A slice of Kimchi - IT Security Blog

This post is an an update to:

• Backdoor and RCE found in 8 TOTOLINK router models
• Backdoor credentials found in 4 TOTOLINK router models
• 4 TOTOLINK router models vulnerable to CSRF and XSS attacks
• 15 TOTOLINK router models vulnerable to multiple RCEs

Totolink has released new firmwares on 2015-07-25 and also removed the old firmwares from their website.

The backdoor is still present in the new firmware images but it is not launched at the startup anymore.

You can check yourself by downloading the images and by using binwalk:

Example with N300RH-V2:

$ wget -O 'TOTOLINK%20N300RH-V2.0.1_20150725.zip' 'http://www.totolink.net/include/download.asp?path=down/010500&file=TOTOLINK%20N300RH-V2.0.1_20150725.zip'
$ 7z x TOTOLINK%20N300RH-V2.0.1_20150725.zip
[...]
$ binwalk -e *web
DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
16            0x10            bzip2 compressed data, block size = 900k
309403        0x4B89B         LZMA compressed data, properties: 0x88, dictionary size: 1048576 bytes, uncompressed size: 65535 bytes
320182        0x4E2B6         LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: 3414764 bytes
1274560       0x1372C0        Squashfs filesystem, little endian, version 4.0, compression:lzma, size: 2251972 bytes,  321 inodes, blocksize: 131072 bytes, created: Thu May  4 11:47:12 2006
$ cd _*/
$ 7z x *squashfs
Processing archive: 1372C0.squashfs

Extracting  bin
Extracting  dev
[...]
Everything is Ok
$ strings bin/skt | grep iptables
iptables -I INPUT -p tcp --dport 80 -i eth1 -j ACCEPT
iptables -D INPUT -p tcp --dport 80 -i eth1 -j ACCEPT
$ tail -n 5 etc/init.d/rcS

# start web server
boa
#skt&

They commented the skt& execution in the /etc/init.d/rcS. The bin/skt backdoor is still there but not activated. I encourage TOTOLINK users to audit next firmwares to make sure the backdoor is not reactivated by "error".

There are no security indications in the "Firmware Update Release Information" and I don't want to waste my time to check if they patched the other security holes (RCE, XSS, CSRF ...) described here:

• https://pierrekim.github.io/blog/2015-07-16-15-TOTOLINK-products-vulnerable-to-multiple-RCEs.html
• https://pierrekim.github.io/blog/2015-07-16-4-TOTOLINK-products-vulnerable-to-CSRF-and-XSS-attacks.html
• https://pierrekim.github.io/blog/2015-07-16-backdoor-credentials-found-in-4-TOTOLINK-products.html
• https://pierrekim.github.io/blog/2015-07-16-backdoor-and-RCE-found-in-8-TOTOLINK-products.html

Totolink statement

By the way, Totolink released a statement the 2015-07-30 saying that there are no backdoors in their routers and threatened to sue medias regarding "totally irresponsible behavior", stating my research contains "some unverified information":

 ZIONCOM (HK) Technology Ltd (ZIONCOM, the manufacturer of TOTOLINK Router), would like to make an
 official announcement regarding some inappropriately news report from network media that were totally
 irresponsible behavior for reporting some unverified information to damage our company reputation.

 1. TOTOLINK do not compromise user privacy and security, TOTOLINK
 product has not been installed any monitor software on user behavior after we verified all of our
 current inventory in Hong Kong market so it is impossible to monitor user behavior. ZIONCOM will
 reserve the right to take legal action against the media report on the wrong information broadcasting
 that may damage our company and product reputations.

 2. Regarding the problem of a default login password of a TOTOLINK
 router may trigger an invasion from hacker through remote control, we would like to recommend all users
 to change the default password at the first time login.We will make an announcement through our Global
 website ( http://www.totolink.net )  for launching new firmware update program for solving the bug soon.

Note that some firmwares have apparently not been correctly updated.

For example, the "this-is-a-feature-not-a-backdoor-executable" is still activated in the latest N300RH-V3 firmware router (from the N300RH webpage).

You can check by yourself the "unverified information" by using the precedent commands: the file /etc/init.d/rcS still contains skt& to execute the "this-is-a-feature-not-a-backdoor-executable" /bin/skt at startup):

$ wget -O TOTOLINK%20N300RH-V3.0.0_20150331.zip 'http://www.totolink.net/include/download.asp?path=down/010500&file=TOTOLINK%20N300RH-V3.0.0_20150331.zip'
$ sha256sum TOTOLINK%20N300RH-V3.0.0_20150331.zip 
3c12a38dfc8c72733f384ba206e9b21a37614ba77aba7f3433ed1ce9bd40cda4  TOTOLINK%20N300RH-V3.0.0_20150331.zip
$ 7z x TOTOLINK%20N300RH-V3.0.0_20150331.zip
[...]
Everything is Ok
$ binwalk -e *web
DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
16            0x10            bzip2 compressed data, block size = 900k
307237        0x4B025         LZMA compressed data, properties: 0x88, dictionary size: 1048576 bytes, uncompressed size: 65535 bytes
317016        0x4D658         LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: 3666608 bytes
1337954       0x146A62        Squashfs filesystem, little endian, version 4.0, compression:lzma, size: 2169904 bytes,  580 inodes, blocksize: 131072 bytes, created: Wed Feb 10 00:30:40 2038
$ cd _*/
$ 7z x *squashfs
Extracting  bin
Extracting  dev
[...]
Everything is Ok
$ strings bin/skt | grep iptables
iptables -I INPUT -p tcp --dport 80 -i eth1 -j ACCEPT
iptables -D INPUT -p tcp --dport 80 -i eth1 -j ACCEPT
$ tail -n 5 etc/init.d/rcS

# start web server
boa
skt&                                                  <-- backdoor is launched at startup

I leave security researchers, totolink users and medias to use their own judgment and draw a conclusion about this case.

Regards,