BT Adds Backdoor access to Latest Home Hub firmware.

[PsiDOC]

BT Has added an open port and firewall rule that allows anyone with the correct rsa keyfile full access to the BT HomeHub settings and possibly more.

Affected Hardware : BT Home Hub Version 2.0a
Affected Firmware : 8.1.H.J

During my recent exploits unlocking the latest Home Hub 2.0A firmware - Version 8.1.H.J - I have some very worrying issues.

This line has been added to the firewall:

rule add chain=forward_custom name=BTAgent srcintf=wan dstintf=lan dstip=192.168.1.253 serv=BTAgent_dst state=enabled action=accept

What this line says is to accept all traffic from a port tagged "BTAgent_dst" and pass it from the WAN (internet) to network IP address 192.168.1.253, which is the secondary address of the router.
The port tag "BTAgent_dst" can be found in the expr.def file and is:

add name=BTAgent_dst type=serv proto=udp dstport=snmp

The UDP SNMP port is port 162.

Was this left there by accident? I think not. Please read on

Also in the firmware some extra files and directories have been added. These are a BTAgent executable, it' start script (btagentstart.sh), libtransport ,libplugins a secure key file for authentication and a few more bits and bobs. I am no linux expert so I have uploaded them here for those that know more than me can have a look and comment. I have however removed the rsa keyfile for security reasons.
What does worry me about this is the fact that the btagentstart.sh contains reference to a read / write directory what is that needed for? To upload plugins?

To summarise:
BT Have put a backdoor into firmware 8.1.H.J This port is permanently open and cannot be closed by the router user.
BT Are running extra files on the router called BTAgent which obviously recieves traffic from the backdoor above.
BT can access any router with this firmware version at any time through the above!
No one was any the wiser about this as BT kept it hidden from view.

I have queried this backdoor with BT on their community forum.
They admitted to it being there on the 1st post of this page and yet deny it's existance on the last post at the bottom. Then they locked the thread soon after. That being very suspect in itself.