cross-posted from: https://mander.xyz/post/56484546

Here is the technical report: ENDLESSDOORS Is Phoning Home. Pick Up.

…

Cybersecurity researchers have disclosed details of a “factory-shipped backdoor” implanted in at least 20 Chinese router models from Zbtlink.

According to a new report from VulnCheck, the implant appears in all 21 firmware images currently available from Zbtlink that span more than 2 years. The backdoors are designed such that they start automatically and attempt to beacon to Chinese command-and-control (C2) infrastructure as often as every 35 seconds.

They masquerade as a Linux kernel thread, but are actually userland processes running with root privileges while blending their true functionality with other legitimate kworker processes. The “phone home” implants have been codenamed ENDLESSDOORS.

“ENDLESSDOORS, at its core, is a small tool called rctl (remote control linux),” Jacob Baines, VulnCheck Chief Technology Officer, said. “Uploaded to GitHub on January 14, 2015 and never touched again, this obscure repository implements a simple command and control client and server.”

“The server listens on port 7000 for clients to connect. It can send the client individual shell commands or tell the client to spawn a reverse bash shell.” Cybersecurity

The “kworker” worker process running on Zbtlink AX3000, which VulnCheck analyzed, is a customized version of rctl that’s configured to contact the following -

…