&gt; According to Adam, the hackers obtained full read&#x2F;write access to Ubiquiti databases at Amazon Web ServicesNot good!

meh, not really a good substitute. They&#x27;ve got the prosumer market locked down.Probably why they got into this mess. Lots of successful product people deferring &#x27;non product&#x27; stuff.

He&#x27;s quoting a source. I don&#x27;t doubt Krebs in the slightest but he&#x27;s simply forwarding someone elses account.

&gt; Hopefully this account isn&#x27;t fully truthfulBrian Krebs is a reputable source who has a lot to lose if he makes unsubstantiated claims.

A few months ago I was considering outfitting my apartment with Ubiquiti gear but ultimately decided to stick to an aging AirPort Extreme and a couple of cheap ethernet switches after seeing reports of bugs with various Ubiquiti pieces. Seems that was a good judgement…

Well, guess I won&#x27;t be about to drop a few thousand on Ubiquiti gear anymore until we get some more details. Hopefully this account isn&#x27;t fully truthful, otherwise Ubiquiti has really screwed up.

You enjoy that also? I thought I was the only one...

The APs and switches are stateless by design (which I sort of like), but if you make CLI changes on the controller using the config file they are not reverted in my experience.Though it&#x27;s not super well supported either because they prefer people using the web UI to the config file.

My favorite part of the web interface is when it silently reverts changes made at the command line.

But the routers have a nice user interface!

&gt; Legal isn&#x27;t there to make sure the company complies with the laws. Legal is there to advise on and minimize legal risk.Breaking laws is one sure way to increase legal liability.

Legal isn&#x27;t there to make sure the company complies with the laws. Legal is there to advise on and minimize legal risk.&quot;It&#x27;s not like we&#x27;re building bridges or something.&quot; -- any legal department when faced with engineers&#x27; ethical duty to report a hack.

Successfully sweeping it under the carpet means you don&#x27;t get sued for the mistakes you made.Legal isn&#x27;t there to make sure the company complies with the laws. Legal is there to advise on and minimize legal risk.

&gt; a source who participated in the response to that breach alleges Ubiquiti massively downplayed a “catastrophic” incident to minimize the hit to its stock price, and that the third-party cloud provider claim was a fabrication.I&#x27;m sure their lawyers don&#x27;t know anything about tech or forensics, but they know how buy shareholders time in a way that minimizes anyone&#x27;s chances of going to prison or facing serious civil liability. If you ask someone in charge of hiring corporate counsel what they look for in a lawyer, they will flat out tell you &quot;a good risk manager who understands discretion&quot; which just means &quot;someone who&#x27;s going to tell us what we can get away with&quot;.The regulatory system in the US is sufficiently dysfunctional that there is zero incentive for corporate counsel to even consider what&#x27;s in the best interest of consumers.

&gt; I wonder why their legal department would PREVENT them from saving their users.Good legal departments understand that the company is there to serve the users and make them happy and operate within those constraints (even trading off possibly liability when it makes the products sell better).Horrible legal departments will block anything that has even a smell of liability, even when it comes to sabotaging the product itself and hiding serious issues from users and employees.I&#x27;ve met way too many ones from the second group.

I wonder why their legal department would PREVENT them from saving their users.What legal reason would exist for that? I thought legal would instead force them to save their users, since otherwise they would risk getting sued by all of them by all the damages caused or something.

The breaches are common, the reporting&#x2F;discovery of them is not. Security just isn’t a priority for a lot of Orgs, as the consequences are minimal (see: Equifax) due to a lack of regulatory or financial penalty pain when a breach occurs.“Help yourself to a free year of identify theft insurance” and all that jazz.

Peplink seems pretty good; they do have a Cloud:tm: management offering called InControl2 but as far as I&#x27;m aware it&#x27;s entirely optional. I&#x27;ve had good luck configuring everything via the local UI. My setup is a Balance Two + a few One AX APs.

Technically, Ubiquiti does have a local option. You can run the controller locally and disable cloud login.

It&#x27;s a shame that Mikrotik doesn&#x27;t have a easy to use global GUI.It&#x27;s the right hardware, and great firmware and wonderful flexibility - but it needs an easy to use GUI controller to make the simple stuff easy to take over from Ubiquiti.

Ruckus Unleashed is what you&#x27;re looking for.

No, TP-Link&#x27;s Omada controller can be run locally, I do that at home and at my parents&#x27; house. It is not cloud-connected unless you turn that on. Runs surprisingly well on a Raspberry Pi 2, actually.I&#x27;ve got a setup similar to what you&#x27;re asking for. The TP-Link APs (AC1750, AC1350 and AC1200) support PoE, they&#x27;re in a wireless mesh, support roaming, and all configuration is handled with one interface, no cloud involved.Just make sure that what you&#x27;re ordering says it supports Omada. They still ship a lot of SMB gear that doesn&#x27;t, but all the basics are there now.

&gt; Does anyone have a decent WAP where I can use PoEThere are PoE devices with OpenWRT support[1] and should be possible to enable 802.11r if they have the support. They can be managed locally even with self-signed certificate.[1] <a href="https:&#x2F;&#x2F;openwrt.org&#x2F;toh&#x2F;views&#x2F;toh_poe-powered" rel="nofollow">https:&#x2F;&#x2F;openwrt.org&#x2F;toh&#x2F;views&#x2F;toh_poe-powered</a>

&gt; Does anyone have a decent WAP where I can use PoE, deploy like 5 of them and have them support roaming between APs, all managed locally? Is that too much to ask?Not as comprehensive as Ubiquiti’s management interface but the CAPsMAN feature on Mikrotik routers and APs does cover this use case.

Mikrotik, but unfortunately getting reasonable throughput for wireless clients is a serious challenge (I always have better results with openwrt on the same hardware).  Still, nice to have local control and not have to rely on some cloud service just to use the hardware I bought.

So the question for becomes: is there just not a good enthusiast market for this stuff? I have met a number of people who are &quot;network nerds&quot;, so I&#x27;m inclined to think the market does exist. With any of the plethora of consumer devices (Linksys, Netgear, D-Link) it&#x27;s a dice roll whether your gear is complete garbage or not. A lot of the time, you&#x27;re coming up snake eyes.I&#x27;ve got some Ubiquiti gear I bought a couple years ago. Like you, I want good quality gear that I can manage myself. I don&#x27;t need a bunch of fancy corporate garbage, like link aggregation or cloud management. Give me solid, hardware accelerated routing and switching, flexibility over my local DNS, and maybe some VLANing.I was running Linux on a small x86 box as my last network router. Maybe it&#x27;s time to get back to that. That or go back to banging rocks together. Haven&#x27;t decided which, yet.

Eero is amazing.It Just Works.Apple style. Plug it in. Never fuck with it. Rock solid.

