Trend Micro Facebook TrendLabs Twitter Malware Blog RSS Feed You Tube - Trend Micro
Search our blog:

  • Mobile Vulnerabilities

  • Zero-Day Alerts

  • Recent Posts

  • Calendar

    August 2015
    S M T W T F S
    « Jul    
  • Email Subscription

  • About Us

    Routers manufactured by Netcore, a popular brand for networking equipment in China, have a wide-open backdoor that can be fairly easily exploited by attackers. These products are also sold under the Netis brand name outside of China. This backdoor allows cybercriminals to easily run arbitrary code on these routers, rendering it vulnerable as a security device.

    What is this backdoor? Simply put, it is an open UDP port listening at port 53413. This port is accessible from the WAN side of the router. This means that if the router in question has an externally accessible IP address (i.e., almost all residential and SMB users), an attacker from anywhere on the Internet can access this backdoor:

    Figure 1. Netstat output, with web admin and backdoor ports highlighted

    This backdoor is “protected” by a single, hardcoded password located in the router’s firmware. Netcore/Netis routers appear to all have the same password. This “protection” is essentially ineffective, as attackers can easily log into these routers and users cannot modify or disable this backdoor.

    Almost all Netcore/Netis routers appear to have this vulnerability, based on the information we examined. Using ZMap, to scan vulnerable routers, we found more than two million IP addresses with the open UDP port. Almost all of these routers are in China, with much smaller numbers in other countries, including but not limited to South Korea, Taiwan, Israel, and the United States.

    What kinds of commands can an attacker give to a vulnerable router? Aside from logging in, the attacker can upload, download, and run files on the router. This gives the attacker near-complete control of the router. For example, settings can be modified to help carry out man-in-the-middle attacks.

    Here’s another attack that can be easily carried out: the file that contains the user name and password for the router’s normal, web-based administration panel is stored without any encryption. This file can be easily downloaded by the attacker, as seen below:

    Figure 2. Dump of user name and password

    We are well aware of the dangers of vulnerable routers, but this vulnerability is particularly serious because of the ease of exploitation. We have not been able to find any documentation that describes this backdoor, nor any that states its purpose and who wrote it. We have contacted the manufacturer, but Trend Micro has not yet received a response.

    In order to determine if their router is vulnerable, users can use an online port scanner. A probe at port 53413 of a vulnerable router would result in something like this:

    Figure 3. UDP port scan

    Users should pay particular attention to the section that has been underlined in red.

    Users have relatively few solutions available to remedy this issue. Support for Netcore routers by open source firmware like dd-wrt and Tomato is essentially limited; only one router appears to have support at all. Aside from that, the only adequate alternative would be to replace these devices.

    Share this article
    Get the latest on malware protection from TrendLabs
    Email this story to a friend   Technorati   NewsVine   MySpace   Google   Live   StumbleUpon

    • zmap

      Not even near 2,000,000 devices

    • HD Moore

      The /bin/igdmptd is the daemon in question. The password is ‘netcore’. I am working on a Metasploit Framework module for it, but the protocol is a bit annoying. In order to successfully login, I have to send one packet with five Xs, then a second packet with 8 Xs + the “netcore” string. This leads to a “session”, but its not clear what the preamble and packet types are. If anyone gets further along and wants to share or collaborate, please let me know. Since the daemon has builtin support for file upload/download and command execution, it would be nice to take advantage of the protocol as opposed to some crazy echo or wget sequence.

      • hdmi

        please, stfu :)

        • devtrap

          try $help

      • Dr-Hack

        where to ?

    • dklkt

      Hi, it said:

      This “protection” is essentially ineffective, as attackers can easily log into these routers and users cannot modify or disable this backdoor.

      I use ZMap and find many devices which open UDP 53413. When I send some data to it, it responses like ‘Login:’ or ‘Login incorrect! ‘. Because I don’t know how to login, I think it’s still safe to most of person.

      If user can also login to the device, why do not they kill the process or use some other command to close the backdoor?

      • funandgames

        One could easily download the firmware from the vendors site, unpack it, reverse the correct binary and see how to use the login function as well as see the hardcoded password that is supposedly passed to strcmp :)

    • ipetwant

      i think it is not a backdoor. anyone can login the router with the port? i think no. the port i think it is more the router internal testing only. when i test with the router. you can not listen the port by WAN. It means. it is safe. the author is making Big Mistake!!!

      • devconsole

        The port is listening on .. how is that anything internal ?
        It is accessible remotely.. furthermore, the protocol it ‘talks’ seems to be designed by the company, unless I was doing something wrong when i tested it a few days ago…

    • spdr

      apparently, Its not only protected by password, there is another (thin) layer :)

    • intense

      Is it in /bin/igdmptd? Can you please provide a model/revision of the router where the backdoor is confirmed?

      • devttys0

        /bin/igdmptd from WF2419_WF2419D-V1.2.27001.bin does in fact bind to port 53413.

    • mx

      I think it should be ok and fixed soon,like TP-LINK before,a more severe backdoor problem than this.

      • HD Moore

        It is unlikely to ever get fixed, just like the sercomm bugs. Fixing the product and publishing new firmware has an almost negligible uptake rate among customers of broadband routers. Even the VxWorks debugger issue has taken years to drop from 300k exposed to 50k exposed.

        • hdmi

          check out /usr/local/etc
          seems like it can be fixed easy

        • HD Moore

          The vendor could easily fix this, but the chance of most affected users actually applying the update is slim to none. The image I have doesn’t include a /usr/local/etc, is there a configuration file I should be looking for elsewhere?

    • Do-wan Kim

      I check my router that port is open but has no service name. I use wf2411 rev 27001 firmware. Is it also opened backdoor?

      • tim

        I think so. You can also use netcat to verify, like nc -u “YourIP” 53413 and press enter. If it responses something like “Login:”, that’s the backdoor.


    © Copyright 2013 Trend Micro Inc. All rights reserved. Legal Notice