Chinese router vendor denies backdoor allegations
Company pauses firmware downloads to address security vulnerabilities.
1Backdoor allegations and company response
Chinese Wi-Fi router vendor Zbtlink denied allegations of backdoors in its products but temporarily halted firmware downloads to address security vulnerabilities. VulnCheck CTO Jacob Baines discovered that Zbtlink routers continuously attempted to connect to a command and control server online. The company claimed this feature was solely for after-sales maintenance and not included in mass-production units.
2Technical details of the ENDLESSDOORS backdoor
The backdoor, named ENDLESSDOORS by VulnCheck, is related to a small tool called rctl uploaded to GitHub in 2015. This tool implements a simple command and control client-server system operating on port 7000. According to Baines, the backdoor runs in Linux kernel threads with root privileges. The communication lacks any security protocols, making it vulnerable to interception by anyone on the network.
3Company's contradictory statements
Zbtlink initially denied any security issues but soon posted a notice on its firmware download page about detected vulnerabilities affecting select router firmware versions. The Wayback Machine's July 31 archive shows no such warning. The company also stated that customers could use their own software and supported OpenWrt open-source firmware.
4Servers contacted by the routers
VulnCheck found that tested devices connected to only four different servers, with just one using a domain linked to Zbtlink. Baines described this connection as 'damning'. Router firmware presents a potential target for supply chain attacks, raising significant security concerns.
5Violation of coordinated disclosure protocols
Baines bypassed standard coordinated disclosure protocols due to the exceptional severity of the issue. These protocols typically give vendors time to fix unintentional flaws. However, Baines asserts the backdoor was intentionally included and has been present across 20 models for years, making standard disclosure procedures inappropriate.
6Affected devices and distribution channels
Zbtlink products are sold under various brands including ZBT, ZBTWiFi and Wiflyer on platforms like Amazon, Alibaba and Shopify. The company also offers OEM and ODM services, allowing hardware customization. This situation suggests countless devices could be at risk. VulnCheck shared technical details for identifying affected devices.
7Recommendations for users
VulnCheck advises users to replace affected devices or at least move them behind strict egress controls, treating their LAN as untrusted. The company provided rules for Suricata, Snort and YARA to block connections to the routers' command servers, offering practical protection measures for concerned users.
8Industry implications and risks
This incident raises important questions about consumer electronics security and supply chain risks. It may increase concerns about hardware from Chinese manufacturers. As critical network components, vulnerable routers could impact millions of users. Experts recommend examining products from other manufacturers for similar risks, highlighting broader industry implications.