Ubiquiti users report having access to others’ UniFi routers, cameras

[nkw]

Ubiquiti users report having access to others’ UniFi routers, cameras

Yikes. I used to be a big fan of Ubiquiti but they have had a lot of missteps (several involving security) the past few years. I've slowly been swapping their stuff out of my home/lab network and a couple of non-profit sites I admin for free, while hoping they would get their mojo back, but stuff like this makes me think it is time to speed up the removal.

 

[klui]

While I'm not a fan of Ubiquiti products their last security breach was the result of a security cloud employee.

Former Engineer At Billionaire Robert Pera’s Ubiquiti Inc. Arrested For Stealing Data, Extortion

Nickolas Sharp, who worked as a cloud engineer at Pera’s Ubiquiti for three years, was arrested in Oregon on Wednesday for stealing gigabytes of confidential data, extorting $1.9 million and posing as a whistleblower.

www.forbes.com

 

[MonumentNetworking]

UniFi devices broadcasted private video to other users’ accounts

What I find interesting is that a simple ID link from their database allowed access to other peoples dashboards. You would think this would be a certificate or token not a remote database.

 

[blunden]

That's why you don't enable the cloud portal. It also shows why a lot of people complained when that portal became mandatory for a short while to set up some devices, before they later removed that requirement.

 

[Gerhen]

Ubiquiti users report having access to others’ UniFi routers, cameras
... I've slowly been swapping their stuff out of my home/lab network...

Same for me and not specifically related to this incident but more from the point of view of my needs going forward. A lot of the information on this forum has been super helpful in this regard.

 

[T_Minus]

That's why you don't enable the cloud portal. It also shows why a lot of people complained when that portal became mandatory for a short while to set up some devices, before they later removed that requirement.

Exactly. Same for me.

Can't imagine giving ppl access to your cameras, wow

 

[blunden]

Exactly. Same for me.

Can't imagine giving ppl access to your cameras, wow

Yeah. If you can set up a VPN, you can get the same functionality without using the cloud portal feature anyway.