FTC sues D-Link over router and camera security flaws

https://www.consumer.ftc.gov/blog/ftc-sues-d-link-over-router-and-camera-security-flaws

by kposehn • 10 years ago

383 193 10 years ago

consumer.ftc.gov

pjmlp2• 10 years ago

This should happen more often.

The software industry must come to the same level of responsibility and quality expectations of other industries.

rixrax• 10 years ago

This. But when we go here, and I believe we will, I am concerned of what happens to our ability to put alternastive firmware / OS / SW on a systems we've purchased. We already see this in regulated industries such as automotive. Part of the motivation not to let us replace software in an automotive infotainment system surely is a concern over a liability this might cause. It would be a sad day indeed when we would regulate out our ability to update vendor provided crapware with OpenWRT, Lineage OS, or what not.

ht85• 10 years ago

In my opinion, progress in that domain should come in the form of mandatory warnings to end-users when selling technologies that do not meet acceptable standards.

A big warning on the package would be enough to turn away average users - thus forcing companies to comply - but wouldn't interfere with hacking activities.

paulddraper4• 10 years ago

"Voids the warranty" comes to mind.

lisivka2• 10 years ago

IMHO, we can make parallels with RF spectrum. Global network and RF spectrum are globally shared resources, so some rules for RF spectrum should apply to global network too. If your system is beyond some minimal power level, e.g. less than 1000 hosts, you are free to do what you want without license, unless you are harming someone. For more than 1K network hosts exposed to global network, minimum safety requirements must be met.

runeks• 10 years ago

This is a reasonable stance, but remember who will bear the cost: the consumers. Demanding security for all these cheap plastic boxes will hopefully make it harder for DDoS attackers to gain cheap weaponry, but it won't come for free. I think it's too vague to just demand that the devices be "secure", as there is an infinite spectrum of security that these devices could live up to.

Also, let's say, theoretically, that I discover a software bug on the ftc.gov website that allows me to get the ftc.gov servers to execute a DoS attack against some target. Should I be able to sue ftc.gov for not securing their site well enough, or does this policy only apply to physical devices?

freehunter3• 10 years ago

As a consultant working in the security industry, I get asked this question a lot. "How do we minimize liability when we know that security is never perfect?" The answer is best practices. I have never seen a company held liable for any breaches that occurred while they were following best practices. As long as you can show that you decided on a set of best practices before making/implementing your product, show that your product follows these best practices (or documenting why it doesn't), and show that you have a process to evaluate these best practices periodically against the latest industry standard, you're basically off the hook.

If FTC.gov was vulnerable to Heartbleed in March of 2014 and you suffered damages related to someone exploiting that, in practice FTC.gov holds no responsibility for that. They were following best practices, and no one knew there was a vulnerability. If they're vulnerable today and you suffer damages due to that being exploited, then you could make a case against them. They should have known better by now.

As for consumers bearing the cost, that's working as intended. Good security costs a little money. How many people do you hear complaining that consumers are bearing the cost of seatbelts and airbags installed in cars? We're willing to pay the few extra dollars because we all know how dangerous it is to not have those things. We could make cars a lot cheaper if they didn't have crumple zones, air bags, seat belts, roll cages, or steel frames. But that's not the world we want to live in.

maxt• 10 years ago

I agree. There's no accountability for such neglect. There should be a fine, or even better, a tax on bad security.

jimbokun• 10 years ago

True, but who will write the guidelines, what will they say, and how will they be implemented and enforced?

lisivka2• 10 years ago

It's engineer duty.

http://www.ieee.org/about/corporate/governance/p7-8.html

http://www.acm.org/about-acm/acm-code-of-ethics-and-professi...

http://www.acm.org/about/se-code

https://www.isaca.org/Certification/Code-of-Professional-Eth...

http://www.bcs.org/category/6030

http://www.depts.ttu.edu/murdoughcenter/products/resources/r...

luma2• 10 years ago

How long is the company that provides the product on the hook for for post-sale support and security updates? If I sell an internet-connected device which has a flaw discovered 5 years after the sale, am I still liable for patching that? Nowhere in this article nor in the complaint do I find any guidelines as to what they consider to be reasonable after-sale support. They list similar action taken against Asus and TRENDnet, which are all large international companies. I'm a dude in my workshop and placing an after-sale support and warranty requirement on anything I make for a period of n-years is onerous.

walrus01• 10 years ago

At this time it appears the FTC is only going after the most egregiously shoddy practices, stuff that is basically new current generation stuff (consumer grade 802.11ac routers, etc) that goes unpatched after the vendor is notified. I would be really surprised if they started going after 3+ year old equipment after the fact, or small manufacturers.

edit: D-Link has been famously shitty for a long time. At least among everyone I know who runs a 'serious' network, D-Link is seen as the exact polar opposite of a proper carrier grade switch or router... D-Link is to home routers as the Trabant is to automobiles.

patcheudor2• 10 years ago

edit: D-Link has been famously shitty for a long time.

