Chinese-Made Zbtlink Routers Ship With Backdoor That Opens Unauthenticated Root Shells
The recent discovery of a 'factory-shipped backdoor' in Chinese router models from Zbtlink has raised serious concerns about the security of IoT devices. This backdoor, dubbed ENDLESSDOORS, is a small tool called rctl that was uploaded to GitHub in 2015 and never touched again. It's designed to start automatically and beacon to Chinese command-and-control (C2) infrastructure as often as every 35 seconds.
What makes this backdoor particularly insidious is its ability to masquerade as a Linux kernel thread, but actually run as a userland process with root privileges. This allows it to blend in with other legitimate kworker processes, making it difficult to detect. The backdoor can send the client individual shell commands or tell the client to spawn a reverse bash shell, giving attackers a live interactive root shell.
One of the most concerning aspects of this backdoor is the lack of handshake, negotiation, or authentication involved. Once the implant sends a 'hello' message to the server alongside the LAN MAC address, it's engineered to run whatever the server sends back in response. This means that anyone along the network path can hijack the client/server communication and obtain a live root shell, taking over control of the router without having to be reachable from the internet.
The affected router models include CPE2801, WE1026-5G-WD, WE1326, WE2007, WE2008-DSIM, WE2416, WE3326, WE5927, WE5931, WE5931AC, WE826-T3-DSIM, WG108, WG1602, WG1608-DSIM, WG209, WG2105, WG2107, WG259, WG3526, and Z8102AX-2DSIM. Each of these models has been found to dial the same set of four primary and secondary endpoints, including zbtctl.epplink.net, 47.107.224.89, online-string.com, and rbdg4nzqadui.wikaba.com.
The discovery of this backdoor has led to the temporary removal of impacted firmware versions from download channels, as well as the development and validation of secured patched firmware. Customers are advised to check the process list, scan the file system for files like /usr/sbin/kworker, /usr/lib/librctl.so, /etc/kworker.cfg, and /etc/init.d/skworker, and block the egress points to protect themselves from potential attacks.
This incident highlights the importance of securing IoT devices and the need for manufacturers to take responsibility for the security of their products. As the internet of things continues to expand, it's crucial to ensure that these devices are not vulnerable to backdoors and other security vulnerabilities that can be exploited by malicious actors.
