Networking vendor D-Link, which this week was sued by the U. S. Federal Trade Commission (FTC) over alleged security issues in its routers and IP cameras, blasted the FTC for insinuating potential security issues rather than pointing out specific instances where customer privacy was breached.
The FTC filed a complaint in the Northern District of California on Thursday which charged Taiwan-based D-Link and D-Link Systems, its Fountain Valley, Calif.-based U. S. subsidiary, with failing to take \u00ab\u00a0reasonable steps to secure its routers and Internet Protocol (IP) cameras\u00a0\u00bb and possibly compromising sensitive consumer information \u00ab\u00a0including live video and audio feeds from D-Link IP cameras. \u00a0\u00bb
According to the FTC, D-Link failed to take steps to address \u00ab\u00a0well-known and easily preventable security flaws. \u00a0\u00bb Among the alleged missteps were hard-coding the username \u00ab\u00a0guest\u00a0\u00bb and password \u00ab\u00a0guest\u00a0\u00bb into some products, allowing a software flaw that could let unauthorized users take control of routers, making a private key code for the D-Link software openly available on a public website for six months, and leaving users’ login credentials for the company’s mobile app unsecured.
[Related: FTC Files Complaint Against D-Link Over Router, Camera Security Issues ]
D-Link was unable to provide a company executive to discuss the FTC action, citing executive travel schedules related to CES 2017.
In a prepared statement, D-Link Systems said it rejects the FTC\u2019s allegations and firmly believes it has \u00ab\u00a0more than reasonable\u00a0\u00bb security processes and procedures including procedures to address potential security issues, which the company said exist in all of its internet of things (IoT) devices.
The company also said the FTC did not allege any breach of a D-Link Systems device or actual instances of consumers suffering, but instead focused on the potential of being hacked.
The FTC charges against D-Link Systems are unwarranted, said William Brown, chief information security officer at D-Link Systems, in the statement.
\u00ab\u00a0We will vigorously defend the security and integrity of our routers and IP cameras and are fully prepared to contest the complaint. Furthermore, we are continually working to address the overall security features of D-Link Systems’ products for their intended applications and to regularly inform consumers of the appropriate steps to take to secure devices.,\u00a0\u00bb Brown said.
D-Link late Thursday posted an online FAQ to address specific allegations in the FTC complaint.
In the FAQ, the company said it maintains procedures to address the kind of potential security issues that exist in all IoT devices and said the FTC must allege that actual consumers were harmed or could suffer actual injuries.
D-Link’s response was what would be expected of a company facing allegations of delivering solutions which could impact the privacy of its customers, said Andrew Calore, vice president of BCI Computers, a West Warwick, R. I.-based solution provider who partners with D-Link to a limited extent.
With the average household having 14 connected devices and the increasing reliance on IoT, security flaws are to be expected, Calore told CRN.
\u00ab\u00a0Nothing is perfect,\u00a0\u00bb he said. \u00ab\u00a0For a company like D-Link, it sounds like they made a reasonable response to the FTC action. \u00a0\u00bb
However, Calore praised the FTC for raising the issue. Vendors, in general, are quick to promise certain features and capabilities but often slower to deliver them, he said.
\u00ab\u00a0I agree the FTC should be involved,\u00a0\u00bb he said. \u00ab\u00a0Routers and cameras get put in your home, your private area. They should be safe. Otherwise, someone could do something like use your camera to see if you’re at home and then rob you. \u00a0\u00bb
When talking with the IT director at a business customer, it is easy to talk about VPNs and firewalls to protect the business, Calore said. \u00ab\u00a0But at home, users rely on their ISPs or on store-bought routers for security,\u00a0\u00bb he said. \u00ab\u00a0You can’t load antivirus on your baby monitors and cameras. \u00ab\u00a0<\/p>\n