The FTC claims D-Link failed to secure its devices
The United States’ Federal Trade Commission (FTC) sued D-Link this week after the company failed to secure its devices, making routers and cameras vulnerable to hacks and exposing users and their data. The FTC explained in the lawsuit documents that D-Link that the firm “failed to take reasonable steps” to protect its devices from known security vulnerabilities, adding that this put thousands of consumers at risk.
Sensitive personal information and local networks have been exposed following D-Link’s failure to secure its devices, the FTC says, and hackers could easily compromise the IP cameras and routers using tools that were already available online and developed to exploit widely known vulnerabilities.
How D-Link failed to protect users
Here are a few claims from the FTC complaint pointing out how and why D-Link failed to offer the security that it advertised for its products:“Defendants repeatedly have failed to take reasonable software testing and remediation measures to protect their routers and IP cameras against well- known and easily preventable software security flaws, such as “hard-coded” user credentials and other backdoors, and command injection flaws, which would allow remote attackers to gain control of consumers’ devices.”
“Defendant D-Link has failed to take reasonable steps to maintain the confidentiality of the private key that Defendant D-Link used to sign Defendants’ software, including by failing to adequately restrict, monitor, and oversee handling of the key, resulting in the exposure of the private key on a public website for approximately six months.”
“Defendants have failed to use free software, available since at least 2008, to secure users’ mobile app login credentials, and instead have stored those credentials in clear, readable text on a user’s mobile device.”
Back in July 2016, a vulnerability found in D-Link cameras allowed attackers to get administrator access and then deploy malware, which was used to spy on users and steal their data. D-Link acknowledged the security vulnerability and promised fixes, recommending users to change their passwords on a regular basis in order to be protected against hacks. The FTC is now asking the US District Court for the Northern District of California to order the firm to improve its security guidelines and to cover all costs of the lawsuit.
