Router Manufacturer Found With Multiple Backdoors in its Products

Researchers at VulnCheck found multiple backdoors in routers from Chinese manufacturer Zbtlink allowing a remote server root access to the router with no authentication.

Most people don't think much about their router: they buy one that fits their price range and lets them access their internet. Commonly, routers end up vulnerable to hackers due to not being updated, or not being replaced once the manufacturer stops supplying updates.

Something most people probably don't consider, however, is the manufacturer itself being hostile.

The researchers originally found a backdoor in routers from Zbtlink back on August 5. The routers were observed continuously phoning home waiting for orders from a command and control (C2) server. This behavior is typical of a device that's been hacked, but these routers were shipped like this from the factory.

ENDLESSDOORS, the name given to the backdoor by the researchers, utilizes a tool called rctl (remote control linux) that was uploaded to GitHub in 2015 and never touched (the page seems to have been mysteriously taken down now).

The tool implements the command and control client and server. It allows the server to send the client (your router) commands. The router will continuously reach a server and, with no authentication or key exchange, start accepting anything the server sends as a command, with no sandbox, always executed as root.

The backdoor was found in every firmware offered on zbtlink's site. Zbtlink also sells its routers white-labeled under different brand names like "Wiflyer" so you might have to match the model name your router to check if it's affected.

The researchers didn't notify the manufacturer since they believe it's not a vulnerability, but an intentional backdoor. There likely won't be a patch.

In a later blog post, VulnCheck found two more backdoors from the same OEM: SPEAKINGSTONE and DARKLANTERN. SPEAKINGSTONE phones home to ZBT's infrastructure and DARKLANTERN listens and executes arbitrary commands, much like ENDLESSDOORS.

The researchers scanned the internet for DARKLANTERN-affected devices and found 16 devices affected. They say likely the deployment was much larger but they caught it on the tail-end of its lifespan.

SPEAKINGSTONE had a hardcoded backup C2 domain that it sent data to if there was no primary C2 server was configured. The researchers registered this backup domain themselves and waited for devices to contact it. As of August 21, they had 392 unique devices phoning home, with one phoning home for almost two years straight.

ZBT actually responded to the backdoor claims, stating "it is intended to assist customers with device troubleshooting and configuration only upon their explicit request and authorization," a hilarious statement considering there is zero authentication involved and the routers were continuously reaching out.