Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Compliance

FTC Sues D-Link Over Failure to Secure Cameras, Routers

The U.S. Federal Trade Commission (FTC) has filed a lawsuit against Taiwan-based networking equipment provider D-Link, accusing the company of making deceptive claims about the security of its products, particularly IP cameras and routers.

The U.S. Federal Trade Commission (FTC) has filed a lawsuit against Taiwan-based networking equipment provider D-Link, accusing the company of making deceptive claims about the security of its products, particularly IP cameras and routers.

The FTC said D-Link’s promotional materials and device interfaces advertise products as being highly secure, but in reality, the company has failed to address flaws and it has put consumers at risk.

The examples provided by the FTC include the existence of hardcoded credentials that allow access to live camera feeds, leaving login credentials unprotected, the accidental disclosure of private code signing keys, and failure to patch serious vulnerabilities that can be exploited to hijack devices.

D-Link has been accused of several FTC Act violations, including misrepresentations about security in router and IP camera user interfaces and promotional materials, falsely claiming that reasonable steps have been taken to prevent unauthorized access to devices, and failure to secure software.

“Hackers are increasingly targeting consumer routers and IP cameras — and the consequences for consumers can include device compromise and exposure of their sensitive personal information,” stated Jessica Rich, director of the FTC’s Bureau of Consumer Protection. “When manufacturers tell consumers that their equipment is secure, it’s critical that they take the necessary steps to make sure that’s true.”

Several researchers reported finding serious vulnerabilities in D-Link products over the past year, and while some were satisfied with how D-Link addressed issues, others decided to disclose unpatched flaws due to the vendor’s failure to release firmware updates in a timely manner.

D-Link is not the only Taiwanese router manufacturer targeted by the FTC. In February, the agency announced that it had reached a settlement with Asus, after the vendor agreed to establish a security program and implement a system to ensure that customers can stay informed on vulnerabilities and the availability of patches.

Earlier this week, the FTC announced the launch of the IoT Home Inspector Challenge, which aims to find technical solutions for securing IoT devices. The winner of the contest will receive $25,000.

Advertisement. Scroll to continue reading.

UPDATE. D-Link has responded to the FTC complaint saying that it denies the unwarranted allegations outlined in the FTC complaint and will vigorously defend the action.

“The FTC complaint alleges certain security hacking concerns for consumer routers and IP cameras, and we firmly believe that charges alleged in the complaint against D-Link Systems are unwarranted,” said William Brown, D-Link’s chief information security officer. “We will vigorously defend the security and integrity of our routers and IP cameras and are fully prepared to contest the complaint. Furthermore, we are continually working to address the overall security features of D-Link Systems’ products for their intended applications and to regularly inform consumers of the appropriate steps to take to secure devices.

Related: FCC, FTC Investigate Mobile Device Patching Practices

Related: Oracle Settles FTC Charges Over Java Security Updates

Written By

Eduard Kovacs (@EduardKovacs) is a managing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Click to comment

Trending

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Join the session as we discuss the challenges and best practices for cybersecurity leaders managing cloud identities.

Register

SecurityWeek’s Ransomware Resilience and Recovery Summit helps businesses to plan, prepare, and recover from a ransomware incident.

Register

Expert Insights

Related Content

Vulnerabilities

Less than a week after announcing that it would suspended service indefinitely due to a conflict with an (at the time) unnamed security researcher...

Identity & Access

Zero trust is not a replacement for identity and access management (IAM), but is the extension of IAM principles from people to everyone and...

Data Breaches

OpenAI has confirmed a ChatGPT data breach on the same day a security firm reported seeing the use of a component affected by an...

IoT Security

A group of seven security researchers have discovered numerous vulnerabilities in vehicles from 16 car makers, including bugs that allowed them to control car...

Vulnerabilities

A researcher at IOActive discovered that home security systems from SimpliSafe are plagued by a vulnerability that allows tech savvy burglars to remotely disable...

Risk Management

The supply chain threat is directly linked to attack surface management, but the supply chain must be known and understood before it can be...

Cybercrime

Patch Tuesday: Microsoft calls attention to a series of zero-day remote code execution attacks hitting its Office productivity suite.

Vulnerabilities

Patch Tuesday: Microsoft warns vulnerability (CVE-2023-23397) could lead to exploitation before an email is viewed in the Preview Pane.