Some would say they took it to an entirely new level. Check out this disclosure from October of 2011:

https://www.kb.cert.org/vuls/id/924307

Summary: after receiving a burst of traffic it disabled WPA/2 and failed wide open. Apparently it was possible to trigger this fault with auth attempts so an attacker didn't even need to wait for someone on the WiFi to send a lot of data before it failed open. I don't even know how something fails like this. Brain hurts.

kosma• 10 years ago

D-Link is to home routers as the Trabant is to automobiles

Trabant was actually a very ingenious design that solved a real problem. D-Link is an analogy of a large car company producing, over decades, model after model of Trabant - each laden with the same old problems - while the rest of the industry moved forward.

freehunter3• 10 years ago

I agree that there should be some kind of guideline on how long product support should be expected. As long as those guidelines are reasonable (90 days? 2 years? 5 years?) I don't think it should be considered onerous for anyone who is selling security-conscious products like networking equipment.

tantalor• 10 years ago

the company failed to protect its routers and cameras from widely known and reasonably foreseeable risks

That's foreseeable, as in, before the sale.

repiret2• 10 years ago

If I'm a dude in my workshop making children's toys, I'm on the hook for strict product liability the rest of my life in I made dangerous toys.

If I'm a one man contractor building a house, certain categories of mistakes I'm on the hook for for the rest of my life.

I don't think it would be unprecedented for IoT device makers to be on the hook forever for certain categories of security flaws. It is not like security flaws grow spontaneously like rust a car. They are all in there from the beginning, whether they are known or not. Most of the IOT security flaws that I have heard about could have been easily prevented with security conscious design and development practices. If we want to have secure IOT devices, then we need to hold people accountable for making insecure ones.

paulddraper4• 10 years ago

Another example would be automobiles. Manufacturers do recalls and provide replaces more many, many years.

Ford isn't on the hook for the Model T, but it does do recalls for decades-old Saturns.

lostlogin3• 10 years ago

One slight difference is that people actively try to do bad on a large scale with software while toys, cars and houses can be used nefariously but short of ramming your truck into a Christmas market, the scope for large scale damage is usually more limited.

mr337• 10 years ago

The contractor building a house has specific warranties that vary state by states (in the US).

http://real-estate-law.freeadvice.com/real-estate-law/constr...

danielweber• 10 years ago

They are all in there from the beginning, whether they are known or not

Some things only exist because of the environment.

If I went back in time to 2001 and tried to get people to take CSRF attacks seriously, they would lose me when I started talking about opening multiple tabs.

For me personally, this kind of product liability is like giving me a big bag of money, because of my profession. But this is a huge can of worms opening up and we don't even know it's going to lead to better security.

TheSpiceIsLife• 10 years ago

If I'm a dude in my workshop making children's toys, I'm on the hook for strict product liability the rest of my life in I made dangerous toys.

I'm not sure this is strictly true. Stanards change over time and old toys might not meet the new standards. Sometimes product recalls occur, other times the change is so broad and insignificant an advisory may be issued or no advisory is necessary.

Point being it isn't always so clear-cut.

With software and hardware it is possible for new vulnerabilities to be discovered as new attack methods are developed.

Also, forever could be too strong. No one is going to complain about vulnerabilities in token-ring network protocols.

luma2• 10 years ago

The trouble with your analogy is that state-sponsored teams of children aren't working day and night to find new ways to make your toy dangerous that you could never have thought of at the time.

I get that D-Link sucks, and their security practices right out of the box were "bad", but what is "bad"? In the eyes of the FTC and US law, what constitutes "good" and "bad" practice? How do I ensure that I am holding myself to those practices when a product ships? What is my responsibility for vulnerabilities found after the product shipped?

