HeadlinesBriefing favicon HeadlinesBriefing.com

UniFi Inform Protocol Reverse-Engineered for Multi-Tenant Hosting

Hacker News •
×

A developer reverse-engineered Ubiquiti's UniFi inform protocol to solve a business problem. Running a UniFi hosting service meant paying $4-6 per VPS for each customer while charging only $7-8 monthly, leaving $1-2 in profit that evaporated with any support request. The solution required making UniFi controllers multi-tenant, which meant routing device traffic without per-instance isolation.

The inform protocol proved the key. Every UniFi device phones home every 10 seconds via HTTP POST to port 8080, sending AES-128-CBC encrypted data. The first 40 bytes contain an unencrypted header with the device's MAC address at byte offset 8. This MAC address lets you identify which device is talking without decrypting anything. Ubiquiti includes it because controllers need to know the device before looking up its per-device encryption key.

With this insight, a simple Go proxy can read the MAC address and route traffic to the correct tenant's controller. The proxy handles edge cases like factory-reset devices while normal subdomain routing handles most traffic. Other ports (8443 for web UI, 3478 for STUN) are straightforward. The economics flip completely - what was a volunteering operation becomes profitable when you're not paying for a whole VM per customer. Six unencrypted bytes in a protocol header made multi-tenant UniFi hosting practical.