The U.S. Federal Trade Commission (FTC) has filed a lawsuit against Taiwan-based networking equipment provider D-Link, accusing the company of making deceptive claims about the security of its products, particularly IP cameras and routers.
The FTC said D-Link’s promotional materials and device interfaces advertise products as being highly secure, but in reality, the company has failed to address flaws and it has put consumers at risk.
The examples provided by the FTC include the existence of hardcoded credentials that allow access to live camera feeds, leaving login credentials unprotected, the accidental disclosure of private code signing keys, and failure to patch serious vulnerabilities that can be exploited to hijack devices.
D-Link has been accused of several FTC Act violations, including misrepresentations about security in router and IP camera user interfaces and promotional materials, falsely claiming that reasonable steps have been taken to prevent unauthorized access to devices, and failure to secure software.
“Hackers are increasingly targeting consumer routers and IP cameras — and the consequences for consumers can include device compromise and exposure of their sensitive personal information,” stated Jessica Rich, director of the FTC’s Bureau of Consumer Protection. “When manufacturers tell consumers that their equipment is secure, it’s critical that they take the necessary steps to make sure that’s true.”
Several researchers reported finding serious vulnerabilities in D-Link products over the past year, and while some were satisfied with how D-Link addressed issues, others decided to disclose unpatched flaws due to the vendor’s failure to release firmware updates in a timely manner.
D-Link is not the only Taiwanese router manufacturer targeted by the FTC. In February, the agency announced that it had reached a settlement with Asus, after the vendor agreed to establish a security program and implement a system to ensure that customers can stay informed on vulnerabilities and the availability of patches.
Earlier this week, the FTC announced the launch of the IoT Home Inspector Challenge, which aims to find technical solutions for securing IoT devices. The winner of the contest will receive $25,000.
UPDATE. D-Link has responded to the FTC complaint saying that it “denies the unwarranted allegations outlined in the FTC complaint and will vigorously defend the action.”
“The FTC complaint alleges certain security hacking concerns for consumer routers and IP cameras, and we firmly believe that charges alleged in the complaint against D-Link Systems are unwarranted,” said William Brown, D-Link’s chief information security officer. “We will vigorously defend the security and integrity of our routers and IP cameras and are fully prepared to contest the complaint. Furthermore, we are continually working to address the overall security features of D-Link Systems’ products for their intended applications and to regularly inform consumers of the appropriate steps to take to secure devices.”
Related: FCC, FTC Investigate Mobile Device Patching Practices
Related: Oracle Settles FTC Charges Over Java Security Updates