Re:Whistleblower: Ubiquiti Breach “Catastrophic”
by rossipedia on Tuesday March 30, 2021 @04:55PM
(#26640348)
> My guess is their local workstation was compromised
Honestly I don't think it was even that complicated, considering when I needed to spend money on some SaaS product the "chief accountant" (because there was no CFO) straight up sent me a photo of the corporate credit card and said "delete that when you're done".
Re:Whistleblower: Ubiquiti Breach “Catastrophic”
by nhumrich on Tuesday March 30, 2021 @11:01PM
(#26643065)
Sure, but to be fair, credit cards really aren't that dangerous of a credential to wave around. You can cancel your card at anytime, and even dispute the charges. Its like instant key rotation, with a way to also roll back time.
Re:Whistleblower: Ubiquiti Breach “Catastrophic”
by cutemonster on Wednesday March 31, 2021 @04:06AM
(#26644641)
And they can have monthly spending limits too
Re:Whistleblower: Ubiquiti Breach “Catastrophic”
by cutemonster on Tuesday March 30, 2021 @04:47PM
(#26640251)
> My guess is their local workstation was compromised
You mean someone was physically at the laptop/desktop and could access the OS and apps? Maybe if the employee was working remote (covid?) from, say, a cafe and left the laptop unattended when refilling coffee?
Or something else? ... Hmm, could also have been eg a browser zero day that gave someone remote access to the computer? Or a dev tools supply chain attack?
Re:Whistleblower: Ubiquiti Breach “Catastrophic”
by hn_throwaway_99 on Tuesday March 30, 2021 @05:24PM
(#26640744)
It's not that complicated. The local workstation could have had a trojan or virus that installed a keylogger or screengrabber.
Re:Whistleblower: Ubiquiti Breach “Catastrophic”
by junon on Wednesday March 31, 2021 @02:36AM
(#26644161)
Or someone watched over their shoulder. 1Password makes it all too easy to accidentally reveal your password within the app. Someone with a video camera just needs one clear frame - 1/60th of a second - with a good enough view.
Re:Whistleblower: Ubiquiti Breach “Catastrophic”
by cutemonster on Tuesday March 30, 2021 @07:12PM
(#26641685)
Ok, thanks
Re:Whistleblower: Ubiquiti Breach “Catastrophic”
by benjaminwai on Wednesday March 31, 2021 @02:37AM
(#26644166)
Or keylogger?
Re:Whistleblower: Ubiquiti Breach “Catastrophic”
by baybal2 on Tuesday March 30, 2021 @04:42PM
(#26640168)
Easy to imagine they just got a spiked chrome binary installed
Re:Whistleblower: Ubiquiti Breach “Catastrophic”
by cutemonster on Tuesday March 30, 2021 @04:52PM
(#26640321)
How could an attacker make that happen?
The interesting part of this story is how the employee's LastPass got popped. My guess is their local workstation was compromised, and their LastPass was either not logged out in a browser plugin, or they didn't have 2 factor auth required for each login and a keylogger got the password. In either case, it's a good reminder to be paranoid about your password manager, make sure it's got a logout timer, and use 2 factor auth.
I also don't let my cloud password managers touch a mobile device. It's fairly inconvenient, so I hesitate to recommend this to others. But I don't trust mobile devices very much. Anyone have thoughts on this?