Podcast
178- Ubiquiti
Darknet Diaries
- Rising Engineer With Growing Access And Resentment
- Nick Sharp joined Ubiquiti from AWS and quickly rose to lead cloud engineering, gaining broad access to sensitive systems and source code.
- He felt underappreciated despite a $250,000 salary, which fed resentment and a desire to be heard. (Time 0:06:41)
- Employee Credentials Can Be The Attack Vector
- Nick realized his legitimate employee credentials provided unfettered access to the AWS environment, GitHub, and Slack, creating a single point of failure.
- He framed a break-in as a way to force leadership to care about security. (Time 0:13:56)
- Bought A VPN To Mask His Break In
- To conceal operations, Nick bought a Surfshark VPN and planned remote access from home and public locations to mask his IP during intrusions.
- He treated the VPN like a criminal hood — part of a deliberate cover strategy. (Time 0:14:20)
- Cloned Hundreds Of Private Repositories Overnight
- Using a shared high-privilege GitHub account and SSH over VPN, Nick cloned hundreds of private repositories and their full history to his home machine.
- He exfiltrated gigabytes of source code late into the night on December 21st, 2020. (Time 0:18:32)
- VPN Drop Left A Trace In Logs
- A momentary ISP outage and VPN kill-switch failure exposed Nick’s real home IP in GitHub logs, creating a critical trace linking him to the downloads.
- Even brief connectivity glitches can produce forensic breadcrumbs. (Time 0:20:32)
- Enforce Least Privilege And Robust Logging
- Do enforce least-privilege and granular auditing so individuals cannot access all company systems and so downloads trigger alerts.
- Nick changed lifecycle retention to one day and renamed sessions to hide his activity, exposing weak logging practices. (Time 0:24:54)
- Extortion Demand Sent Via Email And Keybase
- Nick attempted to extort Ubiquiti for 25 Bitcoin, threatening to publish stolen source code and offering an extra 25 BTC to reveal a supposed backdoor.
- He used Keybase to contact employees and prove possession of the data. (Time 0:27:31)
- Keybase Upload Was Taken Down Quickly
- After no BTC payment, Nick uploaded the stolen data to a public Keybase folder, expecting permanence, but Keybase complied with takedown requests and removed it.
- His reliance on Keybase as an immutable leak vector failed. (Time 0:30:31)
- Local Network Metadata Broke The VPN Cover
- Forensics linked a second MacBook’s MAC address on Nick’s home router to large data transfers concurrent with the GitHub theft, providing a crucial non-IP tie to the crime.
- VPNs hide IPs but local network metadata like MAC-level flows reveal device-level activity. (Time 0:32:58)
- Guilty Plea And Six Year Sentence
- Nick was arrested in December 2021, indicted on wire fraud and related counts, pled guilty to multiple charges, and ultimately sentenced to six years in prison.
- His claim that it was a security drill was rejected during sentencing. (Time 0:38:46)