Let's say for example I ship a widget with an IP address and something like Heartbleed shows up 4 years later and my device is vulnerable. Am I on the hook for patching all the systems in the field? What are my obligations here?

hueving3• 10 years ago

This analogy is stupid. There is a difference between these things breaking under normal use and being activly attacked.

You're not on the hook as a contractor for a house if it's vulnerable to missile attacks.

yoaviram• 10 years ago

The alternative to strict product liability is to make sure the IOT decide you provide has a clearly defined and enforced end of life.

problems8• 10 years ago

This is a ridiculous comparison - there are standards for these things, toys and buildings, provided by governments and insurance companies that you can simply meet and then disclaim almost all liability in the future. Nothing like this exists for security.

No one wants to insure your product is secure, even if they've fully audited it themselves - it's too easy to miss something and make a mistake, especially so in the C-centric world. Software security is a minefield much more so than standard building codes, child safety laws or meeting the best of standards insurance companies may request of those things.

The only alternative here is that we go all-in. Everyone who develops software is individually responsible for it, we all pay insurance for our ability to develop software. Because just about any piece of software can be a huge security liability.

Sounds like a scary world to me, one in which I would have never gotten involved in software development.

ghurtado• 10 years ago

If I'm a one man contractor building a house, certain categories of mistakes I'm on the hook for for the rest of my life.

Should contractors that built houses in the 60s be held liable for using things like asbestos and lead paint?

Should car manufactures from the 70s be held liable for using non-tempered glass and other unsafe features? What about CO2 emission standards?

The topic of product safety cannot be divorced from the historic timeframe in which it is considered.

nommm-nommm3• 10 years ago

It is not like security flaws grow spontaneously like rust a car.

They absolutely can. Its well know that cryptography algorithms "decay" over time as computer power increases. There was a time where encrypting with DES was secure, DES is no longer secure due to increase in computing power. In 50 years I doubt we'll be using many of today's algorithms. Its exactly like a car slowly rusting over time.

That's even assuming support is possible. I may have a stroke so I no longer have the ability to support my product.

sbov• 10 years ago

As a consumer, I would like for my devices to not be security nightmares for, at least, the useful life of what I'm buying. Unless you plaster a giant warning on the product, ~5 years from the time of sale seems reasonable to me for many tech related things.

bisby• 10 years ago

standard product lifetime seems reasonable. If IE6 has a security bug, the answer is "maybe use newer windows + edge". If xbox360 has a security bug, the answer might be "use xbox one".

This could expand to a question of "what is the expected lifetime of a product"... is it when the replacement is released (dont like the security bugs? get camera 2.0!)?, is it when the new camera becomes standard (there are 1000000 camera 2.0s out there, and 100 camera 1.0... maybe you should get on board)? Or is it when the failure rate of the product is above a threshold (Your camera 1.0 is even still working? most of them had their CPUs burn out by now, dont expect an update, in fact you should be grateful/amazed its still running)

Aging hardware is one thing ("modern security practices use a new cryptography algorithm that literally wont run on this device") but aging software is another ("we just dont want to update the software, buy our new product")

sigmar2• 10 years ago

“hard-coded” login credentials integrated into D-Link camera software -- such as the username “guest” and the password “guest” -- that could allow unauthorized access to the cameras’ live feed;

This doesn't seem to be a complaint about future support, but security at the time it was sold.

throwaway72914• 10 years ago

I think the rub is that all security bugs are bugs at the time of sale/update. Discovered or otherwise.

But I agree with you here because at the time of sale, this feature was widely agreed upon to be a bad practice and was also a known feature. So it's not like someone discovered a clever 0-day DLink didn't know about. DLink knew what it was doing, knew that best practices said not to do the thing it was doing, and did that thing anyways.

Floegipoky• 10 years ago

I don't think the FTC is asserting that companies can't discontinue support for old products.

notheguyouthink• 10 years ago

This is all the more reason that we need standardized software/OSs for these IoThings. Not only do the companies not want to be on the line forever, but if they allow users to modify it in sane ways the users can do the work. Eg, if it's just small linux installations with a very basic http api in open source libs, it can probably be patched with relative ease.

