Taiwan-based computer hardware maker ASUSTeK Computer, Inc. has agreed to settle Federal Trade Commission charges that critical security flaws in its routers put the home networks of hundreds of thousands of consumers at risk. The administrative complaint also charges that the routers' insecure "cloud" services led to the compromise of thousands of consumers' connected storage devices, exposing their sensitive personal information on the internet. The proposed consent order will require ASUS to establish and maintain a comprehensive security program subject to independent audits for the next 20 years.
"The Internet of Things is growing by leaps and bounds, with millions of consumers connecting smart devices to their home networks," said Jessica Rich, Director of the FTC's Bureau of Consumer Protection. "Routers play a key role in securing those home networks, so it's critical that companies like ASUS put reasonable security in place to protect consumers and their personal information."
ASUS marketed its routers as including numerous security features that the company claimed could "protect computers from any unauthorized access, hacking, and virus attacks" and "protect [the] local network against attacks from hackers." Despite these claims, the FTC's complaint alleges that ASUS didn't take reasonable steps to secure the software on its routers.
For instance, according to the complaint, hackers could exploit pervasive security bugs in the router's web-based control panel to change any of the router's security settings without the consumer's knowledge. A malware researcher discovered an exploit campaign in April 2015 that abused these vulnerabilities to reconfigure vulnerable routers and commandeer consumers' web traffic. The complaint also highlights a number of other design flaws that exacerbated these vulnerabilities, including the fact that the company set - and allowed consumers to retain - the same default login credentials on every router: username "admin" and password "admin".
According to the complaint, ASUS's routers also featured services called AiCloud and AiDisk that allowed consumers to plug a USB hard drive into the router to create their own "cloud" storage accessible from any of their devices. While ASUS advertised these services as a "private personal cloud for selective file sharing" and a way to "safely secure and access your treasured data through your router," the FTC's complaint alleges that the services had serious security flaws.
For example, the complaint alleges that hackers could exploit a vulnerability in the AiCloud service to bypass its login screen and gain complete access to a consumer's connected storage device without any credentials, simply by accessing a specific URL from a Web browser. Similarly, the complaint alleges that the AiDisk service did not encrypt the consumer's files in transit, and its default privacy settings provided - without explanation - public access to the consumer's storage device to anyone on the Internet.
In February 2014, hackers used readily available tools to locate vulnerable ASUS routers and exploited these security flaws to gain unauthorized access to over 12,900 consumers' connected storage devices.
The Commission alleges that, in many instances, ASUS did not address security flaws in a timely manner and did not notify consumers about the risks posed by the vulnerable routers. In addition, the complaint alleges that ASUS did not notify consumers about the availability of security updates. For example, according to the complaint, the router's software update tool - which allowed consumers to check for new router software - often told consumers that their router was on the most current software when, in fact, newer software with critical security updates was available.
In addition to establishing a comprehensive security program, the consent order will require ASUS to notify consumers about software updates or other steps they can take to protect themselves from security flaws, including through an option to register for direct security notices (e.g., through email, text message, or push notification). The consent order will also prohibit the company from misleading consumers about the security of the company's products, including whether a product is using up-to-date software.
This matter is part of the FTC's ongoing effort to ensure that companies secure the software and devices that they provide to consumers.
The FTC will publish a description of the consent agreement package in the Federal Register shortly. The agreement will be subject to public comment for 30 days, beginning today and continuing through March 24, 2016, after which the Commission will decide whether to make the proposed consent order final. Interested parties can submit comments electronically.
NOTE: The Commission issues an administrative complaint when it has "reason to believe" that the law has been or is being violated, and it appears to the Commission that a proceeding is in the public interest. When the Commission issues a consent order on a final basis, it carries the force of law with respect to future actions. Each violation of such an order may result in a civil penalty of up to $16,000.
Latest News Posts
- New Switch refresh has 9 hours battery life, same specs
- Gamestop to transform stores into retro arcades
- Interactive website plays 50yr Apollo 11 launch in real-time
- 2mm tiny-bots to regenerate your health from the inside out
- Super Smash Bros. Ultimate DLC 'Hero' to drop this Summer
- NZXT H500i Mid-Tower Chassis Review
- GIGABYTE X570 Aorus Master (AMD X570) Motherboard Review
- closing explorer.exe cause unstable mouse movement
- AMD Radeon RX 5700 XT benchmarked at 3440x1440
- AsRock H370M-ITX and RAID
- Phoenix Labs Details Massive 'Fortune & Glory' Content Update For Dauntless, Trials and New Hunt Pass Season Arrive July 16
- Nightmare Reaper is out now in Steam Early Access
- Final Assault Paves the Way for VR Esports at WCG
- WiMi Hologram (WIMI) files for listing on Nasdaq Global Market
- The Intergalactic Bounty Hunt Begins as Futuristic Co-Op Action RPG Killsquad Launches on Steam Early Access