A backdoor is a hidden way to bypass normal authentication and access a system, whether created deliberately by a developer or installed by an attacker.
How backdoors work
A backdoor can be a piece of malware, a web shell on a server, a hard-coded “maintenance” password in a router, a secret account, or a subtle code change in software. Once in place it lets its owner return at any time without exploiting the original vulnerability again. Malware backdoors usually connect to a command and control server and accept commands to run programs, upload files or open a remote shell.
- malicious backdoors are planted by attackers after a compromise or through a supply chain attack;
- vendor backdoors are undocumented access mechanisms left by manufacturers, sometimes for support;
- hardware and firmware backdoors are hidden in chips or firmware and are very hard to detect.
Why backdoors matter for security
Backdoors provide persistence: even after the entry point is patched, the attacker remains. In 2020 the SUNBURST backdoor was shipped in signed SolarWinds updates; in 2024 a backdoor planted in the XZ Utils library over years of social engineering was found by chance before it spread widely. Every hard-coded password in network equipment is eventually found and abused by others. Governments periodically call for “lawful access” backdoors in encryption, but security experts warn that no backdoor can be restricted to good actors only.
How to defend
- After an incident, assume persistence: look for new accounts, scheduled tasks, services, web shells and rootkits.
- Monitor outbound connections and unusual listening ports.
- Verify software integrity and signatures, and buy equipment from vendors with a good security record.
- Remove default and hard-coded credentials; rebuild compromised systems from clean images.
