15 ms·
FTC sues D-Link over router and camera security flaws
- pjmlp 10y agoThis should happen more often. The software industry must come to the same level of responsibility and quality expectations of other industries.
- rixrax 10y agoThis. But when we go here, and I believe we will, I am concerned of what happens to our ability to put alternastive firmware / OS / SW on a systems we've purchased. We already see this in regulated industries such as automotive. Part of the motivation not to let us replace software in an automotive infotainment system surely is a concern over a liability this might cause. It would be a sad day indeed when we would regulate out our ability to update vendor provided crapware with OpenWRT, Lineage OS, or what not.
- ht85 10y agoIn my opinion, progress in that domain should come in the form of mandatory warnings to end-users when selling technologies that do not meet acceptable standards. A big warning on the package would be enough to turn away average users - thus forcing companies to comply - but wouldn't interfere with hacking activities.
- paulddraper 10y ago"Voids the warranty" comes to mind.
- lisivka 10y agoIMHO, we can make parallels with RF spectrum. Global network and RF spectrum are globally shared resources, so some rules for RF spectrum should apply to global network too. If your system is beyond some minimal power level, e.g. less than 1000 hosts, you are free to do what you want without license, unless you are harming someone. For more than 1K network hosts exposed to global network, minimum safety requirements must be met.
- emiliobumachar 10y agoNice analogy. Expanding a bit, if a popular walkie-talkie brand from 20 years ago starts failing today in a way that switches it to aviation frequencies, I believe the manufacturer would be on the hook.
- runeks 10y agoThis is a reasonable stance, but remember who will bear the cost: the consumers. Demanding security for all these cheap plastic boxes will hopefully make it harder for DDoS attackers to gain cheap weaponry, but it won't come for free. I think it's too vague to just demand that the devices be "secure", as there is an infinite spectrum of security that these devices could live up to. Also, let's say, theoretically, that I discover a software bug on the ftc.gov website that allows me to get the ftc.gov servers to execute a DoS attack against some target. Should I be able to sue ftc.gov for not securing their site well enough, or does this policy only apply to physical devices?
- freehunter 10y agoAs a consultant working in the security industry, I get asked this question a lot. "How do we minimize liability when we know that security is never perfect?" The answer is best practices. I have never seen a company held liable for any breaches that occurred while they were following best practices. As long as you can show that you decided on a set of best practices before making/implementing your product, show that your product follows these best practices (or documenting why it doesn't), and show that you have a process to evaluate these best practices periodically against the latest industry standard, you're basically off the hook. If FTC.gov was vulnerable to Heartbleed in March of 2014 and you suffered damages related to someone exploiting that, in practice FTC.gov holds no responsibility for that. They were following best practices, and no one knew there was a vulnerability. If they're vulnerable today and you suffer damages due to that being exploited, then you could make a case against them. They should have known better by now. As for consumers bearing the cost, that's working as intended. Good security costs a little money. How many people do you hear complaining that consumers are bearing the cost of seatbelts and airbags installed in cars? We're willing to pay the few extra dollars because we all know how dangerous it is to not have those things. We could make cars a lot cheaper if they didn't have crumple zones, air bags, seat belts, roll cages, or steel frames. But that's not the world we want to live in.
- pgaddict 10y agoThe current state is not free either - the attacks cost money too, although it's paid by the targets and not the manufacturers. But ultimately it's paid by consumers.
- maxt 10y agoI agree. There's no accountability for such neglect. There should be a fine, or even better, a tax on bad security.
- jimbokun 10y agoTrue, but who will write the guidelines, what will they say, and how will they be implemented and enforced?
- lisivka 10y agoIt's engineer duty. http://www.ieee.org/about/corporate/governance/p7-8.html http://www.ieee.org/about/corporate/governance/p7-8.html http://www.acm.org/about-acm/acm-code-of-ethics-and-professional-conduct http://www.acm.org/about-acm/acm-code-of-ethics-and-professi... http://www.acm.org/about/se-code http://www.acm.org/about/se-code https://www.isaca.org/Certification/Code-of-Professional-Ethics/Pages/default.aspx https://www.isaca.org/Certification/Code-of-Professional-Eth... http://www.bcs.org/category/6030 http://www.bcs.org/category/6030 http://www.depts.ttu.edu/murdoughcenter/products/resources/recommended-core-ethical-values.php http://www.depts.ttu.edu/murdoughcenter/products/resources/r...
- luma 10y agoHow long is the company that provides the product on the hook for for post-sale support and security updates? If I sell an internet-connected device which has a flaw discovered 5 years after the sale, am I still liable for patching that? Nowhere in this article nor in the complaint do I find any guidelines as to what they consider to be reasonable after-sale support. They list similar action taken against Asus and TRENDnet, which are all large international companies. I'm a dude in my workshop and placing an after-sale support and warranty requirement on anything I make for a period of n-years is onerous.
