FTC Sues D-Link For Pretending To Give A Damn About Hardware Security

from the cutting-edge-incompetence dept

If you’ve been paying attention, you’ve probably noticed that the so-called Internet of Things isn’t particularly secure. Hardware vendors were so excited to market a universe of new internet-connected devices, they treated things like privacy, security, and end-user control as afterthoughts. As a result, we’ve now got smart TVs, smart tea kettles, WiFi-connected barbies and all manner of other devices that are not only leaking private customer data, but are being quickly hacked, rolled into botnets, and used in historically unprecedented new, larger DDoS attacks.

This isn’t a problem exclusive to new companies breaking into the IoT space. Long-standing hardware vendors that have consistently paid lip service to security are fueling the problem. Asus, you’ll recall, was dinged by the FTC last year for marketing its routers as incredibly secure, yet shipping them with easily-guessed default username/login credentials and cloud-based functionality that was easily exploitable.

The FTC is back again, this time suing D-Link for routers and video cameras that the company claimed were “easy to secure” and delivered “advanced network security,” yet were about as secure as a kitten-guarded pillow fort. Like Asus, D-Link’s hardware also frequently ships with easily-guessed default login credentials. This frequently allows “hackers” (that term is generous since it takes just a few keystrokes) to peruse an ocean of unsecured cameras via search engines like Shodan, allowing them to spy on families and businesses in real time.

According to the FTC, D-Link’s hardware also consistently suffers from a number of other vulnerabilities the regulator says the company simply refused to seriously address, including command injection software flaws that let remote attackers take control of consumers’ routers via any IP address. D-Link is also accused of mishandling the private key used to sign into D-Link software (said key was openly available on a public website for six months), and of leaving users’ login credentials for the mobile D-Link app unsecured in clear, readable text directly on the mobile device.

Needless to say, the FTC thinks D-Link should have done a little more to keep its products, and by proxy the internet at large, more secure:

?Hackers are increasingly targeting consumer routers and IP cameras — and the consequences for consumers can include device compromise and exposure of their sensitive personal information,? said Jessica Rich, director of the FTC?s Bureau of Consumer Protection. ?When manufacturers tell consumers that their equipment is secure, it?s critical that they take the necessary steps to make sure that?s true.?

Unsurprisingly, D-Link didn’t think much of the FTC lawsuit, quickly posting a new FAQ and a press release implying that because the FTC didn’t cite specific products and document clear instances of harm, there’s no problem. The statement laments the FTC’s “unwarranted allegations” and “contested 2-1 decision” to hold D-Link to account:

“The FTC complaint alleges certain security hacking concerns for consumer routers and IP cameras, and we firmly believe that charges alleged in the complaint against D-Link Systems are unwarranted,” said William Brown, chief information security officer, D-Link Systems, Inc. “We will vigorously defend the security and integrity of our routers and IP cameras and are fully prepared to contest the complaint. Furthermore, we are continually working to address the overall security features of D-Link Systems’ products for their intended applications and to regularly inform consumers of the appropriate steps to take to secure devices.”

Granted you only need to spend a few moments with IoT-specific search engines to realize how common poorly-secured webcams (from D-Link and everybody else) are. And D-Link’s router hardware has been well-represented in the recent rise of DDoS attacks on companies like Dyn. So the end result of this neglect should be pretty clear, and given the agency’s recent warnings (pdf), the FTC’s crackdown (which may or may not persist under a new administration) shouldn’t be a surprise. Companies had every opportunity to prioritize privacy and security in their products, but instead chose to pay lip service to the concept.

Filed Under: , , ,
Companies: d-link

Rate this comment as insightful
Rate this comment as funny
You have rated this comment as insightful
You have rated this comment as funny
Flag this comment as abusive/trolling/spam
You have flagged this comment
The first word has already been claimed
The last word has already been claimed
Insightful Lightbulb icon Funny Laughing icon Abusive/trolling/spam Flag icon Insightful badge Lightbulb icon Funny badge Laughing icon Comments icon

Comments on “FTC Sues D-Link For Pretending To Give A Damn About Hardware Security”

Subscribe: RSS Leave a comment
Anonymous Anonymous Coward (profile) says:


Tomato works for me. I off loaded the encrypt/decrypt of my VPN (Private Internet Access) encryption to my router, which is a Tomato firmware router. I disabled WiFi on my Internet providers router and enabled it on the Tomato, and place the Tomato router BEFORE the ISP router. All connections go through the Tomato router, including WiFi. So to connect to my VPN, all I have to do is connect everything else via the Tomato router.

I did spend a bit more for the router I currently have, so that it had the power to do the encrypt/decrypt without slowing the connection down.

And yes, I have two routers. One, provided by my Internet provider, which connects to the Internet, and a second one which I bought (Tomato) through which everything passes. There is probably a way to get the Tomato router to perform the function on the ISP router, but that is beyond my ken, and/or interest.

This works.

orbitalinsertion (profile) says:

Re: Re: Alternatives

isp routers are frequently gateways with multiple functions including that of a “modem” hardware component to connect to their network if Ethernet isn’t the incoming cable. some “routers”* can do it too.

most of these are far more than routers, although that became the generic term for boxes with a varying set of functions all bundled together with the router aspect.

