Former Ubiquiti Developer Charged With Extortion Among Other Things Related To Whistleblowing Incident
You might recall the mess that Ubiquiti got into earlier this year when they had to admit that they massively downplayed a security breach. Well there was a serious plot twist in that story. It seems that the person who blew the whistle on Ubiquiti was a former developer for the company who was also trying to extort them. And now he’s charged:
Nickolas Sharp, a former employee of networking device maker Ubiquiti, was arrested and charged today with data theft and attempting to extort his employer while posing as a whistleblower and an anonymous hacker.
“As alleged, Nickolas Sharp exploited his access as a trusted insider to steal gigabytes of confidential data from his employer, then, posing as an anonymous hacker, sent the company a nearly $2 million ransom demand,” U.S. Attorney Damian Williams said today.
“As further alleged, after the FBI searched his home in connection with the theft, Sharp, now posing as an anonymous company whistleblower, planted damaging news stories falsely claiming the theft had been by a hacker enabled by a vulnerability in the company’s computer systems.”
According to the indictment [PDF], Sharp stole gigabytes of confidential data from Ubiquiti’s AWS (on December 10, 2020) and GitHub (on December 21 and 22, 2020) infrastructure using his cloud administrator credentials, cloning hundreds of GitHub repositories over SSH.
Throughout this process, the defendant tried hiding his home IP address using Surfshark’s VPN services. However, his actual location was exposed after a temporary Internet outage.
To hide his malicious activity, Sharp also altered log retention policies and other files that would have exposed his identity during the subsequent incident investigation.
“Among other things, SHARP applied one-day lifecycle retention policies to certain logs on AWS which would have the effect of deleting certain evidence of the intruder’s activity within one day,” the court documents read.
After Ubiquiti disclosed a security incident in January following Sharp’s data theft, while working to assess the scope and remediate the security breach effects he also tried extorting the company (posing as an anonymous hacker).
His ransom note demanded almost $2 million in exchange for returning the stolen files and the identification of a remaining vulnerability.
The company refused to pay the ransom and, instead, found and removed a second backdoor from its systems, changed all employee credentials, and issued the January 11 security breach notification.
After his extortion attempts failed, Sharp shared information with the media while pretending to be a whistleblower and accusing the company of downplaying the incident.
This caused Ubiquiti’s stock price to fall by roughly 20%, from $349 on March 30 to $290 on April 1, amounting to losses of over $4 billion in market capitalization.
This pretty much proves that one not only has to worry about hackers on the outside, but those inside your company with an axe to grind. That makes having a solid security posture insanely difficulty. But it’s clearly now a requirement based on this incident.
April 2, 2022 at 3:47 pm
[…] when it came to the response to this story. But it doesn’t end there. The whistleblower was busted for extortion a few months later in relation to this story. And now the latest twist in this story is that Brian […]