2

I have a ZTE router model ZXHN H198A.

Recently, upon connecting to it with Telnet (with some default username-password, of course), I decided to go around the filesystem. Then I noticed that they have a Dropbear SSH server installed in /etc/dropbear. Upon further inspection I saw that an authorized_keys file exists.

The file content is:

ssh-dss AAAAB3NzaC1kc3MAAACBAJa07l9167yfS6MyvmU9KLFCcazA81w1046fsy6wDpuOPsxdhy3S57ScJI4PaJKUBe9n3JMnhoixFHgxvBC6aEDuxCv/5uBZUaJmLNTItVxtdf53tW+RF+t+JrDt8NbBSXK0CANLSa1TNW8QBqjGOkYpwjgLcWxqJAd0JMKkxe57AAAAFQCUjTtXIlXxcM5Dm0janESDSGxrBQAAAIAYz8yZgJJPUhQR6uVQDBWHtqI/92xnRV4zWx+RFf2qF3+YVnbew9NIOCb8PzweeC2Gij3QytMFvJchkqKB1BDJiN9y/GxbgZb73DZnM6brlb6ZCb8m/xEmVqK6HX/PJlbwj7uHdzqaBERsvc6CJrZlQVfh0H5ymIDJbfyZeE4CfwAAAIA3aX33tPW0rxpXxX2LYSXHVGzh1UPYkjf5WWF6nWaxK4JwZdSxRorj+uRTMXrx0otPs2DzQx370KlUvfwXQdD+PEKsXlYSxx/KwZ4QzS3PYierbWbPOzVVxmSSaBEh2MFkZ+L5GMnkTL3foWDN0HDjtPvjNhwLHEkL6+HslXM2Ug== xiekun@localhost.localdomain

ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAIEA3R0au/8rJR9Kr7WZkCzG8Dne7Hf5VpOt7UYUxtytbyUJlAq+FrUZBP1mAxYgdwSBKQbkTcnTodj6RuHQ777d1aCdODvcOI6ntqbHRAQ0LLpIAlg5C4R6JlNmCNA3XUl2oht/40d7xbdUsRIsFMnaARAYa8SSmB1irCstEG8g10k= xiekun@localhost.localdomain

If you look closely, you can see that the user is xiekun@localhost.localdomain in both public keys. This file was last modified when the firmware was installed, comparing it to other files.

By the Chinese name, and seeing at least one more record of this public key online - I came to the conclusion this seems like a backdoor used by ZTE developers which allows them to connect with SSH to any router they wish.

By the way, upon further testing, the router is actually accessible from the internet (with SSH and Telnet).

What do you think is going on here?

Anyway, I tried to remove it but it seems that the filesystem was mounted as read-only fs. How can I remount it?

1

It is likely that there is a backdoor for the devs/support (ZTE) to connect to [of course we would all like if they would stop doing this...]. As for being open to the internet that is the fault of your ISP. They can and should lock down the device itself so that the telnet, http, https, and ssh logins are only accessible from the ISP's CPE management VLAN. It is however sadly common for ISP's to poorly harden their CPE (customer premises equipment).

Vendor backdoors for residential routers is not a new thing: https://w00tsec.blogspot.com/2015/11/arris-cable-modem-has-backdoor-in.html

Specifically for ZTE it is not a new thing: https://github.com/stasinopoulos/ZTExploit/blob/master/ZTExploit_Source/ztexploit.py

Since you have access you could harden the device yourself. But this may lock your ISP out from doing updates/troubleshooting (but they probably aren't doing updates anyway).

  • 1
    I can't find any reason ZTE will need backdoor access to any device after it left production. ISP - sure (and they should be able to acess it internally and not from the internet), but ZTE? This public key is very likely from ZTE and not my ISP (as I said, it was also posted in other places online). – Terrance Jun 5 at 18:59
  • Not sure if I agree fully on the "fault of your ISP" statement. If the ISP doesn't have a policy restricting the hosting of servers by the end user, I personally would be upset if they prevented access to services I may wish to host. Additionally, it is often the CPE manufacturers who do not provide the features necessary to allow the ISP (or often even the end user) to secure their device properly. – YLearn Jun 5 at 19:10
  • @Terrance I never said the key was from the ISP. – DarkMatter Jun 5 at 19:16
  • @YLearn I'm not saying restricting specific ports writ large but locking down the device itself so that the telnet, http, https, and ssh logins are only accessible from the ISP's CPE management VLAN. – DarkMatter Jun 5 at 19:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.