FTC Takes D-Link To Court Citing Lax Product Security, Privacy Perils (networkworld.com)

Reader coondoggie writes: The Federal Trade Commission has filed a complaint against network equipment vendor D-Link saying inadequate security in the company's wireless routers and Internet cameras left consumers open to hackers and privacy violations. The FTC, in a complaint filed in the Northern District of California charged that "D-Link failed to take reasonable steps to secure its routers and Internet Protocol (IP) cameras, potentially compromising sensitive consumer information, including live video and audio feeds from D-Link IP cameras." For its part, D-Link Systems said it "is aware of the complaint filed by the FTC." According to the FTC's complaint, D-Link promoted the security of its routers on the company's website, which included materials headlined "Easy to secure" and "Advance network security." But despite the claims made by D-Link, the FTC alleged, the company failed to take steps to address well-known and easily preventable security flaws such as "hard-coded" login credentials integrated into D-Link camera software -- such as the username âoeguestâ and the password âoeguestâ -- that could allow unauthorized access to the cameras' live feed, etc.

Comments

D-Link doesn't learn or doesn't care (or both)

[Ritz_Just_Ritz]

They have a history of sluggish or non-existent responses to vulnerabilities going back for many years. About 10 years ago they also had that high profile incident where they were randomly abusing NTP servers belonging to other organizations and they shrugged it off for a long time until there was a big public stink. I don't know why anyone buys that crap or trusts them with any of their data.

Re:D-Link doesn't learn or doesn't care (or both)

[bobbied]

Of course they care... Just only as far as there is money in it...

Look, D-Link sells consumer products and most consumers DON'T CARE about (much less ever THINK about) security. They want a device that does what it's designed to do with a minimum of fuss or mess making it work. They don't want to call technical support, they just want to spend as little as they can in both time and money.

Where I applaud the FTC's paying attention to such things, I'm thinking this isn't going to be very effective in getting manufacturers to knuckle under and do the security thing the right way. NOBODY (well, almost nobody) will care and they simply don't want to pay the price in dollars and time to get proper security configured in that consumer device.. The only way the FTC makes a dent is by hitting D-Link (and other manufacturers) in the pocket book really hard and I don't think they have enough leverage to do that.

Re:D-Link doesn't learn or doesn't care (or both)

[slashrio]

Not so long ago I looked for a firmware update for my D-Link and found it on their website.
HTTP!
So I sent an email asking whether it would be possible to send it over an encrypted channel, or at least get a PGP signature.
The reply was that kind of corporate content-less off-topic help-desk level shit that we are used to receiving, so I spent a phone call to the company.
Got a giggling girl on the line who assured me that there was no problem with that, there hans't ever been one and there wouldn't be any in the foreseeable future.
So I told her her manager was stupid, that I was stupid to have bought that brand, and that I'd never buy that brand ever again.
According to her that was ok, no problem.
I think they are rightly sued now...

Re: Who would ever guess that password, though?

[thesupraman]

More to the point.. Shouldn't they be getting an award for helping the NSA etal in their battle against the global terrorist threat by providing such open access to people's privacy?

After all.. If you have nothing to hide...

Isn't this just a company protectively complying with upcoming surveillance requirements that governments are claiming they need to keep us safe from ourselves?

Isn't any form of privacy protection a form of communism?

Or they can only be given the award in the UK just yet.. Other backwards governments havn't made such positions against their own people official.. Yet..

Re:is aware of the complaint filed by the FTC

[Z00L00K]

They are just starting with someone, almost every consumer grade supplier have security holes in their products and they just leave support for your device about a year after you bought it.

Re:is aware of the complaint filed by the FTC

[Wycliffe]

They are just starting with someone, almost every consumer grade supplier have security holes in their products and they just leave support for your device about a year after you bought it.

This is exactly what I'm worried about. Having "guest/guest" hardcoded is ridiculous but I'm not sure I like the idea of the government deciding what is and is not secure enough. Will it get to the point where only giant companies can release products or accept credit cards because no one else is capable of getting their products certified as secure?

Take TP-Link also

[fuzzyf]

Purchased a TP-Link router that turned out to have a backdoor.
https://tech.slashdot.org/stor...

Asking support about it I got the answer back that "We will not fix it. Just make sure nobody get access to your local network".

Both TP-Link and Lenovo are on my do-not-buy list.

Re:EULA Escape?

[krelvin]

FTC is getting them for false advertising, has nothing to do with the EULA. This is the federal government suing not the consumer.

The issue is they are saying their products are secure when they have many vulnerability outstanding that should be easy to fix and they have not. So they are not safe to use.

Re:is aware of the complaint filed by the FTC

[Motherfucking Shit]

This is exactly what I'm worried about. Having "guest/guest" hardcoded is ridiculous but I'm not sure I like the idea of the government deciding what is and is not secure enough.

The FTC isn't trying to appoint itself arbiter of the IoT, this is just a standard Truth in Advertising case. The problem isn't that the devices weren't secure, it's that they weren't secure but D-Link's marketing said they were. If D-Link hadn't made misleading claims like "advanced network security" when promoting products that shipped with backdoors, we wouldn't be having this discussion.

Re:EULA Escape?

[HiThere]

Don't believe the EULA limitations. A lot of them are just there as intimidation. Which terms are enforceable depend on your state, and local laws trump the EULA.