You are going to end up paying for a license to cover security updates. I use Fortinet, not cheap.

I have exactly this setup with three Aruba Instant APs (WiFi 5), but afaict they’ve combined the Instant product line with their cloud offering or something? I’m not entirely sure where they’re going with it, but I am very happy with the setup I have.

As far as I know, TP-Link doesn&#x27;t require any cloud based service, or even a local controller. They can work fine without any of it and you just manage them locally&#x2F;directly.

Isn&#x27;t enough to just disable cloud access?Edit: I got upvoted by somebody, but as an UI user I&#x27;m genuinely looking for an answer. If it&#x27;s still possible to get inside if devices aren&#x27;t connected to UIs cloud.

With TP-Link you can run the Omada controller for their EAP line on a local device (I have it running on a Pi4).

The TP-link offering looks very similar to Ubiquiti from a quick scan a month or two back.Both will run from locally hosted controllers if desired.I&#x27;ve been seeing more Cisco &quot;Meraki Go&quot; kit around as well, which looks to target the same use cases as Ubiquiti (very very similar gear, WAPs, low end switches &amp; gateways), albeit without a local controller option, but at least without the usual steep Meraki subscription charges.

Not 100% sure if that&#x27;s what you are looking for (I don&#x27;t do much network works) but I think that Camsat&#x27;s GlobalCAM-4.5G may be worth checking, with one catch: the company targets CCTV market. Still, that&#x27;s just a router, without any special license fees or mandatory clouds.

Maybe Plume Homepass: <a href="https:&#x2F;&#x2F;www.plume.com&#x2F;homepass&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www.plume.com&#x2F;homepass&#x2F;</a> ? I&#x27;m not sure if they&#x27;re 100% equivalent, but it seems to cover a good part of the Ubiquiti feature.

Omada EAP245. You can use appliance and&#x2F;or software controller that you can run locally, to manage your APs no cloud needed.<a href="https:&#x2F;&#x2F;www.tp-link.com&#x2F;us&#x2F;business-networking&#x2F;ceiling-mount-access-point&#x2F;eap245&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www.tp-link.com&#x2F;us&#x2F;business-networking&#x2F;ceiling-mount...</a>

Ruckus R710 or R510 unleashed. I was talking about Ubnt&#x27;s horrendous security in another thread just last night.<a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=26628198" rel="nofollow">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=26628198</a>Or if you just want Wave1 Hardware...R700&#x2F;R500You can get these as overstock on the cheap on amazon etc. The unleashed version means it can run the controller on the AP.

For those people here saying &quot;go Ruckus unleashed&quot; ... caveat emptor my friends !I have it on very good authority that Ruckus have started rolling out a change in their pricing model to require a Unleashed license per AP to operate, a move which obviously increases costs to the end-user.Some people might say its a deliberate move prevent cannibalisation of their main business model by nudging people away from Unleashed. I couldn&#x27;t possibly comment.

Mikrotik have products that are exactly like that.

Try Mikrotik. It can do all of the things you listed and more.

Synology. Isn’t cheap, decent performance though. However it doesn’t seem to be the brands focus

Also add that all of the SOHO equipment is garbage that drops connections randomly, crashes, or simply can&#x27;t deal with some WiFi chips.This is the reason I went with the Ubiquity UniFi 6 years ago. It was the only one I tried that didn&#x27;t constantly drop connections or cost a fortune. But it&#x27;s only G and I&#x27;ve been considering an upgrade, but there are no good options on the market that don&#x27;t have stupid cloud management bullshit, are built on garbage hardware, or cost an arm and a leg.

have you checked out eero? <a href="https:&#x2F;&#x2F;eero.com&#x2F;" rel="nofollow">https:&#x2F;&#x2F;eero.com&#x2F;</a>I know someone that works there and they seem pretty happy with the place and product. just saw the amazon link now though so that may be a detriment depending on your view of them. (I have never used their systems or anything so it&#x27;s not really an endorsement but something to consider)

ubiquiti is fine. you don&#x27;t have to use the cloud controller. CLI works just fine, at least the products I have used.

Look into Mikrotik hardware and OpenWRT. Of the Mikrotik-based hardware I&#x27;m familiar with, they support PoE. OpenWRT supports roaming and mesh networks, and is a local solution, as opposed to a cloud-based one. There are no licenses you need to pay for, either.

If you don&#x27;t feel like configuring hostapd and dnsmasq I&#x27;m pretty sure there&#x27;s an nmcli one-liner that will have network manager run a WAP for you. I use &#x27;hotspot&#x27; on my phone all the time.WAPs have been absolute crap for years.

So one might call them... ubiquitous?I&#x27;m so sorry. I&#x27;ll go now.

maybe their different product lines are managed differently, but all my Unifi WAPs, router, and switches are managed on a local controller that i installed and maintain myself.i recall some features being locked behind a UBNT account, but that was only reporting-type stuff IIRC<a href="https:&#x2F;&#x2F;help.ui.com&#x2F;hc&#x2F;en-us&#x2F;articles&#x2F;360012282453-UniFi-Set-up-a-UniFi-Network-Controller" rel="nofollow">https:&#x2F;&#x2F;help.ui.com&#x2F;hc&#x2F;en-us&#x2F;articles&#x2F;360012282453-UniFi-Set...</a>

TP-Link Omada is locally controlled (through a smartphone) but you can buy the Omada Cloud to control it remotely.It works with their small 16 port (8 PoE switch).

Disclaimer: worked for Meraki (now Cisco Meraki) for several years.Generally, halfway decent wireless APs are all targeted at the enterprise market. Consumer hardware is a brutal race to the bottom, as lay consumers aren&#x27;t qualified to compare options based on anything but price and UI. Ubiquiti was an outlier in trying to bring enterprise features to the consumer marketThe problem for enthusiasts and small business&#x2F;home office setups like yours are that both the enterprise market (e.g. Meraki) and the premium consumer market (e.g. Google WiFi) focus heavily on ease of management - cloud controllers are table stakes these days, not a controversial feature. Part of that premium that Meraki, Aruba, and that class of enterprise supplier charge is about having a trustworthy and secured backend.Note, however, that roaming between APs is a feature of the 802.11 standard; you just need to have all your APs on the same layer 2 (802.x) network, and using the same SSID and credentials. No fancy hardware required, and you can even mix and match vendors.

Maybe a bit too soon, but has anyone tried Maxwell? <a href="https:&#x2F;&#x2F;www.crowdsupply.com&#x2F;andy-haas&#x2F;maxwell" rel="nofollow">https:&#x2F;&#x2F;www.crowdsupply.com&#x2F;andy-haas&#x2F;maxwell</a>

Get Linux boards and USB-3 WiFi dongles with well-supported chipsets and roll your own?The other alternative is to go way up-market and buy industrial gear. Consumer gear is shit due to a race to the bottom mentality. 90% of consumers buy the cheapest. This is also what turned every TV and appliance into a feature-encrusted shitbox full of spyware.

