News for hackers. Stuff that matters.
Re:Ubiquiti Networks Breach by 3guk on Monday January 11, 2021 @03:37PM (#25736306)
I must admit - Ubiquiti has lost some of it's shine in the last few years, whilst AP and routing hardware seems to still be very good in terms of pricepoint, it does feel like the software side of things has been going in a very strange direction for quite some time.

I'm still quite annoyed by the fact that I was forced to migrate from Unifi Video to Unifi Protect - due to vendor lock in and the fact that the remote interface for Unifi Video was switched off this month.

I guess on the plus side - no one who is still using Unifi Video has to worry all that much.....

Hopefully it is just a case of resetting passwords and enabling 2FA if you haven't done it already - not entirely sure how much damage could be done otherwise, unless there is an undocumented backdoor into Ubiquiti products ?

Re:Ubiquiti Networks Breach by pieno on Monday January 11, 2021 @04:01PM (#25736869)
Agree on Ubiquiti losing their shine. They seem to have fallen for the classic trap of vendors selling hardware without fully factoring in the cost of maintaining software and “cloud” infrastructure. So now their “growth hackers” have to keep coming up with things that should just be add-ons or bug fixes but instead they sell them as a premium feature or new product to make up for a lack of recurring revenue.

Basically they are alienating their existing customer base (who have already paid a premium price for the prosumer product upfront and expect things to Just Work for the price) in favour of convincing the next idiot to fund their OPEX with shiny new features and toys that are a quick sell. Not realising (or unwilling to realise) that this strategy is completely in contradiction with their reputation and brand image as trustworthy prosumer hardware vendor, and just adds to the underlying issue.

I predict that it won’t be long before they run out of cash or investor confidence and have to sell out to a large consumer hardware vendor with deep pockets that will try to capture the Ubiquiti premium margins by selling their lower-value existing consumer gear under the Ubiquiti brand. I applaud them for having come this far while maintaining most of their integrity and reputation, but I’m afraid their strategy is doomed to fail and it’s starting to show.

Re:Ubiquiti Networks Breach by move-on-by on Monday January 11, 2021 @09:24PM (#25741455)
Not only have they engaged in multiple interface redesigns with loss of features with no apparent gains, the last firmware update removed the ability for me to use the Protect app locally on my network without needing cloud access enabled. This breach has only confirmed my belief that my home cameras must stay off their cloud. Extremely dissatisfied.
Re:Ubiquiti Networks Breach by m0dest on Tuesday January 12, 2021 @12:42AM (#25742779)
>engaged in multiple interface redesigns with loss of features with no apparent gains

Yeah, this has been really baffling. Their settings UI has been in a transition state between "Classic Settings" and "New Settings" for years. Neither is complete. Some settings are only in New Settings (e.g. WiFi AI), while many more are only in the Classic Settings (e.g. allow multicast from Ethernet to WiFi).

Re:Ubiquiti Networks Breach by aksss on Tuesday January 12, 2021 @02:56AM (#25743673)
Their EdgeSwitch line has this same issue - legacy and new UI each with different functionality, and even less capability within UNMS (Now named UISP?). Frustrating.
Re:Ubiquiti Networks Breach by ex_ubiquiti on Monday January 11, 2021 @03:41PM (#25736395)
Ubiquiti had a steady exodus of engineers in the past few years. It's a very different company now compared to the glory days of UniFi.
Re:Ubiquiti Networks Breach by rossjudson on Monday January 11, 2021 @04:43PM (#25737698)
Doesn't it seem like one of the missing measurements for directors/VPs should be "amount of disappearing expertise"?
Re:Ubiquiti Networks Breach by katbyte on Monday January 11, 2021 @10:48PM (#25742016)
you would think, but then you'd have to actually do something to retain talent instead of hiring whoever you can whos cheaper and has no idea how any part of the software or or company works. But of course the comp/hr team never see it that way.

More the old guard leaves, the more of the old guard that leaves. Then who is left to train the new people?

Re:Ubiquiti Networks Breach by krupan on Monday January 11, 2021 @08:52PM (#25741258)
Fun fact: very few directors or VPs at Ubiquiti. Very flat organization
Re:Ubiquiti Networks Breach by callalex on Tuesday January 12, 2021 @03:13PM (#25752808)
Often times churn is rewarded because it can keep salaries lower.
Re:Ubiquiti Networks Breach by ex_ubiquiti on Tuesday January 12, 2021 @11:12AM (#25748788)
The directors and VPs quit, also.
Re:Ubiquiti Networks Breach by artificialLimbs on Monday January 11, 2021 @10:27PM (#25741877)
Deploying a 6 AP network some years back, I ran across this gem in some Release Notes. I can hear someone screaming JUST SHIP IT!

"Do not choose the skip option when running the Migrate Site wizard. If you do your devices may end up in a weird state."

https://unifi-forum.nl/index.php?threads/unifi-sdn-controlle...

Re:Ubiquiti Networks Breach by martinmunk on Tuesday January 12, 2021 @08:39AM (#25746670)
For now, I’ve resorted to extracting the rootfs of the cloud key plus firmware images, and running UniFi protect in a LXD container on a raspberry pi. I’ve not tried this with their cloud access, and could not get the app to work with it yet. I’d like to do a writeup at some point, but not sure if I could get in legal trouble...
Re:Ubiquiti Networks Breach by WesolyKubeczek on Tuesday January 12, 2021 @04:59AM (#25744621)
> I'm still quite annoyed by the fact that I was forced to migrate from Unifi Video to Unifi Protect - due to vendor lock in and the fact that the remote interface for Unifi Video was switched off this month.

For me, that’s a good outcome because I won’t be bothered by their updates for my currently-working unifi video setup anymore.

Re:Ubiquiti Networks Breach by conk on Monday January 11, 2021 @10:14PM (#25741797)
Can’t you still access a Unifi video server locally? What’s so hard about setting up a reverse proxy or VPN?
Re:Ubiquiti Networks Breach by kiwijamo on Tuesday January 12, 2021 @12:42AM (#25742783)
You can't do that anymore. You either have to buy their server or use their cloud, from my understanding. I am another considering migration away from them for this reason as well.
Re:Ubiquiti Networks Breach by growse on Tuesday January 12, 2021 @03:29AM (#25743893)
> You can't do that anymore. You either have to buy their server or use their cloud, from my understanding. I am another considering migration away from them for this reason as well.

Alternatively, you can use their hardware with an alternative serf-hosted NVR like zoneminder.

The cameras work just fine in standalone mode as RTSP sources.

Re:Ubiquiti Networks Breach by aksss on Tuesday January 12, 2021 @02:59AM (#25743687)
You can still use their UniFi Video NVR in local-only mode, though I think the last update for that ha shipped. The Protect platform may be different in this regard.

One of the great things about ubnt was the ability to self-host their management software on a Ubuntu VM or container.