[chrisweekly]

Yeah, Krebs published this updated take:

"On Wednesday, a former Ubiquiti developer was arrested and charged with stealing data and trying to extort his employer while pretending to be a whistleblower.

"Federal prosecutors say Nickolas Sharp, a senior developer at Ubiquiti, actually caused the “breach” that forced Ubiquiti to disclose a cybersecurity incident in January."

[ewzimm]

No matter how good your security is, a rogue employee with high-level access will always be a threat. Since they now have experience with this situation, I trust that Ubiquiti has dedicated more resources to preventing both employee sabotage and external breaches.

This also shows that not every breach is what it seems, and investigating fully before publicly disclosing can sometimes help prevent disinformation. The “whistleblower” in this case was intentionally lying, and every customer that dedicated time to mitigation had to pay part of the cost.

[chrisweekly]

Yeah, reminiscent of the (apocryphal?) story of the stuntplane mechanic whose negligence almost cost the pilot his life; assuming he'd be fired, the mechanic was shocked when the pilot said he was now the only mechanic allowed to touch his plane, bc he knew, with certainty, there'd never be another such mishap.