Weak default passwords to be made illegal in California

Come 2020 manufacturers will be forced to preprogram unique default passwords into every device they make

password on posit note

California lawmakers have passed a legislation that will make default passwords such as 'admin' and 'password' illegal in the state from 2020.

The Information Privacy: Connected Devices Bill, which will begin on 1 January 2020, will require manufacturers of connected devices to set unique preprogrammed default passwords for every single device they make.

"This bill would require a manufacturer of a connected device to equip the device with a reasonable security feature or features that are appropriate to the nature and function of the device, appropriate to the information it may collect, contain, or transmit, and designed to protect the device and any information contained therein from unauthorized access, destruction, use, modification, or disclosure, as specified," the bill stated.

The bill will also allow customers who suffer due to a weak default password to sue if a company is found to have ignored the law.

Highlighting the need for strong laws and manufacturers to strengthen device security, a number of recent cyber attacks have used default and easy to guess passwords as a route into peoples homes and businesses, allowing for the spread of various types of malware.

Recently, a research paper from Yossi Oren of Ben-Gurion University said that household devices such as baby monitors, home security and web cameras, doorbells and thermostats shared the same common default passwords and that consumers rarely changed them after purchase.

Last year, routers made by BT, TalkTalk and Sky were found to have the same password flaw as Virgin Super Hub 2 devices, which were easy targets for criminals because of weak default passwords.

In May, Cisco's cybersecurity division, Talos, warned that hackers had infected some 500,000 internet routers and storage devices with Russian state-developed malware called VPNFiler after exploiting weak passwords. 

Featured Resources

Humility in AI: Building trustworthy and ethical AI systems

How humble AI can help safeguard your business

Download now

Future of video conferencing

Optimising video conferencing features to achieve business goals

Download now

Leadership compass: Privileged Access Management

Securing privileged accounts in a high-risk environment

Download now

Why you need to include the cloud in your disaster recovery plan

Preserving data for business success

Download now

Recommended

What is AES encryption?
Advanced Encryption Standard (AES)

What is AES encryption?

30 Nov 2020
UK's Huawei 5G ban brought forward to September 2021
Security

UK's Huawei 5G ban brought forward to September 2021

30 Nov 2020
Hacker claims to be selling C-suite executives' Microsoft credentials
Security

Hacker claims to be selling C-suite executives' Microsoft credentials

30 Nov 2020
The IT Pro Panel
Business strategy

The IT Pro Panel

30 Nov 2020

Most Popular

46 million Animal Jam accounts leaked after comms software breach
Security

46 million Animal Jam accounts leaked after comms software breach

13 Nov 2020
macOS Big Sur is bricking some older MacBooks
operating systems

macOS Big Sur is bricking some older MacBooks

16 Nov 2020
Huawei Mate 40 Pro 5G review: A tragically brilliant Mate
Mobile Phones

Huawei Mate 40 Pro 5G review: A tragically brilliant Mate

26 Nov 2020