"ENDLESSDOORS, at its core, is a small tool called rctl (remote control linux)," Jacob Baines, VulnCheck Chief Technology Officer, said.
ENDLESSDOORS: a kernel-thread impostor that phones home
Security researchers at VulnCheck disclosed a factory-shipped implant, codenamed ENDLESSDOORS, embedded in at least 20 Zbtlink router models and present in all 21 firmware images currently available from the vendor. The implant is configured to start automatically and to attempt to beacon to Chinese command-and-control infrastructure as frequently as every 35 seconds. It masquerades as a Linux kernel thread but is actually a userland process running with root privileges and blending its functionality with legitimate kworker processes.
rctl protocol: unauthenticated greetings, root commands, and rctlbash
VulnCheck identified the implant as a customized version of a small remote control tool called rctl. The repository for rctl was uploaded to GitHub on January 14, 2015. According to Jacob Baines, the rctl server listens on port 7000 and can either send individual shell commands to a client or instruct the client to spawn a reverse bash shell.
The implant on Zbtlink devices sends an unprotected "hello" message to its server that includes the LAN MAC address and then executes whatever the server responds with—there is no handshake, negotiation, or authentication. One reserved protocol string, "rctlbash," causes the implant to open a second connection to port 7001, allocate a pseudo-terminal, spawn /bin/sh, and bridge it. VulnCheck summarizes that this yields "a live interactive root shell." Because the protocol contains only two functional phrases—run this as root, and give me a root shell—anyone along the network path can hijack communications, and anyone who controls the DNS resolution or the address of rbdg4nzqadui.wikaba[.]com can control affected implants.
Nobody's watching your logs at 2 AM.
Full SOC coverage without building one. Nubivance deploys and manages Rapid7 InsightIDR and MDR for organizations that need detection and response, not another dashboard.
Get coverageDevices and endpoints confirmed
VulnCheck reports that every firmware listed on zbtlink.com's download page embeds rctl and starts it at boot with an init.d script named "skworker." The analysis specifically referenced a Zbtlink AX3000 sample. The affected models identified by VulnCheck are:
- CPE2801
- WE1026-5G-WD
- WE1326
- WE2007
- WE2008-DSIM
- WE2416
- WE3326
- WE5927
- WE5931
- WE5931AC
- WE826-T3-DSIM
- WG108
- WG1602
- WG1608-DSIM
- WG209
- WG2105
- WG2107
- WG259
- WG3526
- Z8102AX-2DSIM
VulnCheck found that these models call the same set of four primary and secondary endpoints:
- zbtctl.epplink[.]net (47.100.190[.]96)
- 47.107.224[.]89
- online-string[.]com (45.32.81[.]152)
- rbdg4nzqadui.wikaba[.]com (43.248.136[.]125)
Zbtlink's response and recommended mitigations
On the Zbtlink firmware downloads page, customers are shown a notice stating that the company "have detected firmware security vulnerabilities affecting selected router firmware releases" and that impacted firmware versions have been "temporarily taken down from download channels." The message says the engineering team is "working intensively to develop and validate secured patched firmware" and promises notification when fixed firmware is available.
The Hacker News has contacted the Chinese router manufacturer for further comment and said it will update the story if it hears back. In the meantime, VulnCheck advises customers to check the process list and scan the file system for indicators such as /usr/sbin/kworker, /usr/lib/librctl.so, /etc/kworker.cfg, and /etc/init.d/skworker, and to block the egress points listed above.
What this means for technologists, procurement leaders, and end users
- Technologists and security teams: VulnCheck's findings tie control of implants to DNS and network path control; teams will need to monitor egress to the four endpoints named above, search devices for the specific files and init script listed, and consider immediate network-level blocks.
- Procurement and enterprise IT leaders: Every firmware image offered on Zbtlink's download page was reported to contain the implant; procurement teams should treat current Zbtlink firmware as compromised until patched firmware is released and validate any replacement firmware from the vendor.
- End users: Zbtlink's public notice advises waiting for security-validated firmware and suggests that customers inspect local device files and processes and block the listed egress points as an interim measure.
VulnCheck's report places the risk concretely: implants that start at boot, phone unprotected to fixed endpoints, and accept root commands or a live root shell without authentication. Zbtlink has removed affected firmware from its download channels and pledged fixes; until patched firmware and validated releases are available, the presence of the rctl implant in all published images leaves devices that run those images vulnerable to remote takeover via the named endpoints.
