CyberNew CyberNew
Threat Intelligence & APT Dark Reading 1 month ago

Chinese Routers Sold Worldwide Contain Backdoors

CN
CyberNew Threat Research Desk
• Original Reporting: Dark Reading
CyberNew Threat Intel Assessment
Assessed Severity: CRITICAL
Impacted Surface
Enterprise Perimeter & Network Defense
Intelligence Sector
Threat Intelligence & APT

Analyst Takeaway

"A Chinese manufacturer has been planting backdoors inside of white-label routers sold in high volume around the globe. Shenzhen Zhibotong Electronics Co. Ltd. (ZBT) sells gobs of routers every year, if public evidence is to be believed. The Shenzhen-based 15-year-old company is the bestselling router manufacturer on Chinese e-commerce giant Alibaba.com, which lists its total annual output at 3.6..."

Recommended Defense & Mitigation

  • Emergency Patching: Prioritize vendor patches and CVE mitigation across internet-facing assets immediately.
  • Perimeter Audit: Inspect perimeter firewall logs and hunt for unauthorized RCE indicators.
Curated & Verified by CyberNew Threat Intelligence Desk Standard Defense Framework (NIST / MITRE ATT&CK)

A Chinese manufacturer has been planting backdoors inside of white-label routers sold in high volume around the globe.

Shenzhen Zhibotong Electronics Co. Ltd. (ZBT) sells gobs of routers every year, if public evidence is to be believed. The Shenzhen-based 15-year-old company is the bestselling router manufacturer on Chinese e-commerce giant Alibaba.com, which lists its total annual output at 3.6 million units. Typically, those units are then sold to customers by companies other than ZBT, in countries like the Philippines, India, Canada, Australia, Germany, Bulgaria, Austria, Russia, and the US. According to its marketing, ZBT has exported its products to more than 50 countries and regions.

On Aug. 6, Jacob Baines, chief technology officer (CTO) at VulnCheck, revealed that ZBT's most updated router firmware contains a root-level backdoor. After a few more weeks of investigating, he discovered that, in fact, ZBT routers have contained a variety of backdoors dating several back years.

Related:Exploited Zimbra Flaw Highlights Shrinking Window to Patch

Backdoors in Chinese Tech

Chinese backdoors in network technologies has always been something of a stereotype, but perhaps never been this blatant.

Source Verification & Original Intelligence

This threat report was reviewed by CyberNew analysts and cross-referenced with primary security disclosures from Dark Reading.

Primary Advisory →