Hacker News Reader

Comment by boilerupnc | Hacker News Reader

Ubiquiti Statement: https://community.ui.com/questions/Bug-Fix-Cloud-Access-Misc...

It's great that they are open about it, but it does make me seriously question the design of their cloud infrastructure and backend systems.

Overall I found the statement to be solid. I would like a more detailed follow up analysis to demonstrate they actually did more then just roll back to last version and make a bug fix of the root cause.

There should be changes to their release process to test and ensure this won’t happen. Also, I’d like to see a real root cause analysis of some sort.

I think it's great that they publicly took responsibility however it's not clear what controls they've put in place to not allow this to happen again.

Hint: they haven't put controls in place, and it will happen again.

Unifi is one of the companies with awesome potential but they just seem to whiff it constantly on security and software.

Agreed. It's very difficult, and sometimes impossible, to retrofit security, especially without a huge investment.

If you just don't even care enough, then you'll never get it right. Not saying that Ubiquiti is that way, but there's a reason why some companies never seem to have significant security concerns and others have an unrelenting stream of them.

My unifi controller runs in a VM, The APs have no access to anything but that VM. Wondering if I should limit outgoing traffic from my controller.

I believe the controller can be configured to be accessible via the cloud UI, but it isn't the default. At least thats the behaviour when configured with a local user.

Absolutely, but I do wonder if I should belt and braces it. Just because it shouldn't contact a cloud doesn't mean it doesn't.

If you have an easy way to do so, you should.

Possibly even proxy the traffic via something able to do SSL strip/re-encrypt and monitor that traffic with an IDS.

I always make an assumption that people writing nefarious communication will check SSL certificates and thus MITMing it would only work if I can load a root certificate (which typically is only doable on proper devices like phones and laptops, and I don't like the extra risk of having a wide open root that I've generated and have to keep secure on my devices as I don't trust myself enough)

However speaking to some people at work who have had experience in the past, seems most malware (and that includes IOT devices) doesn't bother validating certificates or things like ESNI and (validated) DOH, so there's a lot you can find out without breaking TLS, due to the lazineess/incompetence of the malware writers.

Reply on news.ycombinator.com