Backdoor.

What Is a Backdoor?

A backdoor is an undocumented way of getting into a computer system. NIST says plainly that a backdoor is a potential security risk. The reason is simple. If a way in is not documented, the people who run the system may not know it exists, so they may not watch it or close it.

NIST also uses the word for a specific kind of malicious program. In one of its publications, a backdoor is a malicious program that listens for commands on a certain Transmission Control Protocol (TCP) or User Datagram Protocol (UDP) port. A port is a numbered channel that a computer uses to send and receive network traffic.

How Does a Backdoor Work?

A backdoor gives someone a path into a system that does not use the normal login. A program of this kind can sit on a machine and wait. When the attacker sends a command to the port it is listening on, the program acts on it.

Web shells are one example that MITRE ATT&CK describes. MITRE says a web shell is a web script placed on an openly accessible web server. An adversary can use the server as a gateway into a network. MITRE lists this technique under the persistence tactic, which means keeping access over time.

Why Is Fixing the First Way In Not Enough?

A backdoor gives an attacker a way back in that does not depend on the first break-in. NIST describes an undocumented way in as a potential security risk. If defenders fix only the first problem they find, a separate backdoor can remain. For this reason, an investigation often needs to look for more than one way in.

How Do You Find a Listener Nobody Expects?

NIST describes a backdoor as a program that listens on a port. That gives defenders a place to look. Reviewing which services listen for connections, and asking whether each one is expected, can show something that should not be there. The same idea applies to web servers. Scripts on a public web server that nobody can explain deserve a closer look.

• Know which ports and services should be open on each system.
• Question any listener that nobody can explain.
• Review the files on public web servers, since MITRE describes web shells as scripts placed on openly accessible web servers.
• When you respond to an intrusion, look for additional ways in, not only the first one.

Where Can a Backdoor Hide?

MITRE lists several places where attackers keep a way in. See web shells, China Chopper and valid accounts for related cases. A current example is CWPdoor, a backdoor XLab found recompiled into Control Web Panel’s own web server; see the Control Web Panel Linux backdoor that skips its own access log.

Is a Backdoor the Same as a Trojan?

No. A Trojan is a program that appears useful but hides a malicious function. A backdoor is about the access it gives. A Trojan can be one way that a backdoor ends up on a system, but the two words describe different things. One describes how the program disguises itself. The other describes the way in.

Is a Backdoor the Same as a Web Shell?

Not exactly. A web shell is a specific kind of script that sits on a web server. A backdoor is the wider idea of any undocumented or hidden way in. A web shell can act as a backdoor, but a backdoor does not have to be a web shell.

Related Terms

See also persistence, command and control and remote access trojan.

Related Pages in the Knowledge Hub

• China Chopper

Sources

• NIST: NIST defines a backdoor as an undocumented way of gaining access to a computer system and a potential security risk, and as a malicious program that listens for commands on a port.
• MITRE ATT&CK: MITRE describes a web shell as a web script on an openly accessible web server. It gives an adversary a gateway into a network, under the persistence tactic.
• MITRE ATT&CK: MITRE describes creating a local account to keep access, with detection notes on account creation.
• MITRE ATT&CK: MITRE describes Windows services used for persistence, with detection notes on new services.