You can absolutely manage ubiquiti local. Even with a ridiculously named local appliance called a cloud key. Their cameras are unfortunately another story.

I hear Cardi B and Megan Thee Stallion have some pretty excellent WAP&#x27;s.

Mikrotik is nice and does all of those things. Just needs actual expertise at network administration to set up. Once done though, it&#x27;s fire and forget.

I have a Turris Omnia for my main router. It&#x27;s a solid piece of kit.The OS, TurrisOS, is based on OpenWRT and for a while they were having trouble keeping up-to-date but that&#x27;s been sorted in recent releases.There are great features like auto-updates and BTRFS snapshots and the ability to rollback to previous known good if you screw up a config. I also run LXC containers on it for things like PiHole (not on the internal flash but the main board takes an M.2 SSD).The Turris MOX is a modular Turris system that you can assemble from the parts that you need.I have a small Gl.iNet router upstairs flashed with upstream OpenWRT that I use as a WiFi access point and have setup 802.11r for BSSID roaming. Have been using this setup for months and handoff has been completely transparent.

Happy enough w my Netgear ORBI (2-node mesh router covers my 3500sq ft house; handoff is fine)

&gt;Seems like there is nothing good out thereCheck out Ruckus. I&#x27;ve found their &#x27;unleashed&#x27; stuff quite nice (no affiliation, just a customer).

Have a look into Ruckus with their local zone director offering.

Aruba sells IAP instant models that do this. No cloud required.(also sell campus controller local no cloud ... but this route is pricey)

Is pfSense, vyos, stuff like that out of fashion? Or too hard to maintain? Automating that stuff with ansible should solve the central management bit...

&gt; all managed locally?Other than ubiquiti I assume you mean? Not that I know of. I want the old ubiquiti back where customers, not stock price and ad revenue, was the focus.

You&#x27;re in the boat of deploying OpenWRT or similar low-cost APs presenting the same SSID on a shared VLAN, plugging them into your favorite PoE switch, and manually configuring their channel strengths, etc. 
It isn&#x27;t so bad if it&#x27;s a one-and-done thing, but all of the out-of-the-box solutions are very IoT.Enterprise solutions with your self-contained WLAN controller and APs (not including PoE switches) are typically pretty pricey (&gt;$5k, can spend a lot more).

I&#x27;m a big fan of flashing OpenWRT on supported APs. You lose central management and setup takes time, but I&#x27;m very happy with the stability and no worries about cloud services or vendor lock-in etc.

My Synologies do that across several locations in my city. Not sure what PoE is, but Synology has site to site vpn which is amazing !

Ruckus seems pretty good. You can use their unleashed APs without cloud&#x2F;controller&#x2F;subscription. POE, and can connect up to 75 devices. I just installed at my hotel.We had ubiquiti, but the power outage usually corrupts the controller, and requires constant resetting.

Aruba doesn&#x27;t require a cloud controller, that&#x27;s just the &quot;Instant On&quot; version. 
I used to run Aruba Instant (not the &quot;instant on&quot;, no controller), but gave those APs to a friend and now run an Aruba 7005 controller with 2x303H and a 324.Support&#x2F;Licensing costs are totally worth it for having trouble-free WiFi with no cloud dependencies (context: using and supported UniFi in various roles since the first UAP came out, and I think was free for UWC attendees, though I could be confusing that with their first camera), but am network nerd that&#x27;s comfortable with enterprise wifi.

you can build one but PoE might not be in the cards unless you want to convert the injected power back to a 5v barrel.Alix makes a decent router board that can host Linux and dual PCI cards means 5 and 2.4 ghz AP&#x27;s. the total would be ~200 for each &quot;AP&quot; but they would be pretty massively powerful.<a href="https:&#x2F;&#x2F;www.pcengines.ch&#x2F;alix.htm" rel="nofollow">https:&#x2F;&#x2F;www.pcengines.ch&#x2F;alix.htm</a>

Ruckus with the Unleashed firmware.I bought an R610 AP on eBay a few months back, flashed it with the Ruckus firmware (legally available to all from their site), and it does exactly what you want. On-prem only, no cloud, one of the APs will act as a controller&#x2F;manager for the others, and they can all communicate via wired or meshing off of each other. One of them can even be a NAT thing if you want.I think I paid around $160 because someone had a bunch of off-lease ones. But if you look up anything that supports the Unleashed firmware you&#x27;ll be good. 802.1ax is the hotness right now, so the slightly older (but still work great) ones are a LOT cheaper.I replaced a Ubiquiti setup with a Ruckus R610 and small fanless running OPNsense (Protectli) with a basic switch and POE injector and it&#x27;s excellent. Sure, it&#x27;s not single pane of glass for it all, but the AP is rock solid and OPNsense is a solid known quantity. I&#x27;ve got no regrets.

I was under the impression that Omada had a non-cloud configuration?

I bought some Ubiquiti gear a year ago (a pair of AC-AP Pros), and immediately after I got them I reflashed them with OpenWRT. Haven&#x27;t had even one issue with them.I get that people with larger networks would find centralized management useful, but I&#x27;m fine just managing a couple APs, a router, and a couple switches on their own. They&#x27;re pretty much set-it-and-forget-it devices anyway.

I realize I&#x27;m a bit late to the party, but GL-iNet does this. They run OpenWRT, too! PoE support can be hit or miss, but being able to truly own my devices without compromising on features is amazing.You probably want something like [0], which has PoE support and an optional Cloud connection. You can roll your own automation with (e.g.) SSH access since they are just Linux machines.[0]: <a href="https:&#x2F;&#x2F;www.gl-inet.com&#x2F;products&#x2F;gl-ap1300&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www.gl-inet.com&#x2F;products&#x2F;gl-ap1300&#x2F;</a>

I’m running a TP-Link VR2100 and a bunch of RE200 repeaters in mesh mode. Nothing is cloud based.All cloud based management stuff is optional and provides TP-Link’s own DDNS support and remote access only. You don’t have to use it.

Sure plenty of solutions out there, but its all going to be Enterprise priced. $600-$700 an AP, plus whatever is going to be the controller. In this space, you&#x27;ll find cloud based options, controller based options, and standalone.If you are willing to go this price range, I think FortiAPs feeding back to a Fortigate FW is rock solid solution. But a FortiAP-431F is $616. And a base FG60F as controller is $535 + service if you need it. And although you probably won&#x27;t need repair options, support&#x2F;maintenance is a yearly fee ontop of that.Ubiquity was definately a unique company offering many of the enterprise features for consumer pricing.

At least a few years ago you could self host Aruba.

