Internet Router Maker Asustek Settles With FTC on Inadequate Device Security

By Jennifer Valentino-DeVries

A maker of home Internet routers agreed to settle charges that it misled consumers and failed to provide adequate security on its devices, the Federal Trade Commission said Tuesday.

The settlement is the first by the FTC involving home routers--products that computer experts warn are rife with security weaknesses that expose users to hackers. Earlier this year, a Wall Street Journal examination found that bugs in home routers often went unpatched, and many of the devices made it difficult for consumers to get updated software to fix the flaws.

Under the settlement, the router maker, Taiwan-based Asustek Computer Inc., must develop a security program that is subject to audits for the next 20 years. The company didn't admit or deny wrongdoing.

Asustek, which markets its products under the brand name Asus, didn't immediately respond to a request for comment.

Among other things, the FTC found that Asustek failed to notify consumers about vulnerabilities and neglected to make timely fixes when security researchers alerted the company to problems, according to the complaint. The router maker's software update tool also inaccurately told people that its software was up to date when in fact it wasn't, the complaint said.

The FTC also cited Asustek for shipping its routers with well-known and "easily foreseeable" security vulnerabilities. The Asus routers were susceptible to several types of attacks and also had weak security features, such as allowing people to use the default login and password, both set to "admin," something that experts have long warned against.

The Journal found such flaws in other routers in a report published in January. Of the 20 routers in the Journal's tests, half didn't let users easily check for new software. Two incorrectly told users that updated software wasn't available, when in fact it was, and one directed users to download software that had a severe, documented security flaw. All but two of the 20 routers tested used insecure, widely known passwords by default and didn't require users to change them.

Write to Jennifer Valentino-DeVries at Jennifer.Valentino-DeVries@wsj.com

(END) Dow Jones Newswires

February 23, 2016 12:26 ET (17:26 GMT)

Asustek Computer (PK) (USOTC:ASUUY)
Historical Stock Chart
From May 2024 to Jun 2024