Which D-Link IP cameras are affected by the FTC complaint, and what can I do about them?

Question

The FTC have filed a legal complaint against D-Link alleging that their routers and IP cameras have critical security vulnerabilities and are misleading consumers into believing they are safe.

Defendants have failed to take reasonable steps to protect their routers and IP cameras from widely known and reasonably foreseeable risks of unauthorized access, including by failing to protect against flaws which the Open Web Application Security Project has ranked among the most critical and widespread web application vulnerabilities since at least 2007.

I did a bit more research and found the response from D-Link, saying:

What D-Link Systems products are impacted?

The FTC has made vague and unsubstantiated allegations relating to routers and IP cameras. Notably, the complaint does not allege any breach of any product sold by D-Link Systems in the US.

Is there any security concern for current products?

The FTC does not allege any breach of any product sold by D-Link Systems.

It's clear that D-Link don't want to admit that their devices are insecure, from that response. The list of the security vulnerabilities is already provided by the FTC, which is helpful, but they don't actually provide a list of which products specifically are vulnerable.

Which products are affected by the complaint, and what actions (if any) can I take to protect my devices and home network?

Answer 1

I have a D-Link 5020-L IP Camera.

Even without D-Link's soft, the messages are transmitted via plain HTTP and a basic autorization header. Which means that if somebody sniffs my home network they can easily get my login/password. And yes, if my router has opened ports my login/password is base64 encoded in the basic header so very easy to read.

As for the document I see two parts for what I have read at the beginning:

• the first part is "insecure cameras". Well yes, people still don't change the default password of their device. Robots simply perform standard queries to see if cameras are secure, then they list them.
• the second part is "easy to secure" cameras written on the box. D-Link assures it is easy to secure a camera, but in fact no, people must have a strong knowledge of Wifi protocols (WPA,...) and these settings are hidden behind all the menus of the camera web interface.

With my first point, I would say "all the devices" are impacted since the user must enable security. So, to answer your question: how?

• Change the default password of the admin account!!!!
• If possible, rename the network host via the web interface or via your router, in that case if an attacker finds your device on the network, he won't know it is a [insert brand] camera.
• Don't expose your camera's port with your router, unless it is a public camera and you have set a guest account.
• Proxyfy your camera: make a webserver perform all the queries to your camera so you can have a visual monitor of who made which queries.