Date: Thu, 13 Aug 2015 10:59:05 +0900
From: Pierre Kim <pierre.kim.sec@...il.com>
To: bugtraq@...urityfocus.com, fulldisclosure <fulldisclosure@...lists.org>
Subject: [FD] Update: Backdoor and RCE found in 8 TOTOLINK router models

Hello,

This is an update to:
  - Backdoor and RCE found in 8 TOTOLINK router models
(http://seclists.org/fulldisclosure/2015/Jul/80 )
  - Backdoor credentials found in 4 TOTOLINK router models
(http://seclists.org/fulldisclosure/2015/Jul/79 )
  - 4 TOTOLINK router models vulnerable to CSRF and XSS attacks
(http://seclists.org/fulldisclosure/2015/Jul/78 )
  - 15 TOTOLINK router models vulnerable to multiple RCEs
(http://seclists.org/fulldisclosure/2015/Jul/77 )

Totolink has released new firmwares on 2015-07-25 and also removed the
old firmwares from their website.

The backdoor is still present in the new firmware images but it is not
launched at the startup anymore.

You can check yourself by downloading the images and by using binwalk:

Example with N300RH-V2:
  $ wget -O 'TOTOLINK%20N300RH-V2.0.1_20150725.zip'
'http://www.totolink.net/include/download.asp?path=down/010500&file=TOTOLINK%20N300RH-V2.0.1_20150725.zip'
  $ 7z x TOTOLINK%20N300RH-V2.0.1_20150725.zip
  [...]
  $ binwalk -e *web
  DECIMAL       HEXADECIMAL     DESCRIPTION
  --------------------------------------------------------------------------------
  16            0x10            bzip2 compressed data, block size = 900k
  309403        0x4B89B         LZMA compressed data, properties:
0x88, dictionary size: 1048576 bytes, uncompressed size: 65535 bytes
  320182        0x4E2B6         LZMA compressed data, properties:
0x5D, dictionary size: 8388608 bytes, uncompressed size: 3414764 bytes
  1274560       0x1372C0        Squashfs filesystem, little endian,
version 4.0, compression:lzma, size: 2251972 bytes,  321 inodes,
blocksize: 131072 bytes, created: Thu May  4 11:47:12 2006
  $ cd _*/
  $ 7z x *squashfs
  Processing archive: 1372C0.squashfs

  Extracting  bin
  Extracting  dev
  [...]
  Everything is Ok
  $ strings bin/skt | grep iptables
  iptables -I INPUT -p tcp --dport 80 -i eth1 -j ACCEPT
  iptables -D INPUT -p tcp --dport 80 -i eth1 -j ACCEPT
  $ tail -n 5 etc/init.d/rcS

  # start web server
  boa
  #skt&

They commented the `skt&` execution in the /etc/init.d/rcS.
The bin/skt backdoor is still there but not activated.
I encourage TOTOLINK users to audit next firmwares to make sure the
backdoor is not reactivated by "error".

There are no security indications in the "Firmware Update Release
Information" ( http://www.totolink.net/sub/news/board_content.asp?b_type=BOARD1&idx=164
) and I don't want to waste my time to check if they patched the other
security holes (RCE, XSS, CSRF ...) described here:
  - https://pierrekim.github.io/blog/2015-07-16-15-TOTOLINK-products-vulnerable-to-multiple-RCEs.html
  - https://pierrekim.github.io/blog/2015-07-16-4-TOTOLINK-products-vulnerable-to-CSRF-and-XSS-attacks.html
  - https://pierrekim.github.io/blog/2015-07-16-backdoor-credentials-found-in-4-TOTOLINK-products.html
  - https://pierrekim.github.io/blog/2015-07-16-backdoor-and-RCE-found-in-8-TOTOLINK-products.html

By the way, Totolink released a statement the 2015-07-30 saying that
there are no backdoors in their routers and threatened to sue medias
regarding "totally irresponsible behavior", stating my research
contains "some unverified information" (From:
http://www.totolink.net/sub/news/board_content.asp?b_type=BOARD1&idx=165
):


     ZIONCOM (HK) Technology Ltd (ZIONCOM, the manufacturer of
TOTOLINK Router), would like to make an official announcement
regarding some inappropriately news report from network media that
were totally irresponsible behavior for reporting some unverified
information to damage our company reputation.