- walrus01 10y agoAt this time it appears the FTC is only going after the most egregiously shoddy practices, stuff that is basically new current generation stuff (consumer grade 802.11ac routers, etc) that goes unpatched after the vendor is notified. I would be really surprised if they started going after 3+ year old equipment after the fact, or small manufacturers. edit: D-Link has been famously shitty for a long time. At least among everyone I know who runs a 'serious' network, D-Link is seen as the exact polar opposite of a proper carrier grade switch or router... D-Link is to home routers as the Trabant is to automobiles.
- patcheudor 10y ago>edit: D-Link has been famously shitty for a long time. Some would say they took it to an entirely new level. Check out this disclosure from October of 2011: https://www.kb.cert.org/vuls/id/924307 https://www.kb.cert.org/vuls/id/924307 Summary: after receiving a burst of traffic it disabled WPA/2 and failed wide open. Apparently it was possible to trigger this fault with auth attempts so an attacker didn't even need to wait for someone on the WiFi to send a lot of data before it failed open. I don't even know how something fails like this. Brain hurts.
- r00fus 10y agoGray's law applies - industrial-grade stupidity/incompetence is indistinguishable from evil. I'm glad D-Link are being slapped down.
- rrggrr 10y agoThis is great AND its a poor substitute for tort reform that permits private companies and individuals to collect damages for hardware/software that is negligently or fraudulently insecure. Products liability lawyers are very effective at changing industry behaviors towards safety to the lawyer's financial benefit but, ultimately, for end-user's security and safety. IANL.
- valleyer 10y agoInteresting, most users of the phrase "tort reform" seem to want the opposite of what you want. You might want to avoid using that phrase in your argument (which I agree with!).
- msbarnett 10y agoI agree but you seem confused about the phrase/concept of "tort reform", which in the abstract could mean many things BUT as usually touted by politicians, generally involves making it harder for companies and individuals to sue other companies/individuals for damages.
- wyldfire 10y agoMaybe they're from the future and it's long since been changed to prevent individuals from bringing suit against corporation. So in that future "tort reform" means repealing the previous reform. Honest timetraveler mistake.
- piker 10y agoIt's interesting to see the FTC bringing this based on injuries to the consumers themselves. We've previously discussed a regulatory body such as the FCC regulating the externalities of networking bugs. Here, the damages are internal to the consumer. It makes sense the FTC acts here, where individual damages could be very difficult to prove, if even discover. But query whether the potential for a class action suit (and lack thereof) have already suggested the proper result here. While this claim seems well-placed, hopefully, both the FTC and the court weighing the claim will establish a reasonable "foreseeableness" limit to the liability such that potential claims as this don't quell innovation in the space.
- wuttwuwut 10y agoCase wouldn't get that far. It'll settle before there's any assessment of liability. Probably end with a consent order and a suspended judgment. So basically, they have to submit to compliance audits once a year, and there's an order in place that triggers liability if they violate the same law again. That accomplishes your foreseeable principle.
- justinsaccount 10y agoNow if only ISPs could start notifying/disconnecting compromised users until they fix their shit.
- willholloway 10y agoI think that this is the layer where this problem should be dealt with at. What we are in for right now is burdensome, expensive and vague regulation that amounts to security theater.
- wmf 10y agoSo the customer throws away every networked device in their home (because they have no idea which one got them banned) and buys new ones from different vendors... which are also insecure and result in their ISP banning them again? And ISP bills go up to cover the massive security scanning infrastructure needed?
- justinsaccount 10y ago> So the customer throws away every networked device in their home (because they have no idea which one got them banned) If a breaker in your kitchen trips do you throw out every single appliance? If your water bill is high do you replace every single sink and toilet? > and buys new ones from different vendors... which are also insecure Maybe after getting burned by purchasing insecure unsupported devices they find out what vendors support their products and don't ship devices with unfixable backdoors before buying new ones? > And ISP bills go up to cover the massive security scanning infrastructure needed? A bunch of $30 cameras can scan and infect the entire internet, what makes you think the infrastructure needed to find these devices is massive? ISPs already have everything they need to find out which of their customers are compromised, they just don't give a shit.
- rasz_pl 10y agoand where is the downside?
- hackuser 10y agoI'm thinking of an elderly couple I know; they have no hope of fixing these problems and it's not reasonable to expect otherwise. They shouldn't have to fix them; the people who make the products should do it.
