Cybersecurity researchers have disclosed details of a “factory-shipped backdoor” implanted in at least 20 Chinese router models from Zbtlink.
According to a new report from VulnCheck, the implant appears in all 21 firmware images currently available from Zbtlink that span more than 2 years. The backdoors are designed such that they start automatically and attempt to beacon to Chinese command-and-control (C2) infrastructure as often as every 35 seconds.
They masquerade as a Linux kernel thread, but are actually userland processes running with root privileges while blending their true functionality with other legitimate kworker processes. The “phone home” implants have been codenamed ENDLESSDOORS.
“ENDLESSDOORS, at its core, is a small tool called rctl (remote control linux),” Jacob Baines, VulnCheck Chief Technology Officer, said. “Uploaded to GitHub on January 14, 2015 and never touched again, this obscure repository implements a simple command and control client and server.”
“The server listens on port 7000 for clients to connect. It can send the client individual shell commands or tell the client to spawn a reverse bash shell.”
The “kworker” worker process running on Zbtlink AX3000, which VulnCheck analyzed, is a customized version of rctl that’s configured to contact the following –
- 47.107.224[.]89
- rbdg4nzqadui[.]wikaba[.]com
What’s more, there is no handshake, negotiation, or authentication involved. Once the implant sends a “hello” message to the server alongside the LAN MAC address, it’s engineered to run whatever the server sends back in response.
“One reserved string, rctlbash, tells the implant to open a second connection to port 7001, allocate a pseudo-terminal, spawn /bin/sh, and bridge it,” Baines explained. “That is a live interactive root shell.”
“The vocabulary of this protocol is two phrases: run this as root, and give me a root shell. Anyone along the network path can hijack the client/server communication. Anyone who controls the resolution of rbdg4nzqadui.wikaba[.]com, or the address it resolves to, can control any ENDLESSDOORS implant that tries to phone home.”
An attacker can take advantage of this loophole to hijack the outbound rctl communications and obtain a live root shell, and take over control of the router without having to be reachable from the internet.
VulnCheck noted that every firmware listed on zbtlink.com’s download page embeds the rctl implant and starts it at boot with an init.d script named “skworker.” The list of affected models is below –
- CPE2801
- WE1026-5G-WD
- WE1326
- WE2007
- WE2008-DSIM
- WE2416
- WE3326
- WE5927
- WE5931
- WE5931AC
- WE826-T3-DSIM
- WG108
- WG1602
- WG1608-DSIM
- WG209
- WG2105
- WG2107
- WG259
- WG3526
- Z8102AX-2DSIM
Each of these models have been found to have been found to dial the same set of four primary and secondary endpoints –
- zbtctl.epplink[.]net (47.100.190[.]96)
- 47.107.224[.]89
- online-string[.]com (45.32.81[.]152)
- rbdg4nzqadui.wikaba[.]com (43.248.136[.]125)
As of writing, users visiting the firmware downloads page on Zbtlink’s website are displayed the below message –
We have detected firmware security vulnerabilities affecting selected router firmware releases.
As a precautionary measure, the impacted firmware versions have been temporarily taken down from download channels. Our engineering team is working intensively to develop and validate secured patched firmware.
We will notify you immediately once the fixed, security-validated firmware is available for release.
We apologize for the inconvenience caused. Thank you for your understanding.
The Hacker News has contacted the Chinese router manufacturer for further comment, and we will update the story if we hear back.
In the meantime, customers are advised to check the process list, scan the file system for files like /usr/sbin/kworker, /usr/lib/librctl.so, /etc/kworker.cfg, and /etc/init.d/skworker, and block the egress points.
