Is Your Router Spying on You?

on


The Back Door You Didn't Know You Bought

A Chinese router discovery should be a wake-up call about everything we connect to the internet

Most people buy a router, plug it in and forget about it.

Few would imagine that hidden inside the box could be a pathway allowing someone outside the home to gain master control of the router.

That is why the recent discovery involving Chinese manufacturer Zbtlink deserves attention.

Security researchers at VulnCheck found a remote-control system they named ENDLESSDOORS embedded in firmware for at least 20 Zbtlink router models.

The software starts when the router starts, contacts outside servers and can accept commands with the router's highest level of authority. Researchers demonstrated the capability by taking control of a test router through the mechanism.

On August 5, Canada's Canadian Centre for Cyber Security issued an advisory identifying affected Zbtlink models and firmware versions.

THE BACK DOOR IS REAL

What has not been proven is that the Chinese government operated it, that every affected router was accessed, or that information was stolen from users.

Zbtlink says the system was intended as a technical-support tool and was never used for unauthorized access.

But that raises an obvious question:

Why would a customer-support tool start automatically and provide powerful remote access without the owner clearly knowing it was there?

THE NAME ON THE BOX MAY NOT TELL THE WHOLE STORY

This is where the story becomes especially important for consumers.

Looking for the word Zbtlink is not enough.

Zbtlink manufactures equipment sold under other names through OEM and private-label arrangements.

VulnCheck warns consumers to identify routers by model number rather than logo.

Names associated with this equipment include:

  • Zbtlink
  • ZBT
  • ZBTWiFi
  • Wiflyer
  • Some unbranded cellular routers

One confirmed example is the Wiflyer WG3526, which VulnCheck identifies as affected Zbtlink hardware sold under another name.

The brand on the front may not tell you who actually manufactured what is inside.

WHAT SHOULD CONSUMERS LOOK FOR?

Check the label on the bottom or back of the router.

Look for:

  • Brand
  • Manufacturer
  • Model number
  • Hardware version
  • Firmware version

Affected model families identified by Canada's Cyber Centre include:

CPE2801, WE1026-5G-WD, WE1326, WE2007, WE2008-DSIM, WE2416, WE3326, WE5927, WE5931, WE5931AC, WE826-T3-DSIM, WG108, WG1602, WG1608-DSIM, WG209, WG2105, WG2107, WG259, WG3526 and ZBT-Z8102AX-2SIM.

The firmware version also matters, so finding one of these model numbers does not automatically mean a particular router is compromised.

But it is reason to investigate further.

WHAT COULD SOMEONE DO WITH CONTROL OF YOUR ROUTER?

A router sits between almost everything in your home and the internet.

That may include computers, phones, security cameras, printers, smart televisions, home automation systems and even business equipment.

Someone with full control of the router could potentially:

  • Monitor network activity
  • Redirect communications
  • Alter router settings
  • Probe connected devices for weaknesses
  • Use your internet connection for other activity

That does not mean an attacker automatically gets every banking password or can instantly read properly encrypted internet traffic.

The greater danger is that control of the router places an attacker in an ideal position to search for the weakest device connected to your network.

The old security camera or forgotten printer may be easier to compromise than your computer.

NOW THINK ABOUT THE CAR IN YOUR DRIVEWAY

The Zbtlink discovery does not prove that Chinese electric cars are being used as spy devices.

But it demonstrates why the question should be taken seriously.

Modern vehicles are increasingly computers on wheels.

They may contain:

  • Cellular connections
  • Bluetooth
  • Wi-Fi
  • GPS
  • Cameras
  • Microphones
  • Telematics systems
  • Navigation history
  • Connected phones

Transport Canada acknowledges that connected vehicles create cybersecurity and privacy risks because increased connectivity creates more potential access points.

The United States has gone further, restricting certain connected-vehicle hardware and software associated with China and Russia because of concerns about sensitive information and possible remote manipulation of vehicles.

That does not prove a particular Chinese vehicle is spying.

It does prove governments recognize that who builds the hardware and writes the software matters.

IT IS NOT JUST CARS

The same principle applies to:

  • Security cameras
  • Video doorbells
  • Baby monitors
  • Smart televisions
  • Thermostats
  • Solar controllers
  • Battery-storage systems
  • Printers
  • Cellular hotspots
  • Vehicle chargers
  • Industrial equipment
  • Connected automobiles

A security camera is no longer simply a camera. It may contain a microphone, processor, memory, Wi-Fi connection and software communicating with distant servers.

A car is no longer simply transportation.

A router is no longer simply a box with flashing lights.

They are computers — and computers can communicate.

THE QUESTION WE SHOULD ASK BEFORE BUYING

Consumers usually compare price, features and reviews.

Perhaps another question belongs on the list:

WHO ACTUALLY MADE THIS THING — AND WHO CAN TALK TO IT AFTER I BRING IT HOME?

Before buying connected equipment, ask:

  • Who actually manufactured it?
  • Is it being sold under another brand name?
  • Does the company provide security updates?
  • Can remote access be disabled?
  • What information does it collect?
  • Where does that information go?
  • Has the model appeared in a government cybersecurity advisory?

You do not need to become a computer expert.

Connectivity creates access — and access requires trust.

THE REAL LESSON

ENDLESSDOORS does not prove every Chinese electronic product is a surveillance device.

It does prove something important.

Consumers bought routers containing a powerful remote-access capability they probably did not know existed.

Some were sold under different brand names.

Researchers discovered it only because they examined the firmware.

Canada subsequently issued a cybersecurity warning.

That should change the question we ask about connected products.

Not simply:

Does it work?

But:

What else can it do — and who else might be able to make it do it?

Because the next hidden doorway may not be beside your computer.

It could be hanging over your front door, sitting on your desk — or parked in your driveway.

SOURCES & FURTHER READING

Canadian Centre for Cyber Security — Zbtlink Security Advisory AV26-779

VulnCheck — ENDLESSDOORS Research

Transport Canada — Vehicle Cyber Security Strategy

U.S. Bureau of Industry and Security — Connected Vehicle Supply Chain Security

Comments

Post a Comment

Pending moderation, your comment will be published. Thank You