Re: [PLUG] Ubiquiti breach

["Keith C. Perry via plug" <plug@lists.phillylinux.org>]

I saw this too and agree, nothing to see here if are doing "proper security".  By that I mean, NOT using cloud <Carlin's 7 bad words * 5 ^ 10> to "manage" your network.

These days, I just chuckle went I see stuff like this.

~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ 
Keith C. Perry, MS E.E. 
Managing Member, DAO Technologies LLC 
(O) +1.215.525.4165 x2033 
(M) +1.215.432.5167 
www.daotechnologies.com

----- Original Message -----
From: "Rich Freeman via plug" <plug@lists.phillylinux.org>
To: "jeffv" <jeffv@op.net>
Cc: "Philadelphia Linux User's Group Discussion List" <plug@lists.phillylinux.org>
Sent: Tuesday, January 12, 2021 11:17:42 AM
Subject: Re: [PLUG] Ubiquiti breach

On Tue, Jan 12, 2021 at 9:53 AM jeffv via plug
<plug@lists.phillylinux.org> wrote:
>
> Ubiquiti tells customers to change passwords after security breach
>

Saw that.  As far as I can tell it only impacts their website (online
shopping, forums, support, etc), and has nothing to do with their
products themselves (such as passwords for
routers/consoles/webinterfaces/etc).  Just to be safe I changed my
UniFi passwords anyway since they're random, but I don't think UniFi
relies on any kind of cloud-based authentication.  If you use their
app there is some kind of cloud-based discovery (I forget how it
works), but I think the actual authentication is vs your local
credentials in the controller.  Maybe it uses your cloud account for
the discovery bit, so that would potentially tell somebody who
compromises it the external IPs of your router, or maybe let them
knock on the front door of your management interface on the
controller.

-- 
Rich
___________________________________________________________________________
Philadelphia Linux Users Group         --        http://www.phillylinux.org
Announcements - http://lists.phillylinux.org/mailman/listinfo/plug-announce
General Discussion  --   http://lists.phillylinux.org/mailman/listinfo/plug
___________________________________________________________________________
Philadelphia Linux Users Group         --        http://www.phillylinux.org
Announcements - http://lists.phillylinux.org/mailman/listinfo/plug-announce
General Discussion  --   http://lists.phillylinux.org/mailman/listinfo/plug