Instead, everyone is doing weird crap, everything is complex. I hate it as a user.

skybrian• 10 years ago

It seems like companies should be on the hook for recalls, but they should be able to outsource this, by buying some kind of insurance to cover the recall. Then it becomes the insurance company's job to assess the risk and price accordingly.

andrei_says_• 10 years ago

In which case the cost of recalls would include the profit of insurance companies.

diggernet• 10 years ago

I think this is what I'd like to see...

The manufacturer of the device is responsible for security updates forever. If at any time a security flaw is discovered in the device, they have two options:

1. Develop and deploy a fix at their own expense, and make it freely available to all owners of the device.

2. Publicly release all source code and documentation necessary for any third party to independently develop and deploy a fix.

This way, any company which still cares about their customers, devices, patents, copyrights, etc which are involved will pay the expense of fixing the problem, as the cost of keeping that which they value. And any company which does NOT care about those things can simply walk away from it all at no cost to themselves.

So, as a dude in your workshop, after n-years have passed and you feel the responsibility is too onerous, you opt for #2 and wash your hands of the mess.

As an interesting side-effect, this opens up a business opportunity for source and documentation escrow services. Because if you've somehow managed to lose some or all of your source and documentation, you've also lost the ability to choose door #2.

sowbug• 10 years ago

It would be interesting if companies had the legal obligation to fully open-source any software associated with hardware that they'd EOLed or abandoned. Not only could interested parties take up the cause of continuing support, but because the OEM would know that its hack-ridden source code would eventually be published, it might have an incentive to write better software to begin with.

This might not be practical because the OEM couldn't include source to third-party components that aren't EOLed. But it would be a start.

swiley• 10 years ago

The user should be responsible for updating the firmware.

rrggrr• 10 years ago

This is great AND its a poor substitute for tort reform that permits private companies and individuals to collect damages for hardware/software that is negligently or fraudulently insecure. Products liability lawyers are very effective at changing industry behaviors towards safety to the lawyer's financial benefit but, ultimately, for end-user's security and safety. IANL.

valleyer• 10 years ago

Interesting, most users of the phrase "tort reform" seem to want the opposite of what you want. You might want to avoid using that phrase in your argument (which I agree with!).

msbarnett3• 10 years ago

I agree but you seem confused about the phrase/concept of "tort reform", which in the abstract could mean many things BUT as usually touted by politicians, generally involves making it harder for companies and individuals to sue other companies/individuals for damages.

wyldfire• 10 years ago

Maybe they're from the future and it's long since been changed to prevent individuals from bringing suit against corporation. So in that future "tort reform" means repealing the previous reform.

Honest timetraveler mistake.

piker• 10 years ago

It's interesting to see the FTC bringing this based on injuries to the consumers themselves. We've previously discussed a regulatory body such as the FCC regulating the externalities of networking bugs. Here, the damages are internal to the consumer. It makes sense the FTC acts here, where individual damages could be very difficult to prove, if even discover. But query whether the potential for a class action suit (and lack thereof) have already suggested the proper result here. While this claim seems well-placed, hopefully, both the FTC and the court weighing the claim will establish a reasonable "foreseeableness" limit to the liability such that potential claims as this don't quell innovation in the space.

wuttwuwut• 10 years ago

Case wouldn't get that far. It'll settle before there's any assessment of liability. Probably end with a consent order and a suspended judgment. So basically, they have to submit to compliance audits once a year, and there's an order in place that triggers liability if they violate the same law again. That accomplishes your foreseeable principle.

justinsaccount3• 10 years ago

Now if only ISPs could start notifying/disconnecting compromised users until they fix their shit.

willholloway3• 10 years ago

I think that this is the layer where this problem should be dealt with at.

What we are in for right now is burdensome, expensive and vague regulation that amounts to security theater.

wmf• 10 years ago

So the customer throws away every networked device in their home (because they have no idea which one got them banned) and buys new ones from different vendors... which are also insecure and result in their ISP banning them again? And ISP bills go up to cover the massive security scanning infrastructure needed?

justinsaccount3• 10 years ago

So the customer throws away every networked device in their home (because they have no idea which one got them banned)

If a breaker in your kitchen trips do you throw out every single appliance? If your water bill is high do you replace every single sink and toilet?

and buys new ones from different vendors... which are also insecure

Maybe after getting burned by purchasing insecure unsupported devices they find out what vendors support their products and don't ship devices with unfixable backdoors before buying new ones?

And ISP bills go up to cover the massive security scanning infrastructure needed?

