News for hackers. Stuff that matters.

A comment on Ubiquiti Networks Breach. Parent comment

Re:Ubiquiti Networks Breach by throwaway5752 on Monday January 11, 2021 @03:39PM (#25736363)
It's impossible to secure yourself against a devoted persistent threat group over the long term. The asymmetry of effort is not tractable to overcome.

So they can take your security seriously, but they will be hacked, or they have already.

[ Parent | on HN ]
Re:Ubiquiti Networks Breach by ziddoap on Monday January 11, 2021 @03:47PM (#25736534)
I don't think my post argues, or even attempts to argue, against your point.

It was a light-hearted jest at the fact that this exact line is in every single breach notification I have read for the past few years.

The more serious point I was alluding at was not "just don't get breached", it was that the "we care" line rings hollow after the 250th time reading it.

[ Parent | on HN ]
Re:Ubiquiti Networks Breach by throwaway5752 on Monday January 11, 2021 @03:50PM (#25736619)
My misread, apologies. I think the "we care" is a dodge around the reality that most are uncomfortable with, which is, "we make your data safe as possible but we will likely be hacked and you should compartmentalize your personal data accordingly with that expectation". But I am no good with marketing.
[ Parent | on HN ]
Re:Ubiquiti Networks Breach by pseudalopex on Monday January 11, 2021 @04:33PM (#25737511)
Most companies choose to collect data they don't have to.
[ Parent | on HN ]
Re:Ubiquiti Networks Breach by luser007 on Monday January 11, 2021 @04:03PM (#25736905)
They put all of their users eggs in one basket in the cloud. That makes for a very interesting target.

They could have not done that. The users were probably unaware that their data was even placed on the cloud servers of some third party.

Ubiquiti used to be cool. They've taken a nose dive in recent years in several ways: Firmware upgrade suddenly including telemetry by default, forcing people to use their NVR appliance instead of installing their software on their private servers, etc.

Had Ubiquiti not moved people to "cloud solutions" an attacker would have to attack millions of peoples equipment. Now he only had to attack one providers network.

[ Parent | on HN ]
Re:Ubiquiti Networks Breach by unethical_ban on Monday January 11, 2021 @04:25PM (#25737344)
I heard rumors about the telemetry thing, but that is usually an overhyped concern - unless it is sending flow logs or something.

When did they stop allowing people to use a private server for central management? I see Unifi still has a network controller.

[ Parent | on HN ]
Re:Ubiquiti Networks Breach by luser007 on Monday January 11, 2021 @04:44PM (#25737712)
Sorry for being obtuse - it wasn't my intention.

I'm thinking of "Unifi Video" that is going out (EOL announced six months ago), where you could either buy their appliance OR download an official .deb package and install the NVR software on your own server.

They replace that with "Unifi Protect" that comes ONLY as an NVR appliance. No more .deb packages. It also requires you to buy one of their other products (Cloud Key 2), IIRC.

[ Parent | on HN ]
Re:Ubiquiti Networks Breach by sounds on Monday January 11, 2021 @03:41PM (#25736400)
I think it is possible to secure yourself against a devoted, persistent threat group.

I think it's expensive, but possible.

Do you have data to back up your claim that no one, ever has ever successfully remained secure?

[ Parent | on HN ]
Re:Ubiquiti Networks Breach by swirepe on Monday January 11, 2021 @03:46PM (#25736512)
My name is Ozymandias, King of Kings; Look on my Works, ye Mighty, and despair!
[ Parent | on HN ]
Re:Ubiquiti Networks Breach by not2b on Monday January 11, 2021 @03:44PM (#25736460)
No one could possibly prove this kind of negative.
[ Parent | on HN ]
Re:Ubiquiti Networks Breach by snoshy on Monday January 11, 2021 @03:55PM (#25736719)
Why not? All you have to do is point to one particular company whose systems have not been verifiably breached after having resisted actual attempts.
[ Parent | on HN ]
Re:Ubiquiti Networks Breach by WaitWaitWha on Monday January 11, 2021 @04:36PM (#25737576)
> one particular company whose systems have not been verifiably breached

The unknown unknown. How can you be sure all the "resisted actual attempts" been even detected?

[ Parent | on HN ]
Re:Ubiquiti Networks Breach by not2b on Monday January 11, 2021 @06:59PM (#25740125)
You've changed the requirement. To prove a company hasn't been breached, you'd also have to prove that there hasn't been a breach that hasn't been detected (so breached, but not verified). Any given target might already be quietly owned by some state actor or corrupt insider with allies on the outside.
[ Parent | on HN ]
Re:Ubiquiti Networks Breach by justinclift on Tuesday January 12, 2021 @01:17AM (#25743062)
Several places probably would have met those goals...

... right up until the SolarWinds hack became public.

The point being, provable "we've never been breached" seems to have a way of turning out to be wrong. :/

[ Parent | on HN ]
Re:Ubiquiti Networks Breach by imoverclocked on Monday January 11, 2021 @04:15PM (#25737146)
Challenge accepted?

Just because known attempts have failed doesn’t mean the unknown ones have too.

[ Parent | on HN ]
Re:Ubiquiti Networks Breach by someguydave on Monday January 11, 2021 @04:22PM (#25737308)
most attacker groups would be unlikely to share that result
[ Parent | on HN ]
Re:Ubiquiti Networks Breach by rodgerd on Monday January 11, 2021 @04:10PM (#25737048)
What evidence do you have that anyone has?
[ Parent | on HN ]
Re:Ubiquiti Networks Breach by ikiris on Monday January 11, 2021 @04:17PM (#25737192)
When was the last time you heard of a google user data breach?
[ Parent | on HN ]
Re:Ubiquiti Networks Breach by harrierpigeon on Monday January 11, 2021 @06:59PM (#25740121)
https://en.wikipedia.org/wiki/2018_Google_data_breach

https://www.express.co.uk/news/uk/1372333/Gmail-hacked-Googl...

Not unheard of at Google, either.

[ Parent | on HN ]
Re:Ubiquiti Networks Breach by rodgerd on Monday January 11, 2021 @04:49PM (#25737789)
https://www.forbes.com/sites/kateoflahertyuk/2018/10/09/goog...

https://arstechnica.com/information-technology/2013/11/googl...

Maybe you should know literally anything about the topic at hand before making sweeping assertions? I realise that's asking a lot here at HN, but it would improve the site a lot.

[ Parent | on HN ]