Antitrust Law Daily Wrap Up, CONSUMER PROTECTION NEWS: ASUS settles FTC charges concerning insecure home routers, ‘cloud’ services, (Feb 23, 2016)

By Michael Menzhuber, J.D., LL.M.

ASUSTeK Computer, Inc. (ASUS), a Taiwan-based computer hardware maker, has agreed to settle FTC charges that critical security flaws in its routers put the home networks of hundreds of thousands of consumers at risk, the agency announced today (In the Matter of ASUSTeK Computer, Inc., FTC File No. 142 3156).

The FTC’s complaint alleged that, although ASUS marketed its routers as including numerous security features, it did not take reasonable steps to secure the software on its routers. According to the complaint, hackers could exploit pervasive security bugs in the router’s web-based control panel to change any of the router’s security settings without the consumer’s knowledge. The complaint also highlighted a number of other design flaws that exacerbated these vulnerabilities.

ASUS’s routers also featured services called AiCloud and AiDisk that allowed consumers to plug a USB hard drive into the router to create their own “cloud” storage accessible from any of their devices. Although ASUS advertised these services as a “private personal cloud for selective file sharing” and a way to “safely secure and access your treasured data through your router,” the FTC’s complaint alleged that these services had serious security flaws.

In February 2014, hackers used readily available tools to locate vulnerable ASUS routers and exploited these security flaws to gain unauthorized access to over 12,900 consumers’ connected storage devices. In many instances, according to the complaint, ASUS did not address security flaws in a timely manner and did not notify consumers about the risks posed by vulnerable computers. Consumers were also not notified about the availability of security updates.

The consent order will require ASUS to:

• establish and maintain a comprehensive security program subject to independent audits for 20 years; and

• notify consumers about software updates or other steps they can take to protect themselves from security flaws, including an option to register for direct security notices.

The consent order also will prohibit ASUS from misleading consumers about the security of its products, including whether a product is using up-to-date software.

A description of the consent agreement package will appear in the Federal Register shortly. The FTC will decide whether to make the proposed consent order final after the close of the 30-day public comment period, which continues through March 24.

Companies: ASUSTeK Computer, Inc.

News: ConsumerProtection FederalTradeCommissionNews