A bunch of $30 cameras can scan and infect the entire internet, what makes you think the infrastructure needed to find these devices is massive?

ISPs already have everything they need to find out which of their customers are compromised, they just don't give a shit.

rasz_pl2• 10 years ago

and where is the downside?

hackuser3• 10 years ago

I'm thinking of an elderly couple I know; they have no hope of fixing these problems and it's not reasonable to expect otherwise. They shouldn't have to fix them; the people who make the products should do it.

justinsaccount3• 10 years ago

And the people who have these devices are not going to even care about fixing their devices until their ISP disconnects them for spewing crap onto the internet.

I've been saying for 10+ years that there needs to be something like the DMCA for accountability for security issues.

A copyright owner can send a takedown notice to an ISP alleging infringement and have action taken, but I can't do anything about the 1,000,000 hosts that scan the shit out of us every day.

nodja2• 10 years ago

My boss installed 2 camera DVRs a year or so ago. All I did was provide 2 external IPs for the DVR and didn't worry much about it. The password was the default "123456" that comes with these things, but since we don't care much about who sees the footage. At worse people will change the password and we need to factory reset (never happened).

Last week the internet for the whole office was going down. Weirdly I could remote in, but the DNS was not working. I first thought our DNS server crapped out but it was working fine. After some investigation, the firewall was not responding. After rebooting the firewall, it would work fine for a while, but go down shortly after.

Long story short: the DVRs my boss got (unbranded) come with telnet access on some nonstandard port. A botnet got access to it and was making thousands of dns and telnet queries, overloading the firewall.

cptskippy4• 10 years ago

You mapped all ports from the external IPs to the DVR?

300bps• 10 years ago

I read it as he gave the DVRs external IP adresses without NATing them to internal addresses.

nodja2• 10 years ago

The firewall has a 1 to 1 NAT feature. It maps an external ip to an internal one. I had no firewall policies set. Rookie mistake, I've blocked all outgoing access and only allow port 80 and the video port incoming.

throwaway72914• 10 years ago

1. Just because you don't mind if people have RO access doesn't mean you should use default passwords. Privilege escalation is a thing, and is often far easier than getting a foot-hold. The number of developers who "don't bother with" disciplined input validation in areas that are supposed to be accessible only be trusted users is staggering.

2. Don't expose entire hosts to the internet. Punch only necessary holes in the firewall. That way the device at least needs to phone home in order to cause a problem like this.

3. Do you have a similar policy with other hosts are your network? I.e., do you figure "well that's inside the firewall so we don't need to worry about encryption/timely application of security updates/resetting default passwords/etc."? If you're not 100% sure (or if the answer is "no"), you now have a lot of cleanup work to do.

jdavis7032• 10 years ago

Not the OP but I just was in a similar conversation: "Oh it's behind a firewall, so let's just disable the extra security (passwords, HTTPS, etc)." The idea of defense in depth is very important, but many people seem to think one security layer is enough sadly.

forrestthewoods• 10 years ago

At worse people will change the password and we need to factory reset

Turns out this was a false assumption. We're all learning this the hard way.

All internet enabled devices need to ship with a unique, resettable default password. Many ISP provides modems/routers do this now and it's great.

hackuser3• 10 years ago

We're all learning this the hard way.

I'd be very disappointed if most HN readers are still learning this.

rconti2• 10 years ago

They could also use the device to pivot into your network. Once you've compromised the DVR, they can go wherever they want.

rasz_pl2• 10 years ago

Great example.

In perfect world ISP should drop you in addition to charging $penalty$ for breaking its ToS. This would result in someone from IT being fired (maybe you) and company starting to actually care about security from now on.

steinystein• 10 years ago

But that's mean...

baq2• 10 years ago

this sounds like a horror story from r/sysadmin.

minxomat3• 10 years ago

In addition to openftp4[1] (where some folks already discovered their own server[2]), I recently published c4[3], one of the more exhaustive list of public facing IP cams that use the default password. Many of them can even be controlled remotely. The majority of them is vulnerable against simple Perl exploits.

[1] http://git.io/ftp

[2] https://www.reddit.com/r/sysadmin/comments/53cor1/someone_ju...

[3] https://github.com/turbo/c4

kuschku4• 10 years ago

Thanks for destroying the web, btw!