     1. TOTOLINK do not compromise user privacy and security, TOTOLINK
     product has not been installed any monitor software on user
behavior after we verified all of our current inventory in Hong Kong
market so it is impossible to monitor user behavior. ZIONCOM will
reserve the right to take legal action against the media report on the
wrong information broadcasting that may damage our company and product
reputations.

     2. Regarding the problem of a default login password of a TOTOLINK
     router may trigger an invasion from hacker through remote
control, we would like to recommend all users to change the default
password at the first time login.We will make an announcement through
our Global website ( http://www.totolink.net )  for launching new
firmware update program for solving the bug soon.



Note that some firmwares have apparently not been correctly updated.
For example, the "this-is-a-feature-not-a-backdoor-executable" is
still activated in the latest N300RH-V3 firmware router (
http://www.totolink.net/include/download.asp?path=down/010500&file=TOTOLINK%20N300RH-V3.0.0_20150331.zip
, from the N300RH webpage ).
You can check by yourself the "unverified information" by using the
precedent commands: the file /etc/init.d/rcS still contains skt& to
execute the "this-is-a-feature-not-a-backdoor-executable" /bin/skt at
startup):

  $ wget -O TOTOLINK%20N300RH-V3.0.0_20150331.zip
'http://www.totolink.net/include/download.asp?path=down/010500&file=TOTOLINK%20N300RH-V3.0.0_20150331.zip'
  $ sha256sum TOTOLINK%20N300RH-V3.0.0_20150331.zip
  3c12a38dfc8c72733f384ba206e9b21a37614ba77aba7f3433ed1ce9bd40cda4
TOTOLINK%20N300RH-V3.0.0_20150331.zip
  $ 7z x TOTOLINK%20N300RH-V3.0.0_20150331.zip
  [...]
  Everything is Ok
  $ binwalk -e *web
  DECIMAL       HEXADECIMAL     DESCRIPTION
  --------------------------------------------------------------------------------
  16            0x10            bzip2 compressed data, block size = 900k
  307237        0x4B025         LZMA compressed data, properties:
0x88, dictionary size: 1048576 bytes, uncompressed size: 65535 bytes
  317016        0x4D658         LZMA compressed data, properties:
0x5D, dictionary size: 8388608 bytes, uncompressed size: 3666608 bytes
  1337954       0x146A62        Squashfs filesystem, little endian,
version 4.0, compression:lzma, size: 2169904 bytes,  580 inodes,
blocksize: 131072 bytes, created: Wed Feb 10 00:30:40 2038
  $ cd _*/
  $ 7z x *squashfs
  Extracting  bin
  Extracting  dev
  [,,,]
  Everything is Ok
  $ strings bin/skt | grep iptables
  iptables -I INPUT -p tcp --dport 80 -i eth1 -j ACCEPT
  iptables -D INPUT -p tcp --dport 80 -i eth1 -j ACCEPT
  $ tail -n 5 etc/init.d/rcS

  # start web server
  boa
  skt&       <-- backdoor is launched at startup


I leave security researchers, totolink users and medias to use their
own judgment and draw a conclusion about this case.

This email has been blogposted to:
https://pierrekim.github.io/blog/2015-08-13-TOTOLINK-how-to-NOT-handle-security-issues.html

Regards,


-- 
Pierre Kim
pierre.kim.sec@...il.com
@PierreKimSec
https://pierrekim.github.io/

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

Powered by blists - more mailing lists