Backdoor.

What is a backdoor?

A backdoor is an undocumented way of getting into a computer system. NIST says plainly that a backdoor is a potential security risk. The reason is simple. If a way in is not documented, the people who run the system may not know it exists, so they may not watch it or close it.

NIST also uses the word for a specific kind of malicious program. In one of its publications, a backdoor is a malicious program that listens for commands on a certain Transmission Control Protocol (TCP) or User Datagram Protocol (UDP) port. A port is a numbered channel that a computer uses to send and receive network traffic.

How does a backdoor work?

A backdoor gives someone a path into a system that does not use the normal login. A program of this kind can sit on a machine and wait. When the attacker sends a command to the port it is listening on, the program acts on it.

Web shells are one example that MITRE ATT&CK describes. MITRE says a web shell is a web script placed on an openly accessible web server so that an adversary can use the server as a gateway into a network. MITRE lists this technique under the persistence tactic, which means keeping access over time.

Why does it matter?

A backdoor gives an attacker a way back in that does not depend on the first break-in. NIST describes the risk in general terms: an undocumented way in is a potential security risk. If defenders fix only the first problem they find, a separate backdoor can remain. For this reason, an investigation often needs to look for more than one way in.

How can you detect or reduce backdoors?

NIST describes a backdoor as a program that listens on a port. That gives defenders a place to look. Reviewing which services listen for connections, and asking whether each one is expected, can show something that should not be there. In general terms, the same idea applies to web servers. Scripts on a public web server that nobody can explain deserve a closer look.

• Know which ports and services should be open on each system.
• Question any listener that nobody can explain.
• Review the files on public web servers, since MITRE describes web shells as scripts placed on openly accessible web servers.
• When you respond to an intrusion, look for additional ways in, not only the first one.

Is a backdoor the same as a Trojan?

No. A Trojan is a program that appears useful but hides a malicious function. A backdoor is about the access it gives. A Trojan can be one way that a backdoor ends up on a system, but the two words describe different things. One describes how the program disguises itself. The other describes the way in.

Is a backdoor the same as a web shell?

Not exactly. A web shell is a specific kind of script that sits on a web server. A backdoor is the wider idea of any undocumented or hidden way in. A web shell can act as a backdoor, but a backdoor does not have to be a web shell.

Related terms

See also persistence, command and control, and remote access trojan.

Related pages in the Knowledge Hub

• China Chopper

Sources

• NIST: NIST defines a backdoor as an undocumented way of gaining access to a computer system and a potential security risk, and as a malicious program that listens for….
• MITRE ATT&CK: MITRE describes a web shell as a web script placed on an openly accessible web server to give an adversary a gateway into a network, under the persistence tactic.