TP-Link is not cloud based - you can run the controller locally. <a href="https:&#x2F;&#x2F;www.tp-link.com&#x2F;pl&#x2F;support&#x2F;download&#x2F;omada-software-controller&#x2F;v4&#x2F;#Controller_Software" rel="nofollow">https:&#x2F;&#x2F;www.tp-link.com&#x2F;pl&#x2F;support&#x2F;download&#x2F;omada-software-c...</a> - Downloadable here.

Agree about TP-Link. I bought some Deco mesh kit for the house and am generally pleased with its performance. However the fact that I can’t configure them locally is a massive turn-off from buying the stuff in the future.I use the TPLink forums to put local management in as a feature request. Perhaps if enough people make a noise?

i use microtik.It needs some getting used to, but preform well.They have their clod versions also, but they keep putting out non cloud devices.

Unifi cloud controller is optional, but they don&#x27;t make it easy to figure that out.Setting up a UDM first thing I did was add a local super admin account, then disable remote access. That way, if their cloud auth servers are down I&#x27;m not affected as I use the local admin account.

Check out Mikrotik. Quite similar range of products to Ubiquiti, very configureable, maybe it fits your needs...

Would you be willing to qualify your statements wrt Engenius? I&#x27;ve had good experience with them in the past, has something changed?

Mikrotik.<a href="https:&#x2F;&#x2F;mikrotik.com&#x2F;" rel="nofollow">https:&#x2F;&#x2F;mikrotik.com&#x2F;</a>Or something like this:
<a href="https:&#x2F;&#x2F;www.aliexpress.com&#x2F;wholesale?&amp;SearchText=pfsense+wifi" rel="nofollow">https:&#x2F;&#x2F;www.aliexpress.com&#x2F;wholesale?&amp;SearchText=pfsense+wif...</a>Again, dont expect it to be simple. Be prepared to learn.

Check out pepwave, I have a couple of their APs with no cloud management involved. I think there are probably roaming features...

Was shopping for alternatives to my Ubiquiti last night. Seems like there is nothing good out there. Engenius has shit hardware and a cloud controller. Aruba has a cloud controller AND you have to pay for a license. Cisco makes you pay for a license. TP-Link is cloud-based.WTF. Does anyone have a decent WAP where I can use PoE, deploy like 5 of them and have them support roaming between APs, all managed locally? Is that too much to ask?

It&#x27;s people not getting it and being plain annoyed by the second factor. YubiKey or Authenticator app on a different device... it&#x27;s too inconvenient and people often only do it if forced (e.g. banks do this afaik).

Lack of 2FA for the AWS access ? Sure. It might have prevented the attack.The attacker had access to the whole database. Which meant he could alter the 2FA seed. So it wouldn&#x27;t have mattered much.

He could have had 2fa on his console account but saved an access key for CLI access. Many large organizations have an infrastructure where you exchange your corporate authentication (including 2FA) for a short lived AWS access key, but AFAIK this isn’t out of the box.

&gt; Man I really wonder why the lack of proper 2FA is so wide spread?Because it&#x27;s a giant PITA unless you have a dedicated team managing it. And the service companies get this and charge accordingly (aka enterprise levels).It&#x27;s why companies like 0Auth get bought for gigabucks.

Man I really wonder why the lack of proper 2FA is so wide spread?Is it rally cost and complexity?Or just missing awareness?Or the lack of consequences when you get hacked in a way which could easily have been prevented (through then they might have attacked in a different way, tbh.).

Got 3 no brainer CVEs against them. We&#x27;re an enterprise customer who is now moving away because after Fortinet acquired them support dropped off a cliff. They had some good people but it bacame rather apparent that there was a bit of a toxic culture there.

There is Fortinet(which acquired Meru 5 years ago). Meru was pretty OK. I helped manage a setup of  2500 + access points on a campus. 
I left that job 6 months after Meru was acquired so I cant say how they are now.

&gt; can we really trust themabsolutely not

You can use AWS Accounts like microservices. The biggest security walls in AWS are the account barriers. Those have to be specifically configured to cross. Sometimes (1%) its unavoidable, but if you have multiple services running on an account, you force yourself to weave arcane webs of IAM permissions crisscrossing all over to get what you need where. It&#x27;s a terrible model that people inflict on themselves because it&#x27;s how everything used to work.

The triangle says Confidentiality, Availability, Integrity.While your concerns are 100% valid, we need to remember too that setting up access in restricted ways and inviting users to understand the protection and remove the correct barriers, or implement the concerns necessary to interact with those for themselves, always runs the risk that some users will find your protections cumbersome and instead find a (totally incorrect) way to baffle them, or otherwise even route around them entirely mooting any efforts to secure a platform.And every time I hear this played out in conversation, the answer is &quot;that&#x27;s on them!&quot; But it&#x27;s clearly a balancing act, it&#x27;s a trade off; tautologically, when you make the service less accessible then... it is, well, ... made less accessible.Besides facilitation of the secure access also sales conversion ratios will depend on that accessibility. The crux of your argument stands, the defaults are too open, and we need to do more to ensure that naive users aren&#x27;t handed a loaded gun to aim at their own feet.

Uhm.. in the AWS i&#x27;ve used, it&#x27;s on explicit allow, and all of their docs and tutorials start with IAM and what&#x27;s needed and why. What more do you want? I can&#x27;t imagine IAM being simpler while being as granular as it is. You just have to actually take the time to learn about it, like every system. It&#x27;s still drastically easier to use it securely than doing something on a similar scale and detail manually.

Spinning up your own DB instance is also &quot;open by default&quot; and takes both effort and expertise to secure properly. I think it&#x27;s pretty reasonable that there&#x27;s a large surface area of IAM permissions when AWS offers a vast number of disparate services.

It&#x27;s odd how the big cloud vendors have been able to escape criticism for being completely open by default. Other vendors have been taken to task and have adopted better security practices. For example, SuperMicro IPMI comes with a random password now.It&#x27;s extremely difficult to lock down an AWS account when there are a bajillion services, IAM policies, roles, etc.. I&#x27;ve been trying for the last few days and it&#x27;s so difficult that I can understand things like this. I don&#x27;t think it&#x27;s acceptable, but I can see how it happens.I think the expectation for AWS, Azure, GCP, etc. needs to change. Accounts should allow nothing by default and part of the tutorial &#x2F; learning process should be understanding the permissions needed for each service and how to limit access to those services. As a bonus, they should show you how to configure Budget Actions to catch anomalies and runaway services. For example, I&#x27;m trying to set up my account so SMTP access to SES gets revoked for SMTP users if the message count exceeds a certain threshold. It&#x27;s really, really hard because there&#x27;s not a single document &#x2F; guide that shows the process from start to finish.

