Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

 


Forgot your password?
Close
typodupeerror
×
Network Networking Security The Courts United States

FTC Takes D-Link To Court Citing Lax Product Security, Privacy Perils (networkworld.com) 72

Posted by msmash from the see-you-in-court dept.
Reader coondoggie writes: The Federal Trade Commission has filed a complaint against network equipment vendor D-Link saying inadequate security in the company's wireless routers and Internet cameras left consumers open to hackers and privacy violations. The FTC, in a complaint filed in the Northern District of California charged that "D-Link failed to take reasonable steps to secure its routers and Internet Protocol (IP) cameras, potentially compromising sensitive consumer information, including live video and audio feeds from D-Link IP cameras." For its part, D-Link Systems said it "is aware of the complaint filed by the FTC." According to the FTC's complaint, D-Link promoted the security of its routers on the company's website, which included materials headlined "Easy to secure" and "Advance network security." But despite the claims made by D-Link, the FTC alleged, the company failed to take steps to address well-known and easily preventable security flaws such as "hard-coded" login credentials integrated into D-Link camera software -- such as the username âoeguestâ and the password âoeguestâ -- that could allow unauthorized access to the cameras' live feed, etc.
This discussion has been archived. No new comments can be posted.

FTC Takes D-Link To Court Citing Lax Product Security, Privacy Perils More

FTC Takes D-Link To Court Citing Lax Product Security, Privacy Perils

Comments Filter:

  • I mean, next thing you'll tell me is that 1234 is a bad combination for my luggage.

    • Re: Who would ever guess that password, though? (Score:4, Funny)

      by thesupraman ( 179040 ) on Thursday January 05, 2017 @05:38PM (#53613153)

      More to the point.. Shouldn't they be getting an award for helping the NSA etal in their battle against the global terrorist threat by providing such open access to people's privacy?

      After all.. If you have nothing to hide...

      Isn't this just a company protectively complying with upcoming surveillance requirements that governments are claiming they need to keep us safe from ourselves?

      Isn't any form of privacy protection a form of communism?

      Or they can only be given the award in the UK just yet.. Other backwards governments havn't made such positions against their own people official.. Yet..

    • Re: (Score:2)

      by msauve ( 701917 )
      1234 is easy to type. Try "username Ãoeguestà and password ÃoeguestÃ".
    • I don't know what you're talking about. It's a perfect password for a planetary shield.

  • D-Link doesn't learn or doesn't care (or both) (Score:5, Informative)

    by Ritz_Just_Ritz ( 883997 ) on Thursday January 05, 2017 @05:31PM (#53613099)

    They have a history of sluggish or non-existent responses to vulnerabilities going back for many years. About 10 years ago they also had that high profile incident where they were randomly abusing NTP servers belonging to other organizations and they shrugged it off for a long time until there was a big public stink. I don't know why anyone buys that crap or trusts them with any of their data.

    • Re:D-Link doesn't learn or doesn't care (or both) (Score:5, Insightful)

      by bobbied ( 2522392 ) on Thursday January 05, 2017 @05:45PM (#53613205)

      Of course they care... Just only as far as there is money in it...

      Look, D-Link sells consumer products and most consumers DON'T CARE about (much less ever THINK about) security. They want a device that does what it's designed to do with a minimum of fuss or mess making it work. They don't want to call technical support, they just want to spend as little as they can in both time and money.

      Where I applaud the FTC's paying attention to such things, I'm thinking this isn't going to be very effective in getting manufacturers to knuckle under and do the security thing the right way. NOBODY (well, almost nobody) will care and they simply don't want to pay the price in dollars and time to get proper security configured in that consumer device.. The only way the FTC makes a dent is by hitting D-Link (and other manufacturers) in the pocket book really hard and I don't think they have enough leverage to do that.

      • Re: (Score:2)

        by Luthair ( 847766 )
        I think its more that customers don't even realize its an issue, they perceive they're buying a legitimate brand. The classic example is the Corvair.

        • Today, even Ralph Nader admits the Corvair was no more dangerous than the classic VW beetle (the IRS super beetle was better though). But he built his career on it, so he doesn't say it loud or often.

          • Re: (Score:2)

            by rtb61 ( 674572 )

            How about this "To make up for the cost-cutting lack of a front stabilizer bar (anti-roll bar), Corvairs required tire pressures which were outside of the tire manufacturers' recommended tolerances."https://en.wikipedia.org/wiki/Unsafe_at_Any_Speed. So handling was not worse than other cars just as long as you ran the tyres at (15psi front, 26psi rear, when cold; 18 psi and 30psi hot). Yep uh huh, sure.

