Weak default passwords to be made illegal in California

Come 2020 manufacturers will be forced to preprogram unique default passwords into every device they make

password on posit note

California lawmakers have passed a legislation that will make default passwords such as 'admin' and 'password' illegal in the state from 2020.

The Information Privacy: Connected Devices Bill, which will begin on 1 January 2020, will require manufacturers of connected devices to set unique preprogrammed default passwords for every single device they make.

Advertisement - Article continues below

"This bill would require a manufacturer of a connected device to equip the device with a reasonable security feature or features that are appropriate to the nature and function of the device, appropriate to the information it may collect, contain, or transmit, and designed to protect the device and any information contained therein from unauthorized access, destruction, use, modification, or disclosure, as specified," the bill stated.

The bill will also allow customers who suffer due to a weak default password to sue if a company is found to have ignored the law.

Highlighting the need for strong laws and manufacturers to strengthen device security, a number of recent cyber attacks have used default and easy to guess passwords as a route into peoples homes and businesses, allowing for the spread of various types of malware.

Recently, a research paper from Yossi Oren of Ben-Gurion University said that household devices such as baby monitors, home security and web cameras, doorbells and thermostats shared the same common default passwords and that consumers rarely changed them after purchase.

Advertisement
Advertisement - Article continues below
Advertisement - Article continues below

Last year, routers made by BT, TalkTalk and Sky were found to have the same password flaw as Virgin Super Hub 2 devices, which were easy targets for criminals because of weak default passwords.

In May, Cisco's cybersecurity division, Talos, warned that hackers had infected some 500,000 internet routers and storage devices with Russian state-developed malware called VPNFiler after exploiting weak passwords. 

Featured Resources

Successful digital transformations are future ready - now

Research findings identify key ingredients to complete your transformation journey

Download now

Cyber security for accountants

3 ways to protect yourself and your clients online

Download now

The future of database administrators in the era of the autonomous database

Autonomous databases are here. So who needs database administrators anymore?

Download now

The IT expert’s guide to AI and content management

Your guide to the biggest opportunities for IT teams when it comes to AI and content management

Download now
Advertisement

Recommended

Visit/security/vulnerability/355276/businesses-brace-for-second-fujiwhara-effect-of-2020-as-patch-tuesday
vulnerability

Businesses brace for second 'Fujiwhara effect' of 2020 as Patch Tuesday looms

9 Apr 2020
Visit/technology/30736/what-is-ethical-ai
Technology

What is ethical AI?

8 Apr 2020
Visit/security/cyber-security/355267/zoom-hires-ex-facebook-cso-to-boost-platform-security
cyber security

Zoom hires ex-Facebook CSO Alex Stamos to boost platform security

8 Apr 2020
Visit/security/vulnerability/355236/hp-support-assistant-flaws-leave-windows-devices-open-to-attack
vulnerability

HP Support Assistant flaws leave Windows devices open to attack

6 Apr 2020

Most Popular

Visit/mobile/mobile-phones/355239/microsofts-patent-design-reveals-a-mobile-device-with-a-third-screen
Mobile Phones

Microsoft patents a mobile device with a third screen

6 Apr 2020
Visit/security/cyber-security/355271/microsoft-gobbles-up-corpcom-domain-to-keep-it-from-hackers
cyber security

Microsoft gobbles up corp.com domain to keep it from hackers

8 Apr 2020
Visit/software/video-conferencing/355257/taiwan-first-country-to-ban-zoom-amid-security-concerns
video conferencing

Taiwan becomes first country to ban Zoom amid security concerns

8 Apr 2020