- nodja 10y agoMy boss installed 2 camera DVRs a year or so ago. All I did was provide 2 external IPs for the DVR and didn't worry much about it. The password was the default "123456" that comes with these things, but since we don't care much about who sees the footage. At worse people will change the password and we need to factory reset (never happened). Last week the internet for the whole office was going down. Weirdly I could remote in, but the DNS was not working. I first thought our DNS server crapped out but it was working fine. After some investigation, the firewall was not responding. After rebooting the firewall, it would work fine for a while, but go down shortly after. Long story short: the DVRs my boss got (unbranded) come with telnet access on some nonstandard port. A botnet got access to it and was making thousands of dns and telnet queries, overloading the firewall.
- cptskippy 10y agoYou mapped all ports from the external IPs to the DVR?
- 300bps 10y agoI read it as he gave the DVRs external IP adresses without NATing them to internal addresses.
- nodja 10y agoThe firewall has a 1 to 1 NAT feature. It maps an external ip to an internal one. I had no firewall policies set. Rookie mistake, I've blocked all outgoing access and only allow port 80 and the video port incoming.
- tlrobinson 10y agoI'd suggest blocking all incoming traffic except a VPN. It's not that hard to set up a VPN. Even better if the high-risk devices like cameras are on a separate VLAN from critical stuff.
- mrpippy 10y agoI wouldn't even allow port 80 incoming from the internet. Even if the web interface appears to have authentication on it, there may be vulnerable CGIs. They left a telnet interface wide open--do you trust them to write a secure website?
- achillean 10y agoLast year I looked into how exposed D-Link devices on the Internet and created this overview page: https://dlink-report.shodan.io/ https://dlink-report.shodan.io/ There are basically ~500,000 D-Link devices directly connected to the Internet and exposing a service that a person on the outside can connect to. Most of the devices I saw back then, and still do now, are their standalone webcams.
- Illniyar 10y agoAnyone know what are the reasonable steps that d-link failed to take? I see no mention of it in the article.
- throwaway729 10y agoHere are the things the FTC faults D-Link for (https://www.ftc.gov/news-events/press-releases/2017/01/ftc-charges-d-link-put-consumers-privacy-risk-due-inadequate https://www.ftc.gov/news-events/press-releases/2017/01/ftc-c...): 1. “hard-coded” login credentials integrated into D-Link camera software -- such as the username “guest” and the password “guest” -- that could allow unauthorized access to the cameras’ live feed; 2. a software flaw known as “command injection” that could enable remote attackers to take control of consumers’ routers by sending them unauthorized commands over the Internet; 3. the mishandling of a private key code used to sign into D-Link software, such that it was openly available on a public website for six months; and 4. leaving users’ login credentials for D-Link’s mobile app unsecured in clear, readable text on their mobile devices, even though there is free software available to secure the information. There are pretty common-sense mitigation techniques for all of these. For 1, * Don't ship with default credentials (change credentials per-device and slap a sticker on the device with user/pass) * Force credentials to be changed on first login. * To avoid attacks targeting specific devices via crafted search engine queries, add a robots.txt and/or use HTTP authentication. For 2, sanitize user input For 3, don't publish private keys on your public-facing website For 4, encrypt stored credentials (or don't store credentials at all) None of these are particularly difficult to implement. In fact, they're all pre-Freshman-level, obviously boneheaded security mistakes. That we've known about and how to prevent since at least the 90's...
- nitrogen 10y ago#4 is very widespread and used to be standard practice, under the excuse that you should use chmod to control access, and that access to the encrypted file probably comes with access to the key since they both have to be present on the same device. One old example: fetchmail One new example: kodi/xbmc
- problems 10y ago
- mankash666 10y agoThis is an unfair lawsuit targeting a foreign corporation. If the FTC were consistent, they'd go after a majority of American tech companies (Cisco, juniper, MSFT..) with publicly known back doors into their technology.
- stephengillie 10y agoMany of these backdoors were instigated by American information agencies. Would an American law enforcement agency be able to sue an American company for putting in backdoors at the insistence of an American governmental agency? It almost seems like a double-threat, where you are at risk for attack from law enforcement if you comply, but at risk for attack from the governmental agency if you do not.
- djsumdog 10y agoCisco seems pretty good about patching. There have been some controversial cases, but typically when I see Cisco exploits at a conference, it will start with, "If you haven't patched your routers to xx.xx.xx, do it now." Do you have specific examples of holes that have existed for a long time without official patches or mitigation?
- mankash666 10y agoFlip this around. If Chinese regulators sued Cisco, Juniper, etc. for known vulnerabilities while deliberately omitting local companies, everyone would scream protectionism. Router companies need to be security conscious, but for the FTC to single out ONE foreign company doesn't smell right.
