The most blatant security backdoor yet seen in an internet router has been found in a range of models sold under multiple brand names. A firmware implant phones home to cloud servers in China to ask for instructions, and can then be remotely controlled …
Earlier this year, the US government banned the import and sale of all new models of Chinese routers, citing national security risks. It followed the discovery last year that thousands of Asus routers had been compromised by a botnet, with devices from Cisco, D-Link and Linksys also targeted.
A major challenge to avoiding these kinds of embedded malware threats is that so many Chinese-made routers are sold under different brands, sometimes with different claimed countries of origin. Additionally, many are rebadged and supplied as standard by US ISPs, so customers have literally no idea who made their router.
Cybersecurity company VulnCheck has now found an incredible and deliberate backdoor built into routers made by Shenzhen Zhibotong Electronics and sold under a variety of brands that include Zbtlink and Wiflyer. They dubbed it ENDLESSDOORS as it can be exploited in endless ways.
They are an implant, a phone-home trojan horse. Our zero-day research team named this ENDLESSDOORS. This, at its core, is a small tool called rctl (remote control linux). Uploaded to GitHub on January 14, 2015 and never touched again, this obscure repository implements a simple command and control client and server. The server listens on port 7000 for clients to connect. It can send the client individual shell commands or tell the client to spawn a reverse bash shell.
