UniFi devices broadcasted private video to other users' accounts(arstechnica.com)
arstechnica.com
UniFi devices broadcasted private video to other users' accounts
https://arstechnica.com/security/2023/12/unifi-devices-broadcasted-private-video-to-other-users-accounts/
5 comments
Help me understand: this allowed people access to other people's self-hosted infrastructure? It is self-hosted, right?
You can enable "remote access" (or maybe it's on by default, don't remember), that does something to allow remote access to your setup with your unifi account, probably tunnels it through unifi servers.
It's an option that definitely should not be in there, remote access should always be done via a VPN or something secure.
It's an option that definitely should not be in there, remote access should always be done via a VPN or something secure.
I have their camera system in my home (and am generally happy with it). You can set it to be accessible only via the local network (and whatever holes you punch through yourself, e.g. setting up VPN), but to compete with cloud-based solutions like Google Nest (if they haven't canceled that already), there is an option to make it available via unifi.ui.com also.
This isn't really cloud-hosted; but it provides a no-setup way to access your security cameras as if they were (as long as your UniFi device is online).
I'm assuming (but also trying to read more to verify) that this bug affected users who had enabled this option.
This isn't really cloud-hosted; but it provides a no-setup way to access your security cameras as if they were (as long as your UniFi device is online).
I'm assuming (but also trying to read more to verify) that this bug affected users who had enabled this option.
As quickly as I was interested and have one device on trial -- have they destroyed all confidence once again and made me go back to the Frigate stack.
Thanks, Ubiquiti. Always so close, but always so NSA stinky.
Thanks, Ubiquiti. Always so close, but always so NSA stinky.