Maybe one needs two, maybe one doesn’t. It depends.

Anonymous Coward says:

not just D-Link

Most manufacturers of SOHO network and IoT stuff play the same game. A few years ago they simply tried to ignore reports by security researches. Only after some media coverage they became active and provided firmware updates with security fixes. Meanwhile some learned how to deal with responsible disclosures by security researchers. Another problem is that they keep using obsolete software packages with known problems for years, instead of updating to the latest version of whatever daemon. Remember the UPnP problem across several brands? And if something is older than 2 years you won’t get a firmware update anyway, because the manufacturer wants you to buy a new inexpensive gadget. Don’t forget the consumer! If you pay $30 for a router you won’t get something as good or secure as a $500 professional SOHO router.

Anonymous Coward says:

Re: not just D-Link

By that logic a $10k router from Cisco is more secure and better supported than the cheaper equivalent from Juniper. That’s just not true. Granted a $30 TP-Link may have fewer features than the $100 Linksys, but even that is a stretch these days and there is no guarantee that Linksys is going to support that $100 device any longer or better than TP-Link supports their $30 device.

What’s the answer? In our current political and social climate in the US, I don’t believe there is one other than ISPs blocking connections they determine are causing problems for their network. The problem is because politicians and government bureaucrats aren’t qualified to write sane, to the point, and appropriate rules for any profession or market let alone something as nuanced and difficult to deal with as electronic & computer security where even the merely competent are uncommon and experts capable of writing best practices and specifications are far more rare than diamonds.

Anonymous Coward says:

Re: Re: not just D-Link

That’s not what I’ve meant. You can’t expect a high quality firmware or long time support for a $30 router. OpenWRT might be an option, but not for average Joe. On the other hand you can buy a router from AVM or Lancom and get free updates for about 5 to 10 years (security fixes and new features).

Anonymous Coward says:

The FTC lawsuits all hinge on marketing claims. Basically, the FTC says labeling one’s devices as “secure” when they are trivial to exploit is false advertising.

Industry solution: never claim anything is secure any longer. FTC is hamstrung and outside of the FCC who can potentially ding companies (and users) for using products that cause RFI, business continues as usual and IoT producers write any court awards and legal fees off as “cost of doing business”.

If you think this lawsuit is going to change one damned thing other than how devices are marketed (they’ll just drop putting “secure” on the box) by major corporations you are seriously deluding yourself.

Any such regulations would be written by politicians and bureaucrats both of which are 1) not qualified to write such rules, and 2) subject to lobby pressure to make them as ineffective as they can buy. Arguably from past experience, these rules would become more onerous as time went on eventually strangling the market for all but the biggest incumbents and scaring off possible market entrants. This is exactly what’s happening with the medical profession, nuclear related industries, and other such ridiculously badly regulated industries. We don’t need MORE regulation, we need SMART regulations NOT written by people who’s only job experience is duping Average Joe to vote for him or her.

DannyB (profile) says:

Re: Re:

It is more than marketing. What you’re saying is that a toaster manufacturer will drop the marketing label: “won’t burn your house down!”, but will continue to make toasters that burn your house down.

The “won’t burn your house down!” is not a feature. Not any more than “Secure”. It is something that should be a base expectation for the product to even be saleable or fit for purpose.

DannyB (profile) says:

Make companies fincially liable for damages

If I buy a toaster, I expect that it will not burn my house down.

If I buy a router or webcam, I expect that it will not get hacked and participate in a botnet that causes damage to others.

The company making products with these defects should be financially liable for the damages their products cause. Yes, really. If you’ve ever looked at the hoops you have to jump through for PCI compliance for a web site to accept credit cards, you know that there is much more that can be done for security. No default credentials. No special manufacturer back doors. Everything locked down. No unnecessary open ports. Signed firmware. Require pressing a physical button on the device in order to perform any admin activity. (OMG! do you know how much an extra button would cost!)

If companies had liability for security problems, they would suddenly have an incentive to invest in security. Even work together. Maybe industry standard best practices. Maybe even a common secure base distribution that everyone builds upon. Imagine incentivizing the shareholders of companies to require working together on security rather than ignoring it as a corner that can be cut.

Joel says:

That private key on the public server

I’m pretty sure I read elsewhere that the private key they left on a public server for 6 months is the one used to sign their firmware. It’s not just a password to log into a software. It’s the key that is used to cryptographically sign firmware files such that devices can be sure that the firmware was authorised by D-Link. Usually the router will not install anything without that signature, preventing malicious third parties from updating the device with their firmware. Having such a private key for signing go public is very serious, because it allows others to impersonate you cryptographically speaking

Add Your Comment

Your email address will not be published. Required fields are marked *

Have a Techdirt Account? Sign in now. Want one? Register here

Comment Options:

Make this the or (get credits or sign in to see balance) what's this?

What's this?

Techdirt community members with Techdirt Credits can spotlight a comment as either the "First Word" or "Last Word" on a particular comment thread. Credits can be purchased at the Techdirt Insider Shop »

Follow Techdirt

Techdirt Daily Newsletter

Techdirt Deals
Techdirt Insider Discord
The latest chatter on the Techdirt Insider Discord channel...