in the revelation of this hack as an inside job casts doubt on his initial reporting, which was about Ubiquity's response to the incident not the attacker's identity.

We should at least wait to read the defence before drawing any conclusions.

If this comment from a former employee is correct then no, he had root access to a bunch of stuff for no good reason and their security stance is abysmal.

Nobody should have the root aws tokens. They should be split between two teams and stored in a safe & access should go through another method that is audited

https://news.ycombinator.com/item?id=29456593

Criminal Accusations <> Facts until proven in a court of law. All Krebs knows at this point is Sharp was arrested.

And what we all don’t know at this point is whether Ubiquiti is competent enough to have unfettered access to all their customer networks because they failed to defend against insider threats.

It's like Okta. Of course it's hard to protect against an insider ( although Ubiquti didn't really try), but that's not an excuse to screw up the disclosure.

This is just more and more embarrassment for a company that clearly just doesn't understand security, and yet wants to force all their users of their products to rely on them as a trust model by making all of their ongoing product systems completely cloud reliant or at least holding third party root keys to sell ads / customer telemetry.

And yet, enterprise-level suppliers do it successfully every day.

"Within five years of the appointment of a business manager, wages decline by 6% and the labor share by 5 percentage points in the US, and by 3% and 3 percentage points in Denmark. Firms appointing business managers are not on differential trends and do not enjoy higher output, investment, or employment growth thereafter."

That said, I am really excited about their forthcoming pre-paired PTP Gigabit link kit. I have been using ancient Ubiquiti paired links and need a replacement.

Late last year I kitted out my home with a switch and two wireless access points.

The switch (S3410-10TF-P) does everything that you expect a switch to do. It has a pretty simple web interface, and a pretty comprehensive CLI.

The access points are AP-W6T6817C (6800mbps WiFi 6, 802.11ax). It is rebranded from Ruijie Networks. The access points have a simple web UI for configuring everything, the range is pretty awesome. Multiple radios can be configured with separate SSIDs that have access to different VLANs.

The usability is less than Ubiquiti, but it seems that they work a little better than my old UniFi setup that this replaced (though, that was purchased more than 8 years ago).

There's WPA3 support.

Getting data via SNMP into Prometheus means that you can see per-client usage history, too.

Edit:

Access Point AP-W6T6817C: https://www.fs.com/products/108707.html

Switch S3410-10TF-P: https://www.fs.com/products/115387.html

for home use at this point I would also recommend mikrotik routers over anything ubiquiti edgeOS based, since they seem to have abandoned development on their fork of vyatta... the $50 edgerouter-x (ER-X) as a standalone wired gigabit router was a good choice in 2017 but not so much anymore.

are these any good? has anyone had any luck with going full oss for this stuff?

So now, suing a journalist is going to fix their reputation? Good luck with that, there's around zero chance of that happening. The way to fix their reputation would be to consolidate product lines, do QA and not ship broken software, and stuff like this. Admit mistakes were made, and outline their strategy on fixing them ( the parts about abandoning hardware lines and security). Digging in won't do them any favours.

https://community.ui.com/questions/CloudKey-Gen2-or-setup-wi...

open the management ports up to the internet (not the default) and be running a firmware prior to April 2018 (or be using a default password)

(1) SSH into you box for shell and use the command line interface (2) Use the comprehensive web interface (3) use the shell tool in the web interface (4) use wine to run the client

If you read carefully, Ubiquiti did not say that no customer data was accessed, they said they have no evidence that customer data was accessed. The first article Krebs wrote quotes the employee (likely the person arrested) saying that this was because they didn't keep logs long enough (this fact was confirmed in Ubiquiti's complaint). That it was the person accessing the data who was able get rid of logs showing the data accessed doesn't change the lack of logs. It was externally breached in the sense that an empoloyee downloaded the data from outside the company and could have done anything with it prior to being caught (and could potentially have it stashed somewhere for later use). Ubiquiti also never denied that legal overrode technical considerations in not forcing all accounts to be reset. The initial reporting was substantially correct and the post was updated when new information was available.

https://krebsonsecurity.com/2021/03/whistleblower-ubiquiti-b...

One thing that might be slightly comforting for customers is that Ubiquiti claims in the March 31 update (linked from the first article and quoted in the last comment on that article) that customer data was never mentioned in negotiations, although that is a specific detail not just who accessed the data. There are potentially some theoretical reasons someone attempting economic sabatage as an empoloyee might be less likely to access customer data (e.g. the average attacker might be more likely to be in a legal jurisdiction where they are unlikely to ever face a judge while an employee in the US may want to be able to tell a judge that they didn't access customer data if they get caught), but I wouldn't count on that at all or make any distinction about what to do based on the employment status of the person who accessed the data (if employees stealing data were less likely to release customer data in gerneral they might decide to do so for no other reason than to look less like an employee stealing data). Sounds like you took reasonable steps. Most if not all companies are breached at times, a company that has no disclosed breaches almost certainly just has a policy of never disclosing them.

This does not seem completely obvious. He uses "Ubiquiti employee" as the source of his first story, and then "former Ubiquiti developer" as the guy who was arrested when it was published. These are two different descriptions used just a sentence away from each other, making it sound like two different people were involved.

Or use OpenBSD (unixsheikh has a guide) or Linux (Vyos, OpenWRT, etc).