Unsecure routers, webcams prompt feds to sue D-Link

The Federal Trade Commission on Thursday sued Taiwan-based D-link in federal court. The FTC alleges that D-link routers and webcams left "thousands of consumers at risk" to hacking attacks.

"Defendants have failed to take reasonable steps to protect their routers and IP cameras from widely known and reasonably foreseeable risks of unauthorized access, including by failing to protect against flaws which the Open Web Application Security Project has ranked among the most critical and widespread web application vulnerabilities since at least 2007," the FTC said in a complaint (PDF) filed in San Francisco federal court.

The commission's move comes 11 months after the agency settled with Asus over its insecure routers that allowed attackers to remotely log in to them and, depending on user configurations, change security settings or access files stored on connected devices.

The government lodged similar allegations against D-Link:

Defendants repeatedly have failed to take reasonable software testing and remediation measures to protect their routers and IP cameras against well-known and easily preventable software security flaws, such as “hard-coded” user credentials and other backdoors, and command injection flaws, which would allow remote attackers to gain control of consumers’ devices;
Defendant D-Link has failed to take reasonable steps to maintain the confidentiality of the private key that Defendant D-Link used to sign Defendants’ software, including by failing to adequately restrict, monitor, and oversee handling of the key, resulting in the exposure of the private key on a public website for approximately six months; and

Defendants have failed to use free software, available since at least 2008, to secure users’ mobile app login credentials, and instead have stored those credentials in clear, readable text on a user’s mobile device.

Reports abound about D-Link and other products being compromised with botnets and other attacks. Now the company stands accused of unfair business practices and misrepresenting its security features. The government wants a federal judge to order D-Link to correct those alleged business practices.