I have a ZTE router model ZXHN H198A.
Recently, upon connecting to it with Telnet (with some default username-password, of course), I decided to go around the filesystem. Then I noticed that they have a Dropbear SSH server installed in
/etc/dropbear. Upon further inspection I saw that an
authorized_keys file exists.
The file content is:
ssh-dss AAAAB3NzaC1kc3MAAACBAJa07l9167yfS6MyvmU9KLFCcazA81w1046fsy6wDpuOPsxdhy3S57ScJI4PaJKUBe9n3JMnhoixFHgxvBC6aEDuxCv/5uBZUaJmLNTItVxtdf53tW+RF+t+JrDt8NbBSXK0CANLSa1TNW8QBqjGOkYpwjgLcWxqJAd0JMKkxe57AAAAFQCUjTtXIlXxcM5Dm0janESDSGxrBQAAAIAYz8yZgJJPUhQR6uVQDBWHtqI/92xnRV4zWx+RFf2qF3+YVnbew9NIOCb8PzweeC2Gij3QytMFvJchkqKB1BDJiN9y/GxbgZb73DZnM6brlb6ZCb8m/xEmVqK6HX/PJlbwj7uHdzqaBERsvc6CJrZlQVfh0H5ymIDJbfyZeE4CfwAAAIA3aX33tPW0rxpXxX2LYSXHVGzh1UPYkjf5WWF6nWaxK4JwZdSxRorj+uRTMXrx0otPs2DzQx370KlUvfwXQdD+PEKsXlYSxx/KwZ4QzS3PYierbWbPOzVVxmSSaBEh2MFkZ+L5GMnkTL3foWDN0HDjtPvjNhwLHEkL6+HslXM2Ug== email@example.com
ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAIEA3R0au/8rJR9Kr7WZkCzG8Dne7Hf5VpOt7UYUxtytbyUJlAq+FrUZBP1mAxYgdwSBKQbkTcnTodj6RuHQ777d1aCdODvcOI6ntqbHRAQ0LLpIAlg5C4R6JlNmCNA3XUl2oht/40d7xbdUsRIsFMnaARAYa8SSmB1irCstEG8g10k= firstname.lastname@example.org
If you look closely, you can see that the user is
email@example.com in both public keys. This file was last modified when the firmware was installed, comparing it to other files.
By the Chinese name, and seeing at least one more record of this public key online - I came to the conclusion this seems like a backdoor used by ZTE developers which allows them to connect with SSH to any router they wish.
By the way, upon further testing, the router is actually accessible from the internet (with SSH and Telnet).
What do you think is going on here?
Anyway, I tried to remove it but it seems that the filesystem was mounted as read-only fs. How can I remount it?