Slashdot Mirror
FTC Takes D-Link To Court Citing Lax Product Security, Privacy Perils (networkworld.com)
Reader coondoggie writes: The Federal Trade Commission has filed a complaint against network equipment vendor D-Link saying inadequate security in the company's wireless routers and Internet cameras left consumers open to hackers and privacy violations. The FTC, in a complaint filed in the Northern District of California charged that "D-Link failed to take reasonable steps to secure its routers and Internet Protocol (IP) cameras, potentially compromising sensitive consumer information, including live video and audio feeds from D-Link IP cameras." For its part, D-Link Systems said it "is aware of the complaint filed by the FTC." According to the FTC's complaint, D-Link promoted the security of its routers on the company's website, which included materials headlined "Easy to secure" and "Advance network security." But despite the claims made by D-Link, the FTC alleged, the company failed to take steps to address well-known and easily preventable security flaws such as "hard-coded" login credentials integrated into D-Link camera software -- such as the username âoeguestâ and the password âoeguestâ -- that could allow unauthorized access to the cameras' live feed, etc.
I mean, next thing you'll tell me is that 1234 is a bad combination for my luggage.
Check out my sci-fi/humor trilogy at PatriotsBooks.
They have a history of sluggish or non-existent responses to vulnerabilities going back for many years. About 10 years ago they also had that high profile incident where they were randomly abusing NTP servers belonging to other organizations and they shrugged it off for a long time until there was a big public stink. I don't know why anyone buys that crap or trusts them with any of their data.
They are just starting with someone, almost every consumer grade supplier have security holes in their products and they just leave support for your device about a year after you bought it.
If builders built buildings the way programmers wrote programs, then the first woodpecker would destroy civilization.
They are just starting with someone, almost every consumer grade supplier have security holes in their products and they just leave support for your device about a year after you bought it.
This is exactly what I'm worried about. Having "guest/guest" hardcoded is ridiculous but I'm not sure I like the idea of the government deciding what is and is not secure enough. Will it get to the point where only giant companies can release products or accept credit cards because no one else is capable of getting their products certified as secure?
Purchased a TP-Link router that turned out to have a backdoor.
https://tech.slashdot.org/stor...
Asking support about it I got the answer back that "We will not fix it. Just make sure nobody get access to your local network".
Both TP-Link and Lenovo are on my do-not-buy list.
Not sure if it would hold off the FTC, but the EULA of these products likely give D-Link full immunity from civil lawsuits like most consumer level software or equipment.
I thought Netgear was a Cisco competitor.
Cisco brand their consumer crap Linksys
So D-Link has buggy insecure code. Can't the marketplace correct for this? Do I care if someone gets the live feed of my camera watching my front door? No. When will the FTC go after Comcast and AT&T for abusing their monopoly status? Or how about Microsoft for spying on me without disclosing what they're doing and upgrading and rebooting my PC without my consent? Why do those companies get a free pass?
I don't see what the issue is. If people want to buy an insecure device that will compromise their well-being, then they should be allowed to. I thought the whole point of capitalism was, "Do whatever it takes to make money", and regulation gets in the way of that!
Thankfully Trump will put an end to this "You need to put out a product that isn't shit" nonsense.
This is exactly what I'm worried about. Having "guest/guest" hardcoded is ridiculous but I'm not sure I like the idea of the government deciding what is and is not secure enough.
The FTC isn't trying to appoint itself arbiter of the IoT, this is just a standard Truth in Advertising case. The problem isn't that the devices weren't secure, it's that they weren't secure but D-Link's marketing said they were. If D-Link hadn't made misleading claims like "advanced network security" when promoting products that shipped with backdoors, we wouldn't be having this discussion.
"BSD: Free as in speech. Linux: Free as in beer. Windows 10: Free as in herpes." --Man On Pink Corner in #52607549.
UL certification for electrical safety is done as an independent third-party audit, but is licensed by the government to do so. Certification is not legally mandated, but nearly everyone does it, because most large companies will not buy products without it.
I think perhaps a similar system for electronic security audits could work in the same way. To get and maintain a favorable rating, you must demonstrate:
a) reasonable and good-faith efforts have been made to ensure security and privacy (no default passwords, no back doors, etc)
b) current industry standards and guidelines have been adhered to
c) a simple or automated patching mechanism is available if security issues are discovered.
d) duration of security support is explicitly listed on packaging.
Or something like that - that's just off the top of my head.
At least users can be reasonably assured of security by looking for a simple label. That seems like a reasonable compromise between "government mandated security rules" and the current "zero security" state of affairs. And it's seemed to work out reasonably well for electrical safety.
Irony: Agile development has too much intertia to be abandoned now.
> If people want to buy an insecure device that will compromise their well-being, then they should be allowed to.
Actually that's the FTC's position. The company fraudulently advertised the product as having "advanced security" and "easy to secure." That's the law suit - "if people want to buy insecure/secure, then they should be allowed to", companies may not lie and deliver the opposite of what they sold the customer. The result of the law suit will probably be that the company will stop advertising security.
What if it IS "Advanced Security", but just not advanced enough? I mean, compared to what we had in the 90s, it most certainly is advanced. :)
Hey Al . . . You do realize you're talking to yourself, right? Never a good sign . . .
But to clear up a point . . . I'be noticed you like to accuse everyone in sight of being exactly what you are. A shame . . . I even tried to treat you civilly here on more than one occasion (even apologizing for my own mistakes made in anger), but you seem unable to recognize such a gesture. You apparently have no emotional background upon which to base adult interaction.
In closing . . . I'm sorry to see that doctors have been unable to identify or cure whatever's wrong with you. Let us all know when you mature. Until then, please feel free to follow-post me; your derision is as much a badge of honor as a +5 post here on Slashdot.
most consumers DON'T CARE about (much less ever THINK about) security.
No, most consumers don't think about IMPLEMENTING security. That's because they trust that the makers of their devices are smarter than them, and wouldn't make deliberate decisions that hurt security (like hardcoded admin logins). This is after people like me hammered in the idea that to be (more) secure on the internet, you need to use a router and not plug in directly.
It's in the same vein as trusting the person who makes your car that it won't cheat on emissions, accelerate without the pedal being pressed, etc etc.
In other words, a case of misplaced trust - or a vendor who violates said trust - not lack of caring...
> This. They're only doing it because D-Link is a Taiwanese company.
> We're seeing racist Trump in action. If he wasn't racist he'd go after
> Microsoft because of their security problems that they refuse to fix.
Errr, uhhhm, Trump is still 2 weeks away from being sworn in as president. A year ago, they were blaming everything on global warming. Now they're blaming everything on Trump.
I'm not repeating myself
I'm an X window user; I'm an ex-Windows user