China's Zbtlink suspends sales of routers found to contain backdoor

Chinese router maker Zbtlink Electronics has suspended sales of routers containing a backdoor, dubbed "Endlessdoors," and is developing updates to address the security issue.

Chinese router maker Zbtlink Electronics said on ​Thursday it was suspending sales of routers ​found to contain a backdoor and ‌pulling the ​affected software from its website while it developed updates to address the issue. Cybersecurity firm VulnCheck identified a backdoor in at least 20 models ‌of routers made by Shenzhen-based Zbtlink Electronics, as Reuters first reported on Wednesday. Zbtlink said in a statement on its website that it was aware of the research, which found the flaw could allow access and control ‌of the device and potentially other devices on the network.

The backdoor discovered by VulnCheck CTO Jacob ‌Baines and dubbed “Endlessdoors” serves “solely as an after-sales technical support tool,” the company said, adding that it was intended to assist customers with device troubleshooting and configuration “only upon their explicit request and authorization.” The tool “has never been used for unauthorized access,” the company ⁠said.

Revelations about ​the backdoor landed amid ⁠growing Western concerns about cybersecurity and risks posed by Chinese-made networking equipment. The Canadian government on Wednesday issued a security advisory related ⁠to the routers' vulnerability. The backdoor automatically connected to a specific IP address and Chinese-registered domain every 35 seconds, and ​whoever controlled those domains or hijacked them could have taken control of the router and potentially ⁠used it to access other devices on the same network, Baines said in an analysis. “Routers deployed around the globe are still ⁠vulnerable ​to hostile takeover via the backdoor,” Baines told Reuters on Thursday. The only mitigation for router users is to remove them from their networks and monitor for any signs of compromise, Baines said. Baines ⁠added that the company’s explanation does not address why the tool used a name that was difficult ⁠to identify unless you were ⁠looking for it, and why the company chose to implement it in an insecure way that was vulnerable to hijack.

Zbtlink did not immediately respond ‌to a request ‌for comment on Thursday.