Researchers found a backdoor implant that gives servers in China full control over the routers.<\/p>\n
Routers made by the Chinese company Zbtlink are shipped with a built-in backdoor, according to a new report from cybersecurity firm VulnCheck.<\/p>\n
VulnCheck examined 20 models made by Zbtlink and found an implant on each one\u2019s firmware that automatically communicates with cloud servers in China. The backdoor could give the company access to other devices connected to the router\u2019s network, says Jacob Baines, the chief technology officer at VulnCheck.\u00a0<\/p>\n
\u201cWhen you take your router and you plug it into your network, it tries to reach out to a server in China that can then fully control that router,\u201d Baines said.\u00a0<\/p>\n
The discovery is as close to a smoking gun as we\u2019ve seen for an argument that many cybersecurity experts and lawmakers have been making for years: Routers from China can\u2019t be trusted.<\/p>\n
It\u2019s a fear of implants like this that led the state of Texas to sue TP-Link, a router manufacturer founded in China but now headquartered in California, alleging in a February lawsuit that its routers are used by the Chinese government to launch cyberattacks in the US.\u00a0<\/p>\n
It\u2019s also why the Federal Communications Commission instituted a blanket ban on the sale of new foreign-made routers in March, although it\u2019s since granted exemptions to several non-Chinese manufacturers. But nothing like Zbtlink\u2019s backdoor has ever been found in TP-Link\u2019s routers.\u00a0<\/p>\n
\u201cWhat makes this different \u2013 and I\u2019ve never really seen it \u2013 is that this is just an implant. It just connects out. You don\u2019t have to make the mistake of exposing it to the internet,\u201d Baines said.\u00a0<\/p>\n
Zbtlink routers are sold around the world \u200bunder both the Zbtlink and Wiflyer brand names, including on platforms like Amazon. They\u2019re primarily used in businesses rather than home networks, Baines said. He estimates that 100,000 are currently deployed around the world, but he wrote in his report that \u201cthe true affected population might be larger than the twenty models we examined.\u201d<\/p>\n
Baines tells me that it\u2019s common for Chinese routers to be white-labeled, or rebranded to look like they\u2019re from somewhere else.<\/p>\n
\u201cThey look like they\u2019re from South Korea or Germany, but really they were made in China by this one company,\u201d he said. \u201cAnd they could be using that firmware. We just don\u2019t know.\u201d<\/p>\n
Zbtlink didn\u2019t immediately respond to CNET\u2019s request for comment.<\/p>\n