Hello, World!
Today in hacking news - one of the dumbest cyber criminals we’ve seen on this channel
has just been jailed for 6 years.
The guy tried to hack his own employer, but failed miserably.
This is an interesting one, I am of course talking about the Ubiquiti hack - trust me
when I say the rabbit hole here runs deep.
Ubiquiti is a company that sells premium iot products, things like WiFi routers, security
cameras and smart locks.
Security is pretty central to their reputation, I mean - would you buy a security product
from a company that was accused of “covering up a catastrophic data breach”?
But let’s back up a bit, our story begins in early 2021 when Ubiquiti customers received
an email notifying them of a data breach, it said “we cannot be certain that user
data has not been exposed”, things like “names”, “emails” and hashed “passwords”
had all apparently been grabbed by hackers.
People were told to change passwords and enable 2FA.
However, on the surface, this seems like a pretty typical low impact data breach - the
kind that happens almost daily, some people took to forums to voice their anger, others
were more understanding, and former employees spawned to dunk on their old boss.
Pretty standard stuff, nothing much of interest - but the rabbit hole deepens.
Ubiquiti assembled an incident response team to investigate the hack.
A team which included one Nickolas Sharp.
Nickolas was a senior developer at Ubiquiti, on a salary of almost a quarter million dollars
per year - the guy was making good money, no one suspected that Nickolas himself was
the mastermind behind the breach.
It turns out that Nickolas was just about to quit working at Ubiquiti, he’d lined
up a new job - and so he launched a plot to squeeze a couple million dollars worth of
bitcoin out of his soon to be former employer.
The plan was simple, use his access to Ubiquiti’s AWS servers and GitHub repositories to steal
gigabytes of confidential data, then send Ubiquiti an anonymous email demanding 50 bitcoin
in exchange for deletion of the data - all whilst using his big brain to implement perfect
OPSEC to avoid detection - what could go wrong?
Well, you see - Nickolas’ OPSEC was about as sophisticated as a 15 year old script kiddy,
he planned to do all of the above from his
home pc, hiding behind a Surfshark VPN subscription.
But in fairness there was some rationale to this, Surfshark does claim “not keep logs”,
which was apparently verified quite recently by an external auditor.
However whilst this will be enough peace of mind for someone wanting to torrent films
whilst avoiding legal letters, more high level criminals might not want to rely entirely
on a VPN, especially when they’re paying for it using their personal PayPal account.
But regardless, Surfshark’s no log claims never actually ended up being tested, because
Nickolas failed at the first hurdle, setting up his VPN properly.
Many VPN’s including Surfshark have a “Kill Switch” feature, so if for whatever reason
you lose your VPN connection, your internet access will be completely cut of until the
VPN connection is restored.
However, Nickolas presumably just didn’t turn this feature on…
Whilst he was in the midst of stealing gigabytes of source code from Ubiquiti’s Github account
- for a brief moment his VPN connection dropped, which caused his computer to revert to using
its default connection, leaking his true ip address right into Github’s logs.
And so, regardless of his other attempts to cover his tracks which even included modifying
session files to implicate his coworkers - it didn’t matter.
The FBI raided his home and seized his devices.
But, the story doesn’t end there, the rabbit hole goes deeper still.
At this point Nickolas was quite obviously on the FBI’s radar, but he hadn’t yet
been charged with anything, so remained a free man.
As for the ransom demand of 50 bitcoin, Ubiquiti flat out refused to pay it, this made Nickolas
very unhappy.
So much so, that even after being raided by the FBI, in what I can only imagine was a
fit of rage, he launched a new campaign to damage Ubiquiti’s reputation by any means
necessary.
Posing as an anonymous whistleblower he contacted Brian Krebs - a well respected reporter in
the field of cyber security, tricking him into running a now famous article, “Whistleblower:
Ubiquiti Breach “Catastrophic”, which claims “The source — we’ll call him
Adam — spoke on condition of anonymity for fear of retribution by Ubiquiti.’
The whole article is essentially a list of false claims about the breach, that hackers
apparently gained the ability access all Ubiquiti customer device’s, that hackers had root
access to all Ubiquiti’s servers and that this armageddon of a breach was all covered
up by Ubiquiti’s legal department.
The article worked, people believed it - decimating
Ubiquiti’s reputation, causing their stock
to plummet 20%, wiping $4 Billion dollars off their valuation overnight.
But whatever satisfaction this all gave Nickolas it didn’t solve his bigger problem, and
after a few months the FBI arrested him for the extortion plot.
But it doesn’t end there, in a bizarre twist Nickolas tried to argue that was all white
hat behaviour, that his little adventure was all part of some kind of “unsanctioned ‘security
drill’”.
However this didn’t get him very far, he ended up pleading guilty, and has in the last
few days been sentenced to 6 years in prison and forced to pay roughly $1.6 million dollars
in damages.
I just can’t understand why a guy on a 250k salary would risk going to prison and becoming
permanently unemployable - in other words ruining his life… for only 8 times his annual
salary.
If you guys can make sense of that, please let me know down below.
Oh and as for the false article.
Ubiquiti actually ended up suing Brian Krebs, not necessarily for posting the article in
the first place, but rather they claimed that he didn’t properly retract it when it all
came out that “Adam” probably wasn’t telling the truth.
But the lawsuit was eventually pulled after Krebs posted an apology.
This video is brought to you by PlexTrac, who’re offering you a FREE one month trial
of their premier cybersecurity reporting and collaboration platform.
Get started today to learn why the best offensive security teams trust PlexTrac.
PlexTrac empowers users to build better reports in half the time, exponentially increasing
ROI and time savings, To aggregate findings from all their tools by consolidating the
testing process into one platform, creating a single source of truth, and to maximize
their reusable report content, like findings writeups and narratives, improving consistency
across the team.
With PlexTrac you’ll become more efficient and effective, delivering better results from
every engagement.
Ready to elevate your reporting, improve collaboration
across teams, and demonstrate real progress?
Spend more time hacking and less time reporting with PlexTrac.
Claim your free month of the PlexTrac platform – exclusively for Seytonic viewers, using
the link in the video description.
As always thanks for watching and I’ll ee you in the next video, have a good one