Chinese Routers with Built-in Root Backdoor Sold Worldwide
Security firm VulnCheck has uncovered a hidden backdoor in at least 20 models of Zbtlink routers, allowing attackers unauthorized root access without any authentication.
Security firm VulnCheck has uncovered a hidden backdoor in at least 20 models of Zbtlink routers, allowing attackers unauthorized root access without any authentication.
The backdoor, named "ENDLESSDOORS", is a tool called rctl (remote control linux), explained Jacob Baines, CTO at VulnCheck. This tool was published on GitHub on January 14, 2015, and has not been modified since. "ENDLESSDOORS, at its core, is a small tool called rctl (remote control linux)", Baines said. The server listens on port 7000 for connecting clients and can send individual shell commands or instruct the client to launch a reverse bash shell.
The process disguises itself as a legitimate Linux kernel thread (kworker), but actually runs as a user-space process with root privileges. After the implant sends a "hello" message to the server, it is ready to execute anything the server sends back. "One reserved string, rctlbash, tells the implant to open a second connection on port 7001, allocate a pseudo-terminal, spawn /bin/sh, and connect it. That's a live interactive root shell", Baines explained.
"The vocabulary of this protocol is two phrases: run this as root, and give me a root shell. Anyone on the network path can hijack the client/server communication. Anyone who controls the resolution of rbdg4nzqadui.wikaba[.]com, or the address it resolves to, can control any ENDLESSDOORS implant that tries to call home", Baines added. The implant automatically starts at system boot and attempts to contact the Chinese C2 infrastructure every 35 seconds.
VulnCheck identified the implant in all 21 available Zbtlink firmware images spanning more than two years. It is estimated that at least 100,000 such routers have been deployed worldwide. Each affected model contacts the same set of four C2 endpoints: zbtctl.epplink[.]net (47.100.190[.]96), 47.107.224[.]89, online-string[.]com (45.32.81[.]152), and rbdg4nzqadui.wikaba[.]com (43.248.136[.]125).
The list of affected models includes CPE2801, WE1026-5G-WD, WE1326, WE2007, WE2008-DSIM, WE2416, WE3326, WE5927, WE5931, WE5931AC, WE826-T3-DSIM, WG108, WG1602, WG1608-DSIM, WG209, WG2105, WG2107, WG259, WG3526, and Z8102AX-2DSIM.
Zbtlink has posted a message on its firmware download page: "We have discovered firmware security vulnerabilities affecting selected router firmware releases. As a precaution, affected firmware versions have been temporarily removed from download channels. Our engineering team is working intensively on developing and validating a secure patched firmware. We will notify you as soon as the fixed, security-validated firmware is available for release."
The discovery comes amid heightened scrutiny of network equipment of Chinese origin in the United States. The U.S. Federal Communications Commission (FCC) issued restrictions on March 23 on imports of certain foreign-made routers due to national security concerns, stating that malicious actors had exploited them for espionage and theft of intellectual property. In February, the state of Texas filed a lawsuit against TP-Link Systems, alleging that it exposed American consumers' devices to access by the Chinese regime.
"If I have it in my lab, in my university lab, you've just invited them right into your lab and they can roam the network as they please. The possibilities are devastating", Baines warned. Although there is no direct link to Croatia, the global distribution of such devices poses a risk to users worldwide. VulnCheck recommends that organizations identify affected devices by model numbers rather than brand, as Zbtlink manufactures routers for other companies through OEM and ODM contracts. It is recommended to replace devices where possible, restrict remote management, and install security patches as soon as they become available.
Users are advised to check the process list, scan the file system for files such as /usr/sbin/kworker, /usr/lib/librctl.so, /etc/kworker.cfg, and /etc/init.d/skworker, and block outbound connections to the listed C2 endpoints.
