Chinese-made routers from Zbtlink have been found to ship with a backdoor that opens unauthenticated root shells, posing a significant security risk to users. This discovery highlights the importance of vigilance in the IoT security landscape. The backdoor, dubbed ENDLESSDOORS, is a small tool called rctl, which was uploaded to GitHub in 2015 and has since been left untouched. It operates as a command and control client and server, listening on port 7000 and sending commands to the client. The implant is designed to start automatically at boot and beacon to Chinese command-and-control infrastructure every 35 seconds. What's concerning is that there's no handshake, negotiation, or authentication involved. Once the implant sends a 'hello' message, it runs whatever the server sends back, potentially granting attackers a live root shell. This vulnerability can be exploited by anyone along the network path, allowing them to hijack the client/server communication and take control of the router without internet reachability. The affected router models include CPE2801, WE1026-5G-WD, WE1326, and many others, all of which embed the rctl implant and start it at boot. The list of primary and secondary endpoints used by the backdoor is also provided, further emphasizing the scope of the issue. The Zbtlink website has temporarily taken down the impacted firmware versions, acknowledging the security vulnerabilities. This incident underscores the need for users to be proactive in securing their IoT devices, including checking process lists, scanning file systems, and blocking egress points. As an expert, I find this case particularly fascinating because it highlights the ongoing challenges in securing IoT devices. The fact that a simple tool left untouched for years can have such a significant impact is a stark reminder of the importance of regular updates and patch management. It also raises questions about the security practices of router manufacturers and the potential consequences of neglecting security in the face of evolving threats. In my opinion, this incident serves as a wake-up call for both users and manufacturers to prioritize IoT security. Users should be encouraged to keep their devices updated and be aware of potential backdoors, while manufacturers must take responsibility for the security of their products. The implications of this discovery extend beyond individual users, as the widespread use of compromised routers could have far-reaching consequences for network security and data privacy. As we move forward, it is crucial to address these vulnerabilities head-on and work towards a more secure IoT ecosystem. This incident also highlights the importance of transparency and accountability in the tech industry. Manufacturers should be more open about the security measures they take and the potential risks associated with their products. Users, in turn, should demand more from their device providers and be more proactive in securing their own networks. In conclusion, the discovery of the ENDLESSDOORS backdoor in Zbtlink routers is a serious security concern that requires immediate attention. It serves as a reminder of the ongoing challenges in securing IoT devices and the need for a multi-faceted approach to address these vulnerabilities. As experts, we must continue to raise awareness, advocate for better security practices, and work towards a safer digital future.