You may be smart, and have secured your systems properly, but someone with the same resume as you in another company might not be.As your manager, how can I tell the difference between someone who actually did the work right, and someone who said they did the work right (and also legitimately believes that they did)?

&gt; BigRespectableCompaniesUbiquiti really aren&#x27;t in the same ballpark as AWS or Microsoft, which are the companies people use that argument for, and you can bet your ass their security is better than in most places.

Managed services with state of the art IAM policies are more secure than lifting and shifting a Linux box running whatever PAM configuring was setup on it in 2005.

&gt; Maybe putting your network control plane in &#x27;the cloud&#x27; isn&#x27;t such a good idea after all...Isn&#x27;t one of the major selling points of cloud-everything &quot;How can you possibly secure your service better than BigRespectableCompany?&quot; I know any time I bring up self-hosting E-mail or a web site or whatever, someone always comes out of the woodwork to remind me that I am not an expert in securing Internet services, and that BigRespectableCompanies have full-time employees dedicated to security. Surely I should be moving to the cloud for this expertise! This is sounding more and more like FUD to me.

All of this makes me skeptical about ubnt but a few corrections1) You dont need to turn on cloud acccess
2) My UDM pro doesn&#x27;t have ssh open to the world so not sure how that would be useful externally

After the Unifi Video fiasco, I bought a UDM Pro to test Unifi Protect.Once I saw it required cloud login I got scared.
After I saw an ubiquiti ssh key preinstalled in a device with unfeteted internet access I shut it down to never bring it up again

We are certainly not having this conversation enough. I regularly chat with a risk office and she keeps telling me: Data minimization is your first line of defense.

Heck, most operating systems are leaky by default.
Even openBSD, which has a stellar trackrecord in terms of security and &quot;goes against the grain&quot; on many decisions for the sake of secure by default (for instance, disabling hyperthreading altogether to prevent any kind of SPECTRE vulnerability) is under constant scrutiny for not being secure enough.Maybe connecting everything to a network and making it a high value target by collecting everyone&#x27;s data is just a terrible idea in the long run.

&gt; can we really trust them to clean up all their tokens and fully eradicate all forms of persistence the hackers may have gotten?The state of security in the tech industry is miserable. The only companies we should trust not to leak our data are those that never collected it in the first place.

Really glad I decided to go with a TP-Link Omada network over Ubiquiti now.My TL-R605 router, OC300, HD660s, and 8 port 2.5 gigabit switch are going strong, and I put the whole network together for under $1000.

&gt; Maybe putting your network control plane in &#x27;the cloud&#x27; isn&#x27;t such a good idea after all...Uh. AWS? GCLOUD?
Those have network control planes, maybe not for physical networks, but a control plane nevertheless.

Full ACK but also you can run a local only setup

&gt;If this is true, and whoever breached them had full access to their AWS account, can we really trust them to clean up all their tokens and fully eradicate all forms of persistence the hackers may have gotten?This is the same for any breach. At least if you&#x27;re using AWS, you know that your management tools aren&#x27;t lying to you (as long as you assume AWS itself isn&#x27;t hacked) and you can use those tools to cleanup. If you run your own machines, you can&#x27;t assume your management tools work correctly. All your machines could have rootkits, all your tools could contain backdoors, and every attempt to cleanup might just be a fake veneer. See Reflections on Trusting Trust.Full disclosure I work for a cloud computing company (but not AWS).

At my last company, signing keys were physically stored in a safe with limited access. No network security breach could possibly get them.

This isn&#x27;t really true. If you have an AWS, you need a global god admin. That&#x27;s the root user. As an IT guy, I have to store those creds somewhere. So I make the password super long and random, store it in lastpass, add 2fa, and add alerting for all logins. It&#x27;s never used except in the super rare case we have to do something that requires the megagod level privs of the root account (like changing billing to a master account etc)

Complete failure of security here. No single credentials should be able to grant that much privileged access.

&gt; can we really trust them toYes, if they destroy all of their backups, all of their hardware and every one of their current AWS accounts. Then start entirely from scratch. Any measure falling short of that (and let&#x27;s be reasonable, it definitely will) means that they&#x27;re entirely untrustworthy from now on.Of course having your home network controlled from the cloud should already have been entirely untrustworthy, so in practice it won&#x27;t be an issue for their sales.

When you&#x27;re operating such massive services, at minimum you should protect the admin accounts not just with 2FA, but also with IP firewall. Looks like both were missing from here ...

&gt; Maybe putting your network control plane in &#x27;the cloud&#x27; isn&#x27;t such a good idea after all...Sure it isnt. It is extremely bad idea and actually something like the ubiquiti breach is not even strange to me, once you have worked once in &quot;enterprise(tm)&quot; world this doesnt seem like anything strange.There is just no way to buy a router that communicates with 3rd party servers and to let it access the LAN is a complete no-go (even if I am paying ISP router as a part of the package it is running as bridge just to pass the connection to my router).I consider router as a first line of defense for inbound traffic and last line of defense for outbound and there is just no way to trust some fishy corporation for this.And if the corporation is actually promoting cloud access, like Ubiquiti or Google, they are pretty much banned from my shopping list for all times.

Why didn’t they have a honeypot alert in their pager duty?

&gt; “The breach was massive, customer data was at risk, access to customers’ devices deployed in corporations and homes around the world was at risk.”&gt; “They were able to get cryptographic secrets for single sign-on cookies and remote access, full source code control contents, and signing keys exfiltration,”Maybe putting your network control plane in &#x27;the cloud&#x27; isn&#x27;t such a good idea after all...Edit: Just re-read the article, this part stood out:&gt; the attacker(s) had access to privileged credentials that were previously stored in the LastPass account of a Ubiquiti IT employee, and gained root administrator access to all Ubiquiti AWS accounts, including all S3 data buckets, all application logs, all databases, all user database credentials, and secrets required to forge single sign-on (SSO) cookies.&gt; Adam says Ubiquiti’s security team picked up signals in late December 2020 that someone with administrative access had set up several Linux virtual machines that weren’t accounted for.If this is true, and whoever breached them had full access to their AWS account, can we really trust them to clean up all their tokens and fully eradicate all forms of persistence the hackers may have gotten?

Yeah well, more money in marketing than anything else.

Hmm, even the self-hosted SW can use SSO from cloud... so I&#x27;m now worried that our equipment is still vulnerable by whatever system allows cloud logins.