Open FTP servers are an asset, not a risk, as they're ideal for distributing downloads, uodates, packages, etc.

Thanks to your efforts, many groups which used to provide all downloads via HTTP and FTP have since stoppes the FTP access, and don't provide wget-able HTTP URLs either.

Congratulations, now I have to run a full browser on my servers to be able to download many packages.

achillean• 10 years ago

Last year I looked into how exposed D-Link devices on the Internet and created this overview page:

https://dlink-report.shodan.io/

There are basically ~500,000 D-Link devices directly connected to the Internet and exposing a service that a person on the outside can connect to. Most of the devices I saw back then, and still do now, are their standalone webcams.

Illniyar2• 10 years ago

Anyone know what are the reasonable steps that d-link failed to take?

I see no mention of it in the article.

throwaway72914• 10 years ago

Here are the things the FTC faults D-Link for (https://www.ftc.gov/news-events/press-releases/2017/01/ftc-c...):

1. “hard-coded” login credentials integrated into D-Link camera software -- such as the username “guest” and the password “guest” -- that could allow unauthorized access to the cameras’ live feed;

2. a software flaw known as “command injection” that could enable remote attackers to take control of consumers’ routers by sending them unauthorized commands over the Internet;

3. the mishandling of a private key code used to sign into D-Link software, such that it was openly available on a public website for six months; and

4. leaving users’ login credentials for D-Link’s mobile app unsecured in clear, readable text on their mobile devices, even though there is free software available to secure the information.

There are pretty common-sense mitigation techniques for all of these.

For 1,

* Don't ship with default credentials (change credentials per-device and slap a sticker on the device with user/pass)

* Force credentials to be changed on first login.

* To avoid attacks targeting specific devices via crafted search engine queries, add a robots.txt and/or use HTTP authentication.

For 2, sanitize user input

For 3, don't publish private keys on your public-facing website

For 4, encrypt stored credentials (or don't store credentials at all)

None of these are particularly difficult to implement. In fact, they're all pre-Freshman-level, obviously boneheaded security mistakes. That we've known about and how to prevent since at least the 90's...

nitrogen• 10 years ago

#4 is very widespread and used to be standard practice, under the excuse that you should use chmod to control access, and that access to the encrypted file probably comes with access to the key since they both have to be present on the same device.

One old example: fetchmail

One new example: kodi/xbmc

problems8• 10 years ago

Correct me if I'm wrong, but isn't #4 just encouraging security through obscurity? If I hacked someone's phone, I can read those credentials, whether that amounts to reading them off the device, sniffing the connection, injecting code into an app, etc. Not encrypting the credentials on the device is not a security offense as it's not a valid security mechanism. Go ask Mozilla, Google and Microsoft about how well their encrypted credential stores work against freely available NirSoft tools or actual malware like iStealer.

Illniyar2• 10 years ago

Thanks! :)

willholloway3• 10 years ago

You are right that these aren't difficult to implement, the problem is that we now have unelected government dictating coding standards by fiat, and ex post facto fiat at that.

This precedent creates unlimited liability for so much software and hardware that gets created.

It is the abiilty to warranty against this type of stuff that has let OSS take off. I expect this to have a chilling effect.

In my opinion we should be against this the way we were against software patents and CISPA.

Just because as devs we are mad when our bosses make stupid security decisions, doesn't mean this is the way to handle it.

I believe this is a very different situation than product liability we are used to. In these cases damage is the result of malicious attack by criminal actors.

mankash6664• 10 years ago

This is an unfair lawsuit targeting a foreign corporation. If the FTC were consistent, they'd go after a majority of American tech companies (Cisco, juniper, MSFT..) with publicly known back doors into their technology.

stephengillie• 10 years ago

Many of these backdoors were instigated by American information agencies. Would an American law enforcement agency be able to sue an American company for putting in backdoors at the insistence of an American governmental agency? It almost seems like a double-threat, where you are at risk for attack from law enforcement if you comply, but at risk for attack from the governmental agency if you do not.

djsumdog2• 10 years ago

Cisco seems pretty good about patching. There have been some controversial cases, but typically when I see Cisco exploits at a conference, it will start with, "If you haven't patched your routers to xx.xx.xx, do it now."

Do you have specific examples of holes that have existed for a long time without official patches or mitigation?

mankash6664• 10 years ago

Flip this around. If Chinese regulators sued Cisco, Juniper, etc. for known vulnerabilities while deliberately omitting local companies, everyone would scream protectionism.