            • Nader is a selfish cock whose data on the Corvair suspension issue was obsolete, as it had already been fixed for the 1965 model year. Instead of correcting his book before publishing it, he put it on the market to quickly collect his profit and contributed to the failure of the (now much safer) Corvair and probably causing many people to lose their jobs.

      • most consumers DON'T CARE about (much less ever THINK about) security.

        No, most consumers don't think about IMPLEMENTING security. That's because they trust that the makers of their devices are smarter than them, and wouldn't make deliberate decisions that hurt security (like hardcoded admin logins). This is after people like me hammered in the idea that to be (more) secure on the internet, you need to use a router and not plug in directly.

        It's in the same vein as trusting the person who makes your car that

        • Not that I disagree, but the point here is that companies like D-Link don't really care until it benefits them financially. Should consumers stop buying their products because of a perception that they lack the necessary security, you can bet that the company will do two things. First, they will develop some kind of security "fix" for all their products... Second they will start a PR "We Care About Security" push to change the perception.

          • Re: (Score:1)

            by phorm ( 591458 )

            "Security is our #1 Priority"

            (until the next scandal, when something else becomes #1)

    • Not so long ago I looked for a firmware update for my D-Link and found it on their website.
      HTTP!
      So I sent an email asking whether it would be possible to send it over an encrypted channel, or at least get a PGP signature.
      The reply was that kind of corporate content-less off-topic help-desk level shit that we are used to receiving, so I spent a phone call to the company.
      Got a giggling girl on the line who assured me that there was no problem with that, there hans't ever been one and there wouldn't be any

  • Take TP-Link also (Score:4, Interesting)

    by fuzzyf ( 1129635 ) on Thursday January 05, 2017 @05:55PM (#53613279)
    Purchased a TP-Link router that turned out to have a backdoor.
    https://tech.slashdot.org/stor... [slashdot.org]

    Asking support about it I got the answer back that "We will not fix it. Just make sure nobody get access to your local network".

    Both TP-Link and Lenovo are on my do-not-buy list.
  • Not sure if it would hold off the FTC, but the EULA of these products likely give D-Link full immunity from civil lawsuits like most consumer level software or equipment.

    • Re: (Score:3)

      by krelvin ( 771644 )

      FTC is getting them for false advertising, has nothing to do with the EULA. This is the federal government suing not the consumer.

      The issue is they are saying their products are secure when they have many vulnerability outstanding that should be easy to fix and they have not. So they are not safe to use.

      • don't get me wrong, I think it's good that the FTC is doing this. But those restrictive terms in typical EULAs should be illegal, and likely many are if actually challenged in court, but consumers need redress for defective products, FTC fining them and pressuring for "better next time" is good, but does nothing for the people that bought the defective gear.

    • Re: (Score:3)

      by HiThere ( 15173 )

      Don't believe the EULA limitations. A lot of them are just there as intimidation. Which terms are enforceable depend on your state, and local laws trump the EULA.

  • So D-Link has buggy insecure code. Can't the marketplace correct for this? Do I care if someone gets the live feed of my camera watching my front door? No. When will the FTC go after Comcast and AT&T for abusing their monopoly status? Or how about Microsoft for spying on me without disclosing what they're doing and upgrading and rebooting my PC without my consent? Why do those companies get a free pass?

  • I don't see what the issue is. If people want to buy an insecure device that will compromise their well-being, then they should be allowed to. I thought the whole point of capitalism was, "Do whatever it takes to make money", and regulation gets in the way of that!

    Thankfully Trump will put an end to this "You need to put out a product that isn't shit" nonsense.

    • > If people want to buy an insecure device that will compromise their well-being, then they should be allowed to.

      Actually that's the FTC's position. The company fraudulently advertised the product as having "advanced security" and "easy to secure." That's the law suit - "if people want to buy insecure/secure, then they should be allowed to", companies may not lie and deliver the opposite of what they sold the customer. The result of the law suit will probably be that the company will stop advertisin

      • What if it IS "Advanced Security", but just not advanced enough? I mean, compared to what we had in the 90s, it most certainly is advanced. :)

Slashdot Top Deals

To the systems programmer, users and applications serve only to provide a test load.

Close