Security researchers have uncovered a hidden backdoor present in 20 models of Zbtlink routers, a Chinese manufacturer also known as Shenzhen Zhibotong Electronics. This backdoor, which the researchers have named ENDLESSDOORS, allows remote servers to execute commands with root privileges, potentially leading to full device compromise. Zbtlink routers are sold under various brand names, including Wiflyer, ZBT, and ZBTWiFi, through platforms like Amazon, Alibaba, and Shopify.
The discovery originated when a researcher observed an unexpected outbound connection attempt from a Zbtlink AX3000 router. Further investigation revealed two processes named `kworker` running as root, with active memory footprints, alongside legitimate Linux kernel threads of the same name. These unbracketed `kworker` processes are not genuine kernel threads but rather userland processes designed to blend in with legitimate system activity.
The ENDLESSDOORS implant functions as a phone-home trojan. It connects to a hardcoded server and, once a connection is established, transmits a fixed 39-byte "hello" message consisting of a 33-byte class label padded with nulls, followed by the router's LAN MAC address. Crucially, the researchers found no client or server verification mechanisms in place. After this initial registration, any data sent by the command server is passed to the `popen()` function and executed as `uid 0`, granting root access without any allow-listing or sandboxing.
A specific string, "rctlbash," instructs the implant to open a second connection to port 7001, allocate a pseudo-terminal, spawn `/bin/sh`, and bridge it, effectively providing a live, interactive root shell. This means an attacker controlling the command server could obtain a remote login to the router without requiring a password. Because the router initiates the connection, standard firewall rules designed to block incoming connections are ineffective, leaving devices behind multiple layers of corporate firewalls just as vulnerable as those directly exposed to the internet, provided they can reach the command server.
To demonstrate the exploit, the researchers developed a tool that impersonated the command server. They successfully intercepted the router's outbound connection and obtained a root shell within seconds. The backdoor is automatically launched at boot through an `init` script named `skworker` across all affected models.
The researchers identified that the entire fleet of compromised routers connects to a small set of four primary and secondary endpoints. These endpoints are hosted across Alibaba Cloud, Vultr, and a Chinese cloud provider. This centralized infrastructure implies that whoever controls these servers could simultaneously control all affected routers globally. The primary endpoints include `zbtctl.epplink[.]net` (resolving to 47.100.190[.]96 on Alibaba Cloud, Shanghai) and a hardcoded IP address (47.107.224[.]89 on Alibaba Cloud, Shenzhen). Secondary endpoints are `online-string.com` (resolving to 45.32.81[.]152 on Vultr) and `rbdg4nzqadui[.]wikaba[.]com` (resolving to 43.248.136[.]125 on Jiangsu Dongyun Cloud).
The researchers opted against a coordinated disclosure process with the vendor, citing that the backdoor appeared to be an intentionally built-in component, present across numerous models and firmware releases over several years. They believed that warning the vendor would only alert those operating the malicious infrastructure.
Zbtlink, in response to inquiries, claimed the backdoor was solely for "after-sales maintenance" and was not intended for mass-production shipments, stating it was only retained on sample units for software debugging. However, the company subsequently removed firmware downloads from its website and acknowledged unspecified "firmware security vulnerabilities," which has raised further questions regarding its explanation.
Given that this is a vendor-built "feature," no patch is expected. Users of affected Zbtlink router models are advised to consider their devices compromised by design. It is crucial to check the specific model number, as the same hardware can be rebranded under different names.
