Aug 5 (Reuters) - More than 20 models of a Chinese-made router available throughout the world ship with a backdoor that could allow access and potential connections to other devices on the network, researchers with cybersecurity firm VulnCheck said on Wednesday.
The finding adds to growing Western concerns about cybersecurity risks posed by Chinese-made networking equipment. Western governments have warned for years about hackers exploiting such devices, and U.S. regulators moved this year to restrict imports of foreign-made routers. The previously unreported backdoor, dubbed "Endlessdoors" by the researchers who discovered it, ships in multiple models of routers manufactured and sold by Zbtlink around the world under both the Zbtlink and Wiflyer brand names, according to Jacob Baines, the chief technology officer at VulnCheck who found the backdoor.
Also read: Indian diaspora in China flags visa, social media concerns at embassy's first Open House in years
Zbtlink did not respond to a request for comment. Baines estimates that at least 100,000 such routers are deployed worldwide, although it’s not possible to say exactly where, he said, or how many are active in the U.S. Western governments have warned about Chinese-linked hackers abusing small office and home office routers and other internet devices to gain access to networks for later intrusions as well as cyberespionage. Beijing regularly denies condoning or carrying out cyberattacks or cyberespionage. The Federal Communications Commission in March announced that it was banning the import of new foreign-made consumer routers over national security concerns, though the agency subsequently exempted many non-Chinese firms. In February, the state of Texas sued TP-Link, a California-based router manufacturer spun off from a Chinese firm, alleging the company allowed Beijing access to American consumers’ devices, a claim the company disputed. The backdoor discovered by Baines automatically communicates to a specific IP address and Chinese-registered domain every 35 seconds, Baines said in a blog post on the company’s website. Whoever controls those domains could take control of the router and potentially use it to access other devices on the same network, he said.
{{/usCountry}}Zbtlink did not respond to a request for comment. Baines estimates that at least 100,000 such routers are deployed worldwide, although it’s not possible to say exactly where, he said, or how many are active in the U.S. Western governments have warned about Chinese-linked hackers abusing small office and home office routers and other internet devices to gain access to networks for later intrusions as well as cyberespionage. Beijing regularly denies condoning or carrying out cyberattacks or cyberespionage. The Federal Communications Commission in March announced that it was banning the import of new foreign-made consumer routers over national security concerns, though the agency subsequently exempted many non-Chinese firms. In February, the state of Texas sued TP-Link, a California-based router manufacturer spun off from a Chinese firm, alleging the company allowed Beijing access to American consumers’ devices, a claim the company disputed. The backdoor discovered by Baines automatically communicates to a specific IP address and Chinese-registered domain every 35 seconds, Baines said in a blog post on the company’s website. Whoever controls those domains could take control of the router and potentially use it to access other devices on the same network, he said.
{{/usCountry}}Also read: What does China's J-20 have that even America's F-35 cannot ignore?
Baines said most people who order this router and use it for their small business or home office would likely have no clue that it could allow this sort of access. "If I have it in my lab, in my lab at my university, you just invited them straight into your lab and they can roam the network as they choose," Baines said. "The capabilities are devastating."
Reuters could not determine why the backdoor exists, what purpose it serves, or whether it has ever been abused.
(Reporting by AJ Vicens in Detroit; Editing by Sanjeev Miglani)