- tommorris 10y ago> a foreign corporation > California-based D-Link Systems, Inc. If you don't want to be bound by the laws of the United States and the State of California, maybe don't incorporate there.
- mankash666 10y agoWiki disagrees, so does D-Link's own website. https://en.wikipedia.org/wiki/D-Link https://en.wikipedia.org/wiki/D-Link
- israrkhan 10y agoAfter Mirai botnet disaster, government decided to step-in to IoT security landscape. I am not sure how far they can go to force consumer electronic manufacturers to add security to their products. Some CE manufacturers do not control the bulk of the software in their products. They just take kernel/libraries/binaries provided by SoC vendor and glue them together. SoC vendors are even more careless about security and they often provide out-dated and unpatched software. Even if SoC vendors or CE manufacturers start patching the vulnerabilities, it is very difficult to implement a secure firmware upgrade mechanism. A glitch in automated firmware upgrades can be very risky. Perhaps FCC could start addressing these issues as part of certification requirements. However there are many challenges. How will FCC enforce SecureBoot and secure firmware upgrades and longterm product support? What will be the penalties. How will they deal with unbranded (or foreign) brands.
- jiqiren 10y agoHow about all these smartphones being sold with unsupported broken versions of Android?
- problems 10y agoMostly not remotely exploitable or not easily, so they can probably get away fine. There's no giant Android botnet eating the internet.
- djsumdog 10y agoThat still doesn't excuse it at the least. Forcing manufactures to support security updates on these devices for a reasonable amount of time (no less than 6 years) would greatly slow planned obsolescence and may even force manufactures to actually agree on driver and kernel standards instead of their mess of non-upstreamable garbage patches. Right now we're lucky to get even 2 years of normal updates (much less security updates) on any Android device.
- paulddraper 10y agoAre the any big vulnerabilities you're thinking of?
- zitterbewegung 10y agoAlthough we should emphasize securing consumer devices by default I don't see any other way to motivate companies to secure devices having either the FTC or a class action lawsuit to implement security.
- ChuckMcM 10y agoDoes anyone know if the FTC is backdooring a federal warranty carve out here for software with respect to security? Generally devices that come with software have specific disclaimers of all warranties for fitness and damages (either direct or incidental). And California has held such exclusions to be allowed[1]. So if the FTC prevails and D-Link is held to be liable for their software flaws, would that then create a place where consumers could sue software producers when their software broke even though there are specific exclusions in the TOS and EULA? [1] http://wmblaw.blogspot.com/2013/05/are-contractual-exclusions-of.html http://wmblaw.blogspot.com/2013/05/are-contractual-exclusion...
- throwaway729 10y agoThe FTC is suing D-Link for "unfair or deceptive acts or practices in or affecting commerce" because they claimed their routers were secure, but then failed to follow even the most rudimentary best practices. I imagine that if D-Link claims that their software was provided without any "warranties for fitness and damages", the FTC will argue that such a claim definitively proves that D-Link's marketing of their security features was unfair and a misrepresentation.
- ChuckMcM 10y agoI get that, but every software package I have ever bought explicitly disclaimed it would do anything in the EULA and TOS documents. So if they are successful at suing D-Link does it create a carve-out that says "If you tell people your software does x or has feature or attribute y, and it doesn't actually do that or have that, you are liable for misrepresenting your product." Because it it does create that carve out then there are going to be a BOATLOAD of lawsuits against software companies.
- throwaway729 10y ago> So if they are successful at suing D-Link does it create a carve-out that says "If you tell people your software does x or has feature or attribute y, and it doesn't actually do that or have that, you are liable for misrepresenting your product."... Because it it does create that carve out then there are going to be a BOATLOAD of lawsuits against software companies. They also need to prove material harm to consumers. So lawsuits will almost certainly focus on security, privacy, and outright fraud/theft. I really do not understand why this bothers people so much. Hire competent engineers. Follow best practices. It's really not that hard, and it's in your company's best interest anyways. (Also, since its come up in other sub-threads, the name of the FTC is the Federal TRADE Commission, and they regulate commerce. OSS projects that don't engage in commerce aren't subject to these regulations.)
- jbritton 10y agoI have a Netgear router. Netgear has end of life'd it and will not provide anymore firmware updates. It has security vulnerabilities. There is DD-WRT firmware available for it. However, Netgear has since modified their firmware to disallow installing DD-WRT.
- dubberx 10y agoWhen that happened to my WRT54GS, I managed to downgrade to an older Netgear firmware that did not do this check. Then, from the older firmware, I could flash DD-WRT, no problem. I now build routers / firewalls with a free OS to ensure I do not get burned again.
- NickBusey 10y agoAny tips on how to find out which cameras are actually secure?