Router companies need to be security conscious, but for the FTC to single out ONE foreign company doesn't smell right.

tommorris3• 10 years ago

a foreign corporation
California-based D-Link Systems, Inc.

If you don't want to be bound by the laws of the United States and the State of California, maybe don't incorporate there.

mankash6664• 10 years ago

Wiki disagrees, so does D-Link's own website.

https://en.wikipedia.org/wiki/D-Link

israrkhan• 10 years ago

After Mirai botnet disaster, government decided to step-in to IoT security landscape. I am not sure how far they can go to force consumer electronic manufacturers to add security to their products. Some CE manufacturers do not control the bulk of the software in their products. They just take kernel/libraries/binaries provided by SoC vendor and glue them together. SoC vendors are even more careless about security and they often provide out-dated and unpatched software. Even if SoC vendors or CE manufacturers start patching the vulnerabilities, it is very difficult to implement a secure firmware upgrade mechanism. A glitch in automated firmware upgrades can be very risky.

Perhaps FCC could start addressing these issues as part of certification requirements. However there are many challenges. How will FCC enforce SecureBoot and secure firmware upgrades and longterm product support? What will be the penalties. How will they deal with unbranded (or foreign) brands.

jiqiren• 10 years ago

How about all these smartphones being sold with unsupported broken versions of Android?

problems8• 10 years ago

Mostly not remotely exploitable or not easily, so they can probably get away fine. There's no giant Android botnet eating the internet.

djsumdog2• 10 years ago

That still doesn't excuse it at the least. Forcing manufactures to support security updates on these devices for a reasonable amount of time (no less than 6 years) would greatly slow planned obsolescence and may even force manufactures to actually agree on driver and kernel standards instead of their mess of non-upstreamable garbage patches.

Right now we're lucky to get even 2 years of normal updates (much less security updates) on any Android device.

zitterbewegung• 10 years ago

Although we should emphasize securing consumer devices by default I don't see any other way to motivate companies to secure devices having either the FTC or a class action lawsuit to implement security.

ChuckMcM2• 10 years ago

Does anyone know if the FTC is backdooring a federal warranty carve out here for software with respect to security? Generally devices that come with software have specific disclaimers of all warranties for fitness and damages (either direct or incidental). And California has held such exclusions to be allowed[1]. So if the FTC prevails and D-Link is held to be liable for their software flaws, would that then create a place where consumers could sue software producers when their software broke even though there are specific exclusions in the TOS and EULA?

[1] http://wmblaw.blogspot.com/2013/05/are-contractual-exclusion...

throwaway72914• 10 years ago

The FTC is suing D-Link for "unfair or deceptive acts or practices in or affecting commerce" because they claimed their routers were secure, but then failed to follow even the most rudimentary best practices.

I imagine that if D-Link claims that their software was provided without any "warranties for fitness and damages", the FTC will argue that such a claim definitively proves that D-Link's marketing of their security features was unfair and a misrepresentation.

ChuckMcM2• 10 years ago

I get that, but every software package I have ever bought explicitly disclaimed it would do anything in the EULA and TOS documents. So if they are successful at suing D-Link does it create a carve-out that says "If you tell people your software does x or has feature or attribute y, and it doesn't actually do that or have that, you are liable for misrepresenting your product."

Because it it does create that carve out then there are going to be a BOATLOAD of lawsuits against software companies.

cardiffspaceman• 10 years ago

I think, in support of this point you are making, the key is that the FTC is not in charge of the Internet, and doesn't have to be trying to protect the Internet with this action. Large-scale consumer frauds are more the thing the FTC goes after.

jbritton• 10 years ago

I have a Netgear router. Netgear has end of life'd it and will not provide anymore firmware updates. It has security vulnerabilities. There is DD-WRT firmware available for it. However, Netgear has since modified their firmware to disallow installing DD-WRT.

dubberx• 10 years ago

When that happened to my WRT54GS, I managed to downgrade to an older Netgear firmware that did not do this check. Then, from the older firmware, I could flash DD-WRT, no problem.

I now build routers / firewalls with a free OS to ensure I do not get burned again.

NickBusey• 10 years ago

Any tips on how to find out which cameras are actually secure?

FTC sues D-Link over router and camera security flaws

Related Stories