<story><title>Ubiquiti developer charged with extortion, causing 2020 “breach”</title><url>https://krebsonsecurity.com/2021/12/ubiquiti-developer-charged-with-extortion-causing-2020-breach/</url></story><parent_chain><item><author>duxup</author><text>&amp;gt; Investigators say they were able to tie the downloads to Sharp and his work-issued laptop because his Internet connection briefly failed on several occasions while he was downloading the Ubiquiti data. Those outages were enough to prevent Sharp’s Surfshark VPN connection from functioning properly — thus exposing his Internet address as the source of the downloads.&lt;p&gt;Not the first time I’ve read about a VPN unable to mask someone’s ip when they were on a wonky connection.</text></item></parent_chain><comment><author>dreyfan</author><text>Proper opsec is you blackhole all traffic when the vpn isn’t active.</text></comment>
<story><title>Ubiquiti developer charged with extortion, causing 2020 “breach”</title><url>https://krebsonsecurity.com/2021/12/ubiquiti-developer-charged-with-extortion-causing-2020-breach/</url></story><parent_chain><item><author>duxup</author><text>&amp;gt; Investigators say they were able to tie the downloads to Sharp and his work-issued laptop because his Internet connection briefly failed on several occasions while he was downloading the Ubiquiti data. Those outages were enough to prevent Sharp’s Surfshark VPN connection from functioning properly — thus exposing his Internet address as the source of the downloads.&lt;p&gt;Not the first time I’ve read about a VPN unable to mask someone’s ip when they were on a wonky connection.</text></item></parent_chain><comment><author>mikepurvis</author><text>Presumably this is an OS-level thing, that it helpfully tries to fall back? If so, I suppose it could be mitigated either by a software control that prevents using the bare connection, or by running the VPN elsewhere, for example on your router.&lt;p&gt;(I see posts elsewhere in the thread now describing how to do this with iptables.)</text></comment>