Recent findings by cybersecurity experts reveal a significant security vulnerability in at least 20 models of routers manufactured by Zbtlink. These devices reportedly come with a pre-installed backdoor, compromising their security integrity. The analysis by VulnCheck highlights that this backdoor exists in all of the 21 available firmware images from Zbtlink, which date back over two years.
Details of the Security Vulnerability
The embedded backdoors operate automatically, attempting to connect with command-and-control (C2) servers in China every 35 seconds. Although they appear as Linux kernel threads, they are actually userland processes with root access, blending in with legitimate processes. The backdoor, named ENDLESSDOORS, is essentially a remote control tool, rctl, which was uploaded to GitHub in 2015 and hasn’t been updated since.
According to Jacob Baines, VulnCheck’s CTO, this tool enables a server to send commands to the router, including the ability to initiate a reverse bash shell. This communication occurs without any authentication, allowing anyone intercepting the traffic to gain control over the device.
Technical Analysis and Risks
The customized rctl version in the Zbtlink AX3000 model analyzed by VulnCheck is configured to communicate with specific endpoints, including 47.107.224.89 and rbdg4nzqadui.wikaba.com. The lack of authentication means an attacker could easily hijack the communication, gaining a live root shell and control over the router remotely, without needing direct internet access.
VulnCheck’s report indicates that all firmware versions on Zbtlink’s website contain this backdoor, with the process initiated at boot by an init.d script named “skworker.” Affected models include CPE2801, WE1026-5G-WD, and WG3526, among others, all dialing the same primary and secondary endpoints.
Response and Recommendations
In response to these vulnerabilities, Zbtlink has temporarily removed the affected firmware from their download page, indicating that their engineering team is working on secure updates. Meanwhile, users are advised to inspect their device processes and filesystem for suspicious files related to “kworker” and block the listed egress points.
The Hacker News has reached out to Zbtlink for a statement, and further updates will be provided when available. Users should remain vigilant and take recommended precautions to safeguard their devices against potential exploitation.
This situation underscores the importance of maintaining updated firmware and being aware of possible security risks associated with IoT devices.
