Zbtlink Routers Ship with a Factory Backdoor That Opens Passwordless Root Access

VulnCheck has reported a “factory-installed” backdoor found in at least 20 models of Chinese-made Zbtlink routers. According to the researchers, the implant is present in all 21 firmware images available on the manufacturer's website — firmware that spans a period of more than two years.

How ENDLESSDOORS Works

The malicious component, dubbed ENDLESSDOORS, launches automatically at boot (via the skworker init.d script) and disguises itself as a Linux kernel thread. In reality it is a user-space process running with root privileges that hides among the legitimate kworker processes. The implant “phones home” to Chinese command infrastructure — sometimes every 35 seconds.

According to VulnCheck CTO Jacob Baines, at its core lies a tiny utility called rctl (remote control linux), posted to GitHub on January 14, 2015, and never touched since. The server listens on port 7000 and can either send the client a single command or order it to open a reverse bash shell.

No Handshake, No Password

The most alarming part is the complete absence of authentication. After sending the server a hello message containing the LAN MAC address, the implant is ready to carry out whatever comes back in response. The reserved string rctlbash makes the device open a second connection on port 7001, allocate a pseudo-terminal, launch /bin/sh and wire it outward — in other words, hand over a live interactive root shell.

The protocol's entire “vocabulary,” Baines quips, consists of two phrases: “run this as root” and “give me a root shell.” Which means the C2 operator isn't the only one who can hijack control: anyone who controls the path to the server or the resolution of the domain name rbdg4nzqadui.wikaba[.]com gains control of the device — and the router doesn't even need to be reachable from the internet.

Affected Models and What to Do

The vulnerable devices include the AX3000, WE826-T3-DSIM, WG3526, Z8102AX-2DSIM and a dozen and a half other models. All of them reach out to the same set of four primary and backup addresses, including zbtctl.epplink[.]net and online-string[.]com.

As of publication, Zbtlink's firmware download page is offline: the manufacturer says it has temporarily pulled the affected versions and is working on fixed builds. Until patches are available, VulnCheck advises inspecting the process list, looking for files such as /usr/sbin/kworker, /usr/lib/librctl.so, /etc/kworker.cfg and /etc/init.d/skworker, and blocking outbound traffic to the addresses listed above.

Source: The Hacker News