<story><title>Ubiquiti accused of covering up ‘catastrophic’ breach– and it’s not denying it</title><url>https://www.theverge.com/2021/3/31/22360409/ubiquiti-networking-data-breach-response-whistleblower-cybersecurity-incident</url></story><parent_chain><item><author>akersten</author><text>What I want to know is the likelihood that customer devices were compromised. Frankly, I could care less about whether my data&amp;#x2F;password&amp;#x2F;whatever were lost in the breach. Happens all the time, who cares. The problem with the Ubiquiti case is that this compromise has the potential to have poisoned official firmwares, with the silly source code&amp;#x2F;customer data bitcoin ransom as a smokescreen.&lt;p&gt;Remember, there were VMs spun up in their cloud that they couldn&amp;#x27;t account for. That doesn&amp;#x27;t look like someone just tooling around to me, that looks like someone recreating a build process.&lt;p&gt;Is anyone monitoring their Ubiquiti devices in their homelabs to watch for any suspicious traffic? Being part of a nation-state botnet is not a very comforting idea.</text></item></parent_chain><comment><author>inetknght</author><text>&amp;gt; &lt;i&gt;Is anyone monitoring their Ubiquiti devices in their homelabs to watch for any suspicious traffic?&lt;/i&gt;&lt;p&gt;With modern software good luck filtering suspicious noise from signal.</text></comment>
<story><title>Ubiquiti accused of covering up ‘catastrophic’ breach– and it’s not denying it</title><url>https://www.theverge.com/2021/3/31/22360409/ubiquiti-networking-data-breach-response-whistleblower-cybersecurity-incident</url></story><parent_chain><item><author>akersten</author><text>What I want to know is the likelihood that customer devices were compromised. Frankly, I could care less about whether my data&amp;#x2F;password&amp;#x2F;whatever were lost in the breach. Happens all the time, who cares. The problem with the Ubiquiti case is that this compromise has the potential to have poisoned official firmwares, with the silly source code&amp;#x2F;customer data bitcoin ransom as a smokescreen.&lt;p&gt;Remember, there were VMs spun up in their cloud that they couldn&amp;#x27;t account for. That doesn&amp;#x27;t look like someone just tooling around to me, that looks like someone recreating a build process.&lt;p&gt;Is anyone monitoring their Ubiquiti devices in their homelabs to watch for any suspicious traffic? Being part of a nation-state botnet is not a very comforting idea.</text></item></parent_chain><comment><author>count</author><text>Not to discount the threat, but &amp;#x27;vms spun up in their cloud&amp;#x27; is ...exactly what coinminining attackers do.  It&amp;#x27;s so frequent, it&amp;#x27;s even called out as a &amp;#x27;thing to watch your bill to notice&amp;#x27; in amazon security talks&amp;#x2F;etc.
Gain access, launch N VM&amp;#x27;s, where N is as many as your credential and the cloud account limits in place allow, mine coins &amp;#x27;for free&amp;#x27;, and move on.</text></comment>