The FBI announced Thursday it successfully disrupted a Russian GRU-led hacking campaign that infiltrated more than a thousand home and small business routers.
OpenWrt has an admin password and UI as well. I hope you changed the former and blocked the latter on external ports, before connecting it to the internet.
Yes of course I changed the root password, I think it would actually be quite difficult not to do that on OpenWrt as it warns you if the password isn’t set.
Was the exploit not related to unifi’s remote / cloud administration features? That’s how I read it, unless they mean remote admin that was installed by the malware.
UniFi and Edge are different product lines. UniFi uses a controller (local or cloud-based) and edge products are the more traditional interface on the device itself.
The article clearly states that edgerouter is the affected product, which means the default password and remote admin interface were the attack vectors.
Thanks, I find the names of Ubiquiti’s product lines pretty confusing particularly as they are often used together.
I have an Edgerouter X, an Edgerouter PoE-5, two UAP-AC-LR (“Ubiquiti UniFi-AC-LR”) access points, and one UAP-AC-MESH (“Ubiquiti UniFi-AC-MESH”) access point.
The access points came with UniFi firmware, whereas the routers were running EdgeOS. I’m no longer using the PoE-5 and I’ve replaced the firmware on all of the other devices with OpenWrt.
OpenWrt has an admin password and UI as well. I hope you changed the former and blocked the latter on external ports, before connecting it to the internet.
Yes of course I changed the root password, I think it would actually be quite difficult not to do that on OpenWrt as it warns you if the password isn’t set.
Was the exploit not related to unifi’s remote / cloud administration features? That’s how I read it, unless they mean remote admin that was installed by the malware.
The articles refer to EdgeOS, not UniFi, which is a separate thing.
UniFi and Edge are different product lines. UniFi uses a controller (local or cloud-based) and edge products are the more traditional interface on the device itself.
The article clearly states that edgerouter is the affected product, which means the default password and remote admin interface were the attack vectors.
Thanks, I find the names of Ubiquiti’s product lines pretty confusing particularly as they are often used together.
I have an Edgerouter X, an Edgerouter PoE-5, two UAP-AC-LR (“Ubiquiti UniFi-AC-LR”) access points, and one UAP-AC-MESH (“Ubiquiti UniFi-AC-MESH”) access point.
The access points came with UniFi firmware, whereas the routers were running EdgeOS. I’m no longer using the PoE-5 and I’ve replaced the firmware on all of the other devices with OpenWrt.
Indeed. Pretty sure the latter is blocked by default.