Routers manufactured by Netcore, a popular brand for networking equipment in China, have a wide-open backdoor that can be fairly easily exploited by attackers. These products are also sold under the Netis brand name outside of China. This backdoor allows cybercriminals to easily run arbitrary code on these routers, rendering it vulnerable as a security device.
What is this backdoor? Simply put, it is an open UDP port listening at port 53413. This port is accessible from the WAN side of the router. This means that if the router in question has an externally accessible IP address (i.e., almost all residential and SMB users), an attacker from anywhere on the Internet can access this backdoor:
Figure 1. Netstat output, with web admin and backdoor ports highlighted
This backdoor is “protected” by a single, hardcoded password located in the router’s firmware. Netcore/Netis routers appear to all have the same password. This “protection” is essentially ineffective, as attackers can easily log into these routers and users cannot modify or disable this backdoor.
Almost all Netcore/Netis routers appear to have this vulnerability, based on the information we examined. Using ZMap, to scan vulnerable routers, we found more than two million IP addresses with the open UDP port. Almost all of these routers are in China, with much smaller numbers in other countries, including but not limited to South Korea, Taiwan, Israel, and the United States.
What kinds of commands can an attacker give to a vulnerable router? Aside from logging in, the attacker can upload, download, and run files on the router. This gives the attacker near-complete control of the router. For example, settings can be modified to help carry out man-in-the-middle attacks.
Here’s another attack that can be easily carried out: the file that contains the user name and password for the router’s normal, web-based administration panel is stored without any encryption. This file can be easily downloaded by the attacker, as seen below:
Figure 2. Dump of user name and password
We are well aware of the dangers of vulnerable routers, but this vulnerability is particularly serious because of the ease of exploitation. We have not been able to find any documentation that describes this backdoor, nor any that states its purpose and who wrote it. We have contacted the manufacturer, but Trend Micro has not yet received a response.
In order to determine if their router is vulnerable, users can use an online port scanner. A probe at port 53413 of a vulnerable router would result in something like this:
Figure 3. UDP port scan
Users should pay particular attention to the section that has been underlined in red.
Users have relatively few solutions available to remedy this issue. Support for Netcore routers by open source firmware like dd-wrt and Tomato is essentially limited; only one router appears to have support at all. Aside from that, the only adequate alternative would be to replace these devices.
