Ubiquiti breach INVOLVES MacBook
Forensics linked a MacBook connected to Nick’s router with the large data transfer during the attack.
Explicit Confidence 99% · Jack Rhysider EP 178 Details
“a MacBook laptop was used to connect to the router”
Qualified triples from the transcripts. Origin, speaker, and evidence stay attached. These are not independently verified facts.
Ubiquiti breach INVOLVES MacBook
Forensics linked a MacBook connected to Nick’s router with the large data transfer during the attack.
Explicit Confidence 99% · Jack Rhysider EP 178 Details
“a MacBook laptop was used to connect to the router”
Ubiquiti breach INVOLVES Nickolas Sharp
The episode presents Nickolas Sharp as the insider responsible for carrying out the Ubiquiti breach; he later admitted the plan.
Explicit Confidence 99% · Jack Rhysider EP 178 Details
“In February 2023 he pleads guilty to three counts”
“Nick admits that it was all planned for financial gain.”
Ubiquiti breach INVOLVES log deletion
The breach involved Nick’s deletion or attempted deletion of AWS logs to conceal activity.
Explicit Confidence 98% · Jack Rhysider EP 178 Details
“This will delete the logs”
Ubiquiti breach INVOLVES Data exfiltration
The Ubiquiti breach involved exfiltration of private repositories and other confidential company data.
Explicit Confidence 99% · Jack Rhysider EP 178 Details
“data has been exfiltrated”
“he’s cloned and downloaded over 100 repositories”
CWT ransomware attack INVOLVES Ransomware
The CWT attack involved ransomware.
Explicit Confidence 99% · Jack Rhysider EP 178 Details
“Then they infected the network with ransomware.”
Ubiquiti breach INVOLVES MAC address
Investigators used MAC-address information from the home router to identify the device involved in the attack.
Explicit Confidence 99% · Jack Rhysider EP 178 Details
“they can see which MAC address connected to that Ubiquiti router”
CWT ransomware attack INVOLVES Data exfiltration
The attackers stole two terabytes of data from CWT.
Explicit Confidence 99% · Jack Rhysider EP 178 Details
“The hackers stole two terabytes of data.”
Ubiquiti breach INVOLVES IP address
The investigation involved matching Nick’s home IP address with the IP address used in the attack.
Explicit Confidence 99% · Jack Rhysider EP 178 Details
“His home IP address was found in the investigation”
“the IPs match”
Robert Pera MEMBER_OF Ubiquiti
Robert Pera is identified as Ubiquiti’s CEO and Nick’s boss.
Explicit Confidence 99% · Jack Rhysider EP 178 Details
“His big boss was Robert Pera, the CEO of Ubiquiti.”
Nickolas Sharp MEMBER_OF Ubiquiti
Nickolas Sharp worked for Ubiquiti and eventually led its cloud team.
Explicit Confidence 99% · Jack Rhysider EP 178 Details
“he quit his job at AWS and took the job at Ubiquiti”
“ended up leading the whole cloud team”
Nickolas Sharp USES Keybase
Nick used Keybase to communicate with a senior Ubiquiti employee and publish stolen data.
Explicit Confidence 99% · Jack Rhysider EP 178 Details
“Nick himself was active on Keybase”
“Nick uploads the stolen data to a public Keybase folder.”
Ubiquiti’s bug-bounty program was run through HackerOne.
Explicit Confidence 99% · Jack Rhysider EP 178 Details
“This program, run by HackerOne, rewards people for finding vulnerabilities.”
Nickolas Sharp USES Surfshark VPN
Nick purchased and used Surfshark VPN to conceal his IP address during the attack.
Explicit Confidence 99% · Jack Rhysider EP 178 Details
“Nick went with Surfshark VPN.”
“Nick was connected behind that Surfshark VPN”
Nickolas Sharp USES GitHub
Nick used Ubiquiti’s GitHub account and repositories to access and clone private source-code data.
Explicit Confidence 99% · Jack Rhysider EP 178 Details
“Nick logs into Ubiquiti’s GitHub account.”
“he starts running commands to clone these top-secret files”
Nickolas Sharp USES VPN
Nick used a VPN to hide his IP address while accessing Ubiquiti systems.
Explicit Confidence 98% · Jack Rhysider EP 178 Details
“He got a twenty-seven-month subscription”
“His IP is hidden”
Ubiquiti used GitHub to store source code and private repositories.
Explicit Confidence 99% · Jack Rhysider EP 178 Details
“GitHub is where Ubiquiti stores their source code.”
Nickolas Sharp USES SSH
Nick connected to GitHub via SSH while using the shared high-level account.
Explicit Confidence 99% · Jack Rhysider EP 178 Details
“He connects via SSH.”
Nickolas Sharp USES Data exfiltration
Nick downloaded more than 100 repositories containing gigabytes of confidential company data.
Explicit Confidence 99% · Jack Rhysider EP 178 Details
“he’s cloned and downloaded over 100 repositories”
“That’s gigabytes of confidential company data.”
Nickolas Sharp USES Amazon Web Services
Nick used his normal Ubiquiti credentials to log into the company’s AWS cloud environment.
Explicit Confidence 99% · Jack Rhysider EP 178 Details
“Nick fires up his work laptop. He logs into Ubiquiti’s cloud environment on AWS.”
Nickolas Sharp USES get-caller-identity
Nick ran get-caller-identity to verify the identity of the account he was using.
Explicit Confidence 99% · Jack Rhysider EP 178 Details
“Nick then runs a command called get-caller-identity.”
Nickolas Sharp USES VPN kill switch
Nick enabled a VPN kill switch to prevent connections from going out if the VPN disconnected.
Explicit Confidence 99% · Jack Rhysider EP 178 Details
“He thought about that and enabled a VPN kill switch”
Ubiquiti used Keybase as a channel through which the attacker contacted a senior employee and uploaded data.
Explicit Confidence 95% · Jack Rhysider EP 178 Details
“They contact Keybase”
“Keybase removes all the data that Nick uploaded.”
Nickolas Sharp USES principle of least privilege
Nick had advocated the principle of least privilege, although he also exploited Ubiquiti’s overly broad access controls.
Explicit Confidence 97% · Jack Rhysider EP 178 Details
“The principle of least privilege is something he tried to tell them about”
Nickolas Sharp USES log deletion
Nick changed AWS log-retention policies to one day in an attempt to delete evidence of his activity.
Explicit Confidence 99% · Jack Rhysider EP 178 Details
“He changes the life cycle retention policies to just one day.”
“This will delete the logs”
Ubiquiti USES Amazon Web Services
Ubiquiti hosted its cloud environment and systems on AWS.
Explicit Confidence 98% · Jack Rhysider EP 178 Details
“Ubiquiti’s cloud environment on AWS”