Home / vulnerabilities TOTOLink Backdoor Persistence
Posted on 13 August 2015
Source : packetstormsecurity.org Link
Hello,
This is an update to:
- Backdoor and RCE found in 8 TOTOLINK router models
(http://seclists.org/fulldisclosure/2015/Jul/80 )
- Backdoor credentials found in 4 TOTOLINK router models
(http://seclists.org/fulldisclosure/2015/Jul/79 )
- 4 TOTOLINK router models vulnerable to CSRF and XSS attacks
(http://seclists.org/fulldisclosure/2015/Jul/78 )
- 15 TOTOLINK router models vulnerable to multiple RCEs
(http://seclists.org/fulldisclosure/2015/Jul/77 )
Totolink has released new firmwares on 2015-07-25 and also removed the
old firmwares from their website.
The backdoor is still present in the new firmware images but it is not
launched at the startup anymore.
You can check yourself by downloading the images and by using binwalk:
Example with N300RH-V2:
$ wget -O 'TOTOLINK%20N300RH-V2.0.1_20150725.zip'
'http://www.totolink.net/include/download.asp?path=down/010500&file=TOTOLINK%20N300RH-V2.0.1_20150725.zip'
$ 7z x TOTOLINK%20N300RH-V2.0.1_20150725.zip
[...]
$ binwalk -e *web
DECIMAL HEXADECIMAL DESCRIPTION
--------------------------------------------------------------------------------
16 0x10 bzip2 compressed data, block size = 900k
309403 0x4B89B LZMA compressed data, properties:
0x88, dictionary size: 1048576 bytes, uncompressed size: 65535 bytes
320182 0x4E2B6 LZMA compressed data, properties:
0x5D, dictionary size: 8388608 bytes, uncompressed size: 3414764 bytes
1274560 0x1372C0 Squashfs filesystem, little endian,
version 4.0, compression:lzma, size: 2251972 bytes, 321 inodes,
blocksize: 131072 bytes, created: Thu May 4 11:47:12 2006
$ cd _*/
$ 7z x *squashfs
Processing archive: 1372C0.squashfs
Extracting bin
Extracting dev
[...]
Everything is Ok
$ strings bin/skt | grep iptables
iptables -I INPUT -p tcp --dport 80 -i eth1 -j ACCEPT
iptables -D INPUT -p tcp --dport 80 -i eth1 -j ACCEPT
$ tail -n 5 etc/init.d/rcS
# start web server
boa
#skt&
They commented the `skt&` execution in the /etc/init.d/rcS.
The bin/skt backdoor is still there but not activated.
I encourage TOTOLINK users to audit next firmwares to make sure the
backdoor is not reactivated by "error".
There are no security indications in the "Firmware Update Release
Information" ( http://www.totolink.net/sub/news/board_content.asp?b_type=BOARD1&idx=164
) and I don't want to waste my time to check if they patched the other
security holes (RCE, XSS, CSRF ...) described here:
- https://pierrekim.github.io/blog/2015-07-16-15-TOTOLINK-products-vulnerable-to-multiple-RCEs.html
- https://pierrekim.github.io/blog/2015-07-16-4-TOTOLINK-products-vulnerable-to-CSRF-and-XSS-attacks.html
- https://pierrekim.github.io/blog/2015-07-16-backdoor-credentials-found-in-4-TOTOLINK-products.html
- https://pierrekim.github.io/blog/2015-07-16-backdoor-and-RCE-found-in-8-TOTOLINK-products.html
By the way, Totolink released a statement the 2015-07-30 saying that
there are no backdoors in their routers and threatened to sue medias
regarding "totally irresponsible behavior", stating my research
contains "some unverified information" (From:
http://www.totolink.net/sub/news/board_content.asp?b_type=BOARD1&idx=165
):
ZIONCOM (HK) Technology Ltd (ZIONCOM, the manufacturer of
TOTOLINK Router), would like to make an official announcement
regarding some inappropriately news report from network media that
were totally irresponsible behavior for reporting some unverified
information to damage our company reputation.
1. TOTOLINK do not compromise user privacy and security, TOTOLINK
product has not been installed any monitor software on user
behavior after we verified all of our current inventory in Hong Kong
market so it is impossible to monitor user behavior. ZIONCOM will
reserve the right to take legal action against the media report on the
wrong information broadcasting that may damage our company and product
reputations.
2. Regarding the problem of a default login password of a TOTOLINK
router may trigger an invasion from hacker through remote
control, we would like to recommend all users to change the default
password at the first time login.We will make an announcement through
our Global website ( http://www.totolink.net ) for launching new
firmware update program for solving the bug soon.
Note that some firmwares have apparently not been correctly updated.
For example, the "this-is-a-feature-not-a-backdoor-executable" is
still activated in the latest N300RH-V3 firmware router (
http://www.totolink.net/include/download.asp?path=down/010500&file=TOTOLINK%20N300RH-V3.0.0_20150331.zip
, from the N300RH webpage ).
You can check by yourself the "unverified information" by using the
precedent commands: the file /etc/init.d/rcS still contains skt& to
execute the "this-is-a-feature-not-a-backdoor-executable" /bin/skt at
startup):
$ wget -O TOTOLINK%20N300RH-V3.0.0_20150331.zip
'http://www.totolink.net/include/download.asp?path=down/010500&file=TOTOLINK%20N300RH-V3.0.0_20150331.zip'
$ sha256sum TOTOLINK%20N300RH-V3.0.0_20150331.zip
3c12a38dfc8c72733f384ba206e9b21a37614ba77aba7f3433ed1ce9bd40cda4
TOTOLINK%20N300RH-V3.0.0_20150331.zip
$ 7z x TOTOLINK%20N300RH-V3.0.0_20150331.zip
[...]
Everything is Ok
$ binwalk -e *web
DECIMAL HEXADECIMAL DESCRIPTION
--------------------------------------------------------------------------------
16 0x10 bzip2 compressed data, block size = 900k
307237 0x4B025 LZMA compressed data, properties:
0x88, dictionary size: 1048576 bytes, uncompressed size: 65535 bytes
317016 0x4D658 LZMA compressed data, properties:
0x5D, dictionary size: 8388608 bytes, uncompressed size: 3666608 bytes
1337954 0x146A62 Squashfs filesystem, little endian,
version 4.0, compression:lzma, size: 2169904 bytes, 580 inodes,
blocksize: 131072 bytes, created: Wed Feb 10 00:30:40 2038
$ cd _*/
$ 7z x *squashfs
Extracting bin
Extracting dev
[,,,]
Everything is Ok
$ strings bin/skt | grep iptables
iptables -I INPUT -p tcp --dport 80 -i eth1 -j ACCEPT
iptables -D INPUT -p tcp --dport 80 -i eth1 -j ACCEPT
$ tail -n 5 etc/init.d/rcS
# start web server
boa
skt& <-- backdoor is launched at startup
I leave security researchers, totolink users and medias to use their
own judgment and draw a conclusion about this case.
This email has been blogposted to:
https://pierrekim.github.io/blog/2015-08-13-TOTOLINK-how-to-NOT-handle-security-issues.html
Regards,
--
Pierre Kim
pierre.kim.sec@gmail.com
@PierreKimSec
https://pierrekim.github.io/