They forced cloud authentication on self hosted software too.[1][1] <a href="https:&#x2F;&#x2F;www.reddit.com&#x2F;r&#x2F;Ubiquiti&#x2F;comments&#x2F;kslyh9&#x2F;cloud_key_local_account&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www.reddit.com&#x2F;r&#x2F;Ubiquiti&#x2F;comments&#x2F;kslyh9&#x2F;cloud_key_...</a>

Apparently I was... 
Now, updated the firmware and it says server certificate changed. Frikkin A. Now I am in &#x27;what the hell&#x27; land

We should be clear here that there are multiple types of &quot;self-hosted&quot;. Ubiquiti makes essentially little (weaker) Raspberry Pi devices with PoE that are dedicated to just the controller, and a few years back they also forced their (garbage) &quot;Protect&quot; onto their hardware only. They (confusingly) call these &quot;Cloud Keys&quot;, though they have nothing to do with the cloud. However, you can also get 100% standalone versions of the Controller that will run on any server or VM you&#x27;ve got, Linux, Windows, or Mac. This is just the Java 8-based controller software and that&#x27;s it, and you can lock those down arbitrarily hard for any WAN access same as any other LAN network software, no general internet access is needed at all and no firmware is involved.A lot of people quite reasonably got CKs seeing them as very easy ways to have a low power always on local controller since they didn&#x27;t have some other server running 24&#x2F;7 already. If the firmware on those was updated to require tie-in to Ubiquiti&#x27;s SSO that&#x27;s a horrible betrayal. But I&#x27;m confident in saying the full standalone Controller doesn&#x27;t since I have mine locked down from any general net access, remote L3 management was done to IP only at the firewall and I&#x27;ve been switching to just putting it all through WireGuard.

Same, my setup is 100% Unifi from back before they started going downhill. At least I was self-hosting the software so I wasn&#x27;t bitten by this breach.

I almost did the same thing, but it was clear a year ago that they were moving towards &quot;cloud based&quot; services, something I didn&#x27;t want to participate in. Looks like it was a good decision, in retrospect.

Not every network hardware provider ties everything to a &quot;Cloud&quot; for reasons. They may have breaches but they won&#x27;t be this widespread.

If  i were you I’d take heart in the knowledge that the others aren’t any better, it’s just a matter of “when” they’ll get cracked in the same way

If you don&#x27;t have remote access enabled and aren&#x27;t running their surveillance camera software, it is not clear to me that there is any risk to the customer from this event (outside of the source code being used to generate new exploits). It doesn&#x27;t sound like the attackers were able to abuse automated firmware update functions, and losing credentials to a UI account has no impact on users running cloud key locally without remote access enabled.

I can&#x27;t speak to the newer UniFi garbage, but the selling point for their Edge network products was that you could have Cisco-ish managed switches and routers without paying the absurd prices for ASICs, licenses, ios upgrades, parasitic middleman distributors, etc.

I always thought that the main selling point of their devices was that you can run your own Ubiquiti server at home and keep everything local? They are always portrayed as the not-so-shitty IoT company.

I bought the EdgeRouter X a year or two ago because I was tired of having to reboot my router constantly. Still use it, still love it.

I picked up an EdgeRouter and none of the cloudkey&#x2F;unifi stuff. I initially felt like maybe I should have picked the unifi gear and maybe a dumb switch, but now I don’t regret the EdgeRouter. Couldn’t be happier with it.I don’t trust anything that tries to solve the “firewall problem” by setting up a cloud service for what should be a local appliance.

As long as you change your UI.com password (and enable 2fa there) and disable the remote administration option, you should be all good.

Are you me?Just finished setting up my Ubiquiti-based home network that includes a dream machine, 6 access-points, and a wireless bridge to an outbuilding. All told about a $1,500 investment I made because I thought I was investing in &quot;best-in-class&quot; hardware and software.Sigh.

Our &quot;CTO&quot; was told only last week by someone from the company that helps us with ISO 27001 that we shouldn&#x27;t use whatever we&#x27;ve got, but get Ubiquity instead, because it was safer...

This company is a disaster it seems, and I have just setup my whole home infrastructure and home security aound their products... 
They where the most recommended brand when I was shopping for new stuff a year ago.

By trying to sweep it under the rug they just opened themselves up.Crazy.

No. They don&#x27;t care if customers get pwnd. They care if customers become aware of exactly how they got pwnd and launch a class action. It&#x27;s shitty but entirely predictable behavior common in these situations.

Yeah that doesn’t make sense to me. Sales would do something like that. Legal should be erring in the opposite direction.

It&#x27;s probably considered Consciousness of Guilt.

This actually seems like criminal advice.

So hackers breached the network and still might have been present. Having everyone reset their passwords at that time is the LAST thing you want to do, as the hackers could have just collected all the fresh credentials, a significant percentage of which are also used for other services because users are users.Legal made the right decision. You clean up the internals, close the backdoors, and then you notify&#x2F;refresh user credentials.

&gt; Adam wrote in his letter. “Legal overrode the repeated requests to force rotation of all customer credentials, and to revert any device access permission changes within the relevant period.”tsk.

I don&#x27;t think a state actor would&#x27;ve tried to extort bitcoin, but who knows…

Wow, this is huge. I wonder if the attacker was a state actor, and if so, what their intended mischief is.

I have never ever seen &quot;plausible deniability&quot; keep someone out of trouble. I have seen attempts at applying it several times, but never successfully.As an excuse for why to not do the right thing I really hate &quot;plausible deniability&quot;.

Ironically they can factually make that statement now as well.

&quot;Hacker came in through the server hard-line&quot; &lt;-- HollyWoods favorite Hacker Trope.

&quot;We believe that the hackers obtained read-write access to our database, but we also believe that they were too polite to actually use it for anything.&quot;

Better solution: never store unencrypted PII&#x2F;PCI&#x2F;PHI&#x2F;etc. in the database. There are loads of tokenization solutions (Very Good Security got a bunch of buzz a couple years back) that do this, or alternatively all of the big cloud providers have key services (KMS on AWS and Google, Key Vault on Azure) so that you can ensure that every decryption attempt is tracked and logged.If you need to search on some of this data you should use blind indexes (Google blind index for more info).

That works for exactly as long as the data hasn&#x27;t come out. Once the data comes out... well, you&#x27;ve got questions to answer.

Sounds like a case of poor incentives. It&#x27;s easy to wag our fingers and say &quot;well they shouldn&#x27;t be doing that&quot; but difficult to come up with a system of incentives that makes everyone want to do what&#x27;s socially beneficial. In this case, it seems like there should be a separate organization in charge of looking for adverse events that is rewarded for finding events (instead of punished). We use some strategies like this currently when regulating the finance industry

I worked for a pharma co for a while, they did have a social media listening department in marketing, also we were trained to report any discussion of the company at all to a special investigations unit that would follow up.

Reminds me a little bit of Adverse Event Reporting in pharma. If a drug manufacturer finds out about an adverse event (i.e. a bad reaction) to a drug, it kicks off all sorts of obligations that have the potential to be time-consuming and expensive. So pharma is the one sector you won&#x27;t see with a &quot;social media listening&#x2F;analysis&quot; department in marketing. They actively avoid tracking or learning about discussion of their products on social media.

