At least 20 Zbtlink router models ship with ENDLESSDOORS, a root backdoor that attempts C2 contact as often as every 35 seconds and accepts commands.

cross-posted from: https://mander.xyz/post/56484546

Here is the technical report: ENDLESSDOORS Is Phoning Home. Pick Up.

…

Cybersecurity researchers have disclosed details of a “factory-shipped backdoor” implanted in at least 20 Chinese router models from Zbtlink.

According to a new report from VulnCheck, the implant appears in all 21 firmware images currently available from Zbtlink that span more than 2 years. The backdoors are designed such that they start automatically and attempt to beacon to Chinese command-and-control (C2) infrastructure as often as every 35 seconds.

They masquerade as a Linux kernel thread, but are actually userland processes running with root privileges while blending their true functionality with other legitimate kworker processes. The “phone home” implants have been codenamed ENDLESSDOORS.

“ENDLESSDOORS, at its core, is a small tool called rctl (remote control linux),” Jacob Baines, VulnCheck Chief Technology Officer, said. “Uploaded to GitHub on January 14, 2015 and never touched again, this obscure repository implements a simple command and control client and server.”

“The server listens on port 7000 for clients to connect. It can send the client individual shell commands or tell the client to spawn a reverse bash shell.” Cybersecurity

The “kworker” worker process running on Zbtlink AX3000, which VulnCheck analyzed, is a customized version of rctl that’s configured to contact the following -

…

  • jobbies@lemmy.zipEnglish
    431·
    2 days ago

    Every time I mention this being a risk with Chinese tech I get flamed.

    The CCP effectively controls every chinese company. If they want backdoors, they get backdoors.

    I say that as a centre-left European who has just as much criticism for American tech.

    • village604@adultswim.fanEnglish
      352·
      2 days ago

      They seem to think criticism of the CCP means support for the US fascists.

      It’s possible to hate both.

      • jobbies@lemmy.zipEnglish
        14·
        2 days ago

        Yeah. Or if you speak up about Gaza you’re antisemetic. Or defend a Jewish person you’re a fascist. Fucking hate the way things are.

        • Greyghoster@aussie.zoneEnglish
          2·
          14 hours ago

          Usually but not always different people calling fascist and antisemitic. It’s really polarised society, media and politics.

        • 0x0@infosec.pubEnglish
          10·
          2 days ago

          Pitching us against them has been the playbook of the epstein class since forever.

          Bread and circus on repeat, our planet is a giant resort for the few and we are the serfvants

    • Siegehammer85@lemmy.worldEnglish
      46·
      2 days ago

      Not sure why you’re telling me that like especially as I’m essentially saying they are the opposite sides of the same fucked up coin. I’d say the fundamental difference is on the western side it’s the child raping Epstein class is who is behind it all and who are actively working to make our lives more miserable driven by immense obsession of power and wealth. The Chinese side is more if defacto state operation which isn’t benefiting a few greedy sickos but rather maintaining the whole status quo for the state. Neither should exists, both countries are a threat to the rest of the world, though the Americans have tilted the evil scale more towards themselves at this point in time. And in Europe we’re now worried the US will flip a switch to cut us off from all cloud services too, besides spying on us, sabotage us and threatening invasion. China is somewhat less extreme now, but still undermining us and spying on is nonetheless. A swinging pendulum of who is more evil that I wish would turn into a wrecking ball and free us of this insanity.