Wednesday, July 3, 2019

D-Link Systems Settles With FTC

Fountain Valley-based networking products developer D-Link Systems said on Tuesday that it has settles with the U.S. Federal Trade Commission (FTC), over allegations about the company's security practices in its products. According to D-Link, the FTC order "does not find D-Link Systems liable for any alleged violations." The FTC had alleged that D-Link Systems had implemented "inadequate security" in its computer routers and cameras, which "put U.S. consumers' privacy at risk". The original complaint had specifically targeted D-Link's use of default passwords (such as the username "guest" and password of "guest"), a "command injection" flaw in its router software, and use of clear-text login credentials in its mobile app. For its part, the FTC said the suit was settled after D-Link agreed to "implement a comprehensive software security program". The FTC said in its settlement announcement and original claim that D-Link had promoted its hardware claiming it offered "advanced network security," while the company "failed to perform basic secure software development, including testing and remediation to address well-known and preventable security flaws."

---