In Ubiquiti&#x27;s defense, I once brought a disclosure to their attention on Twitter a few years back and they very swiftly issued an update. I guess things have gone downhill since then. It boggles the mind why a company whose core business is catering to the self-hosting crowd, would try to force self-hosters onto its cloud plantation, when it can&#x27;t even protect its own house.

Ubiquiti&#x27;s response is not surprising. Of course they would lie and deflect about the severity of the attack. They have terrible customer support and awful software update communications; besides, they are hostile to analysts and the press.
Either Ubiquiti made false material statements, or the company is negligent. In both cases, it will get them into hot water.

AWS offers object locking, which is similar to a WORM drive (Write Once Read Many). This prevents logs from being deleted. The other approach is to ship logs to another AWS account.<a href="https:&#x2F;&#x2F;aws.amazon.com&#x2F;blogs&#x2F;storage&#x2F;protecting-data-with-amazon-s3-object-lock&#x2F;" rel="nofollow">https:&#x2F;&#x2F;aws.amazon.com&#x2F;blogs&#x2F;storage&#x2F;protecting-data-with-am...</a>

Can you provide more information regarding a system that can log these types of breaches (and all other activity, as required) and that would be deemed &quot;safe&quot; and reliable post-breach? i.e.: A system that can provide logging and that can *assert* that all logs, even in the event of a breach, are asserted CIA?

Most places I&#x27;ve worked say - do not read other people&#x27;s patents.

&gt; ”Ubiquiti had negligent logging (no access logging on databases) so it was unable to prove or disprove what they accessed”Perversely, this is exactly the logging that you want to have in place in case of a breach.You can then (factually) make the statement that ”we have no evidence any customer data was accessed.”

For AWS root account?Generate a long random password, print it out and then lock it in a safe without allowing anyone to see it.Turn on 2FA and then lock the second factor in a different safe.There’s virtually never a need for the root account and it’s impossible to attenuate (by design).

The root account credentials should be used to create a privileged IAM user and then physically locked away in a box after setting up a hardware MFA device (plus a backup MFA) for the root account: <a href="https:&#x2F;&#x2F;docs.aws.amazon.com&#x2F;IAM&#x2F;latest&#x2F;UserGuide&#x2F;best-practices.html" rel="nofollow">https:&#x2F;&#x2F;docs.aws.amazon.com&#x2F;IAM&#x2F;latest&#x2F;UserGuide&#x2F;best-practi...</a>The privileged IAM user should then be used to administer other IAM users and roles. All IAM users should be required to have hardware security keys like Yubikey.

AWS root user accounts are kind of an achillis heel in every enterprise setup using AWS. What you typically do is MFA (bare minimum) + sharded secrets. This means you need multiple people to use the root user account. You can also hook in additional audit controls eg by automating cloud watch and sending notifications about any root user login. Alternative is that you throw away the password and vow to never use it, or set up an account recovery process (all of this may not be a great idea as it can fail when you need it most).The situation is somewhat more relaxed with GCP Billing Accounts and Azure EA Accounts, though they have better separation of concerns than AWS (billing vs. workload access). Nonetheless, never give these passwords to finance department lest they store it in an excel sheet on a SharePoint. Access to these credentials allows anyone to suspend billing for an entire enterprise... not sure what controls the providers have in place to verify any of this before initiating automated shutdown of all workloads.

Hardware keys should be used to store stuff like:- private keys for ssh, gpg, vpn auth- 2fa for sudo access, password manager access, etc

What is the right way store credentials to something like this?Hardware keys?

&gt; this completely invalidates the 2FA of TOTP if your password manager get broken intoI think that&#x27;s the big &quot;if&quot;. If you assume the password manager is secure (which something clearly wasn&#x27;t in this case, but that seems like an outlier), TOTP secret in the password manager still secures the account.Is such a setup as protective as a separate storage method? No, but it&#x27;s leagues more convenient. A cloud-based PW manager also solves the problem of a lost&#x2F;broken&#x2F;new phone causing you to lose all of your 2FA setups. Some 2FA apps do as well (Authy, iirc), but trust me when I say people lose 2FA codes _all the time_. And then 2FA needs to be disabled by support, which is its own can of worms.The best security measures are the ones people actually use. If not having to use a separate app is the convenience people need, then I think it&#x27;s totally worth it.

The alternative is to navigate 100 separate token reset processes if you ever lose your phone and all of its TOTP tokens.

Because I already use MFA to access my password manager in the first place, and don&#x27;t want to deal with managing backups for each flavor of MFA app that is pushed on me.

&gt; Why do password managers let people store TOTP next to the passwordOne absolutely invaluable use-case is that it lets multiple employees share access to an account with 2FA enabled.Many systems don’t have appropriate role&#x2F;permission systems to allow for 2FA otherwise.

This boggles me when I see this option in any password manager (and I think every single one has this &#x27;option&#x27;).Why do password managers let people store TOTP next to the password, this completely invalidates the 2FA of TOTP if your password manager get broken into.

&gt; Adam says the attacker(s) had access to privileged credentials that were previously stored in the LastPass account of a Ubiquiti IT employee, and gained root administrator access to all Ubiquiti AWS accounts, including all S3 data buckets, all application logs, all databases, all user database credentials, and secrets required to forge single sign-on (SSO) cookies.A root user user breach, seemingly on the organization main account. Ouch.I wonder if MFA was set up, with the TOTP creds also kept in LastPass.

I&#x27;ll take a look at it, but also note that I need in total:Router,
Wifi AP (probably two to get full coverage),
Powerline extender,
Point-to-point extender with a switch on the other end.Stupid outbuildings. Anyway, thanks for the tip!

Eero is cloud managed too. And reports MAC addresses and network usage to Amazon.

Does their gear have any cloud offerings?

Parent’s place?Go Eero Pro.Your future time management self will thank you.

Shit, I had plans to refresh the network infrastructure in my parent&#x27;s place with a full ubiquiti setup to replace the years of added on junk.

There was just a thread[1] yesterday about them starting to serve ads in their UI. It seems this company is rapidly losing credibility.I have had plans kicking around for a bit over a year to do a full build out using their products, and just within that time it seems like they&#x27;ve gone from a glowing reputation to severely tarnished. Unfortunate, as it seems like they once had great products.1: <a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=26628198" rel="nofollow">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=26628198</a>

Mikrotik is the most common recommendation probably but wifi speed is a problem apparently.There were some other suggestions in yesterday&#x27;s Ubiquiti discussion.[1][1] <a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=26628198" rel="nofollow">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=26628198</a>

Can you elaborate on your experience with Mikrotik wifi? What don&#x27;t you like about it?

Is it not possible to just add in a separate WAP to the MikroTik device ?

