21.1 C
Saturday, January 29, 2022

Ubiquiti hack may have been an inside job, federal charges suggest

[adace-ad id="2627"]

An indictment from the Department of Justice states that the Ubiquiti hack reported in January, and subsequent whistleblower allegations of a cover-up, were the work of someone who was then an employee of the company. The Department of Justice alleges that Nicholas Sharp, 36, was arrested Wednesday for allegedly using his employee’s credentials to download confidential data and sending anonymous demands to the company he worked for for pretending to be a hacker in an attempt to obtain a ransom of 50 bitcoins. You can read the full indictment below.

The indictment does not specifically name Ubiquiti, but only refers to “Company-1”. However, all the details line up. In January, Ubiquiti sent an email to users stating that an unauthorized party had gained access to “IT systems hosted by an external cloud service provider”. In March, a person claiming to be a whistleblower portrayed the incident as “catastrophic”, claiming that the company could not know the full extent of the attack because it was not keeping logs and that the attacker had access to Amazon Ubiquiti Web Services (AWS).

The indictment says the company is based in New York, which is based in Ubiquiti, and says the company’s share price fell about 20 percent between March 30 and March 31 following news of the incident. According to Yahoo Finance, Ubiquiti’s stock was valued at $376.78 on March 29 and had fallen to $298.30 by March 31.

[adace-ad id="2627"]

Perhaps most notable is the claim that Sharp stated itself as a whistleblower to the media in late March 2021 — at the same time that a whistleblower accused Ubiquiti of covering up the severity of the data breach, despite the company’s denials that user data was targeted. We also saw a LinkedIn profile that appears to belong to Sharp and appears to have worked for Ubiquiti during the time period listed in the indictment.

The Department of Justice alleges that Sharp accessed the company’s Amazon Web Services and Github accounts after applying for a job at another company in December 2020. The indictment says another employee discovered the breach days after Sharp downloaded “gigabytes” of confidential data and applied AWS policies to restrict Register. Sharp is allegedly assigned to the response team involved in assessing the incident, and the Department of Justice says he used the position to try to avoid suspicion.

According to the indictment, Sharp sent an anonymous email promising not to release the data and to help the company correct the backdoor if it obtained 50 bitcoins by January 10, 2021. The Department of Justice alleges that Sharp released some of the stolen data when the company did not pay the ransom.

DOJ says it was able to track Sharp due to a small technical glitch – Sharp allegedly used SurfShark VPN to conceal his identity while taking data and sending emails, but “in one passing case” his real IP address was identified and recorded as the GitHub connection for the company. According to the Department of Justice, this happened when Sharp’s home Internet went down, then reconnected.

[adace-ad id="2627"]

According to the indictment, this eventually led to the FBI executing a search warrant for Sharp’s home, in which he denied using SurfShark and said someone else had used his PayPal account to purchase the subscription. In a recent development, the indictment states that Sharp communicated with the media pretending to be a whistleblower after, after The FBI searched his home and confiscated electronic devices.

If Sharp is found guilty and the Department of Justice can establish that the incident was disclosed as stipulated in the indictment, it will surely shed new light on the Ubiquiti hack reports. The indictment alleges that Sharp began the attack using credentials he obtained to do his job. In March, Ubiquiti stuck to its statement that the attackers had not accessed customer data, which does not appear to contradict information disclosed today.

[adace-ad id="2627"]

Related Articles


Please enter your comment!
Please enter your name here

Stay Connected


Latest Articles