I use Mikrotik (or OpenWRT) for routers, but Mikrotik is not that good on WiFi. Peeople recommend Ruckus, but it&#x27;s pretty expensive (and not that easy to get second hand in Europe, or Spain at least).Is there any (good) brand with pricing between Mikrotik and a Ruckus that doesn&#x27;t need a cloud connection?

That looks pretty nice. Too bad I didn&#x27;t see this a week earlier since I just upgrade my home network last week.

For router check out the Turris Omnia [0]. Seems to be a good choice.[0]: <a href="https:&#x2F;&#x2F;www.turris.com&#x2F;en&#x2F;omnia&#x2F;overview&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www.turris.com&#x2F;en&#x2F;omnia&#x2F;overview&#x2F;</a>

&quot;an amazon company&quot; already makes some warning lights blink in my head.
Do they have cloud integration of any kind?

I have happily upgraded several homes from Mikrotik and&#x2F;or Ubiquiti to Eero mesh - <a href="https:&#x2F;&#x2F;eero.com&#x2F;" rel="nofollow">https:&#x2F;&#x2F;eero.com&#x2F;</a>

For firewall, I suggest an OPNSense box. You could run it on a thin client, a Protectli etc.For AP, OpenWRT seems decent.

Was days away from refitting my home out with £2,000 of gear. Any other recommendations for routers, wifi and security cameras?

Thank you Adam. You saved me thousands, I was seriously considering a network upgrade.

The problem isn&#x27;t Ubiquiti using AWS. It&#x27;s Ubquiti forcing customers to use cloud authentication.

&gt;The problem is that on-prem isn&#x27;t much better in many cases. Only the largest organizations have the capability to operate deep defenses against these threats whether it&#x27;s the cloud, or the on-prem.One of the truly sad things about all this though is precisely that UniFi made this a lot easier for small orgs and even individuals (and could have gone even farther). Stuff like VLANs and RADIUS became dramatically more accessible &quot;for free&quot;, using just what was built-in to a UniFi stack someone might get anyway. Back when they were still more competent Ubiquiti added management VLAN support across the lineup, and the setup is fairly intuitive and then just works. At one point I&#x27;d hoped they&#x27;d continue in that direction much more. It&#x27;s not some impossible thing, it mainly just needs better UX putting the pieces together in a graspable way. Graphical VLAN topologies and point-and-click, automating all the certificate authentication&#x2F;signing stuff, the generation of profiles for onboarding, all the components for this stuff exist right now just not, well, unified.I think a lot of places don&#x27;t want to in fact, because they&#x27;d rather push cloud ties since that can yield subscription revenue.

on-prem is much better in most cases because if there is a bug an attacker would have to scan the internet and find you before a patch is released and you update. If that bug is only accessible from inside of your network to begin with, then that means the attacker would already have to be inside your network.As far as the team having skills, there is not much that ubiquity does that can&#x27;t be handled on prem, I mean you&#x27;re already installing physical devices, how much more effort is it to install a controller? Sure, that means you&#x27;re on the hook for upgrades, but in most cases you&#x27;re better off not getting them instantly anyway.And to clarify my point about ISP gear, I agree that the average user can&#x27;t be expected to understand or care. I meant so called technical users.

The problem is that on-prem isn&#x27;t much better in many cases. Only the largest organizations have the capability to operate deep defenses against these threats whether it&#x27;s the cloud, or the on-prem.If you and your team have the skills you can operate fairly effectively on a small scale, but that&#x27;s a pretty luxurious situation. Most home users can&#x27;t tell the difference between a router and cable modem hence it&#x27;s in the interest of cable providers to lower support costs by providing a managed offering. It&#x27;s terrible from a security perspective, but customers have signed that away.The common theme running through these breaches is that the organization isn&#x27;t necessarily small, but they aren&#x27;t Google&#x2F;Apple&#x2F;Microsoft-size either. Those companies have multiple layers of expertise and the cash flow to hold up development of anything in order to make sure things are secure. It&#x27;s hard to wing stuff once the bureaucracy understands security is needed. They even start pushing their product security initiatives outside of product development to mundane departments because they get attacked by very smart actors. You can see from the news it&#x27;s still far from perfect.Once you get to companies the size of Ubiquiti, you start having challenges with implementing close to the same degree of security because you don&#x27;t have float in the system to allow for additional costs, delays, etc. on top of the lack of expertise. Apparently Ubiquiti have been hemorrhaging expertise in other areas due to opportunistic cost-cutting, so it isn&#x27;t a surprise that they suffer and respond in this way given that culture. A bad security decision by one exec in companies of this size can cut across many departments which doesn&#x27;t happen in the behemoths.

 Cloud managed anything has a giant red target painted on it. Especially infrastructure equipment.  I&#x27;m still surprised anyone think&#x27;s it&#x27;s ok to use their ISP provided router and wifi, let alone having it be managed remotely by the manufacturer.

Or they&#x27;ll just change their passwords and pretend to have solved the problem.

&quot;Adam says the attacker(s) had access to privileged credentials that were previously stored in the LastPass account of a Ubiquiti IT employee, and gained root administrator access to all Ubiquiti AWS accounts, including all S3 data buckets, all application logs, all databases, all user database credentials, and secrets required to forge single sign-on (SSO) cookies.&quot;Holy...Wow. That is catastrophic. Everything is compromised. That&#x27;s a complete rebuild.

previously stored. They probably made a csv backup of the lastpass database. Those aren’t encrypted.

&gt;Adam says the attacker(s) had access to privileged credentials that were previously stored in the LastPass account of a Ubiquiti IT employee.So the laptop probably had some malware&#x2F;keylogger on it that was able to pick up some data in the lastpass browser extension or something?

Why does it have to be a neighbor? It says &quot;internet&quot; on the tin. Do you have confidence that random people on the internet can&#x27;t do the equivalent of a port-scan on you?The other way I think of it is, I don&#x27;t use it right now. It likely has open doors, intentional or unintentional. If the open doors are widely discovered, reliably closing them seems difficult. The highest-leverage point in time to influence this story is before I start using it. &quot;The only winning move is not to play.&quot;Feedback appreciated on this thought process.

been doing it for years. meet the new boss, same as the old boss.this is the other side of the coin of &quot;you don&#x27;t need privacy if you have nothing to hide&quot;, and it&#x27;s exactly as stupid in application here as it ever is.

It’s not _that_ unbounded? At least not yet! Until a tech savvy neighbor who’s also a creep can easily break into your network and home camera I’m not personally worried.

Why do people trust any IoT devices these days? Shouldn&#x27;t we be trying to reduce our exposure to (inevitably insecure) software? What benefits does it provide that are worth the unbounded risks?

Whistleblower: Ubiquiti Breach “Catastrophic”