What Is A Backdoor?

Date First Published: 11th May 2023

Topic: Cybersecurity

Subtopic: Threats To Systems, Data & Information

Article Type: Computer Terms & Definitions

Difficulty: Medium

Difficulty Level: 6/10

CONTENTS

How Are Backdoors Installed and Detected?
Difference Between A Backdoor And A Rootkit
Notable Backdoors

Learn more about what a backdoor is in this article.

A backdoor is a security vulnerability that allows an attacker to gain unauthorised remote access to the victim's computer without their permission or knowledge and bypass normal security mechanisms. After establishing a backdoor on a system, the attacker can do almost anything they want, including stealing sensitive information, disabling antivirus software, modifying files, installing malware, and even taking full control of the computer. Therefore, a backdoor is one of the most serious types of threats which puts user's and company's private data at great risk.

Backdoors are designed to sneakily take control of a computer and gain unauthorised access. They are often hidden using obfuscation and encryption layers so that they are difficult to detect. This term came from the ways that burglars sneakily robbed houses by going through the unguarded backdoor without the observer seeing any external signs of a burglary.

How Are Backdoors Installed and Detected?

Backdoors are often installed by exploiting vulnerabilities in software programs and security systems. Then, once the vulnerabilities are exploited, malware can be installed on a system that gives an attacker control over a system to do almost anything they want. The most serious types of security holes are ones in the operating system. This is because after gaining access, they will have access to everything on the operating system, including all data and files, which becomes a serious security risk.

Backdoor malware can also be installed using deception techniques as part of a Trojan horse. Trojan horses look like something useful and safe when they actually install malware or open backdoors on systems.

Backdoors are not always easy to detect and can go undetected for several days, weeks, or months if they don't greatly affect the functionality of a system. Antivirus software, firewalls, and network activity monitoring tools can detect and block backdoors. Strong antivirus software should be able to block attackers from using Trojan horses to open up backdoors.

Difference Between A Backdoor And A Rootkit

These terms sound similar in that they both enable unauthorised access to a system, but the main difference between a backdoor and a rootkit is that a backdoor is a wider term that refers to a way for an unauthorised user to gain access and take control of a system. A rootkit is a special type of backdoor that allows an unauthorised user to gain root privileges to a system and modify anything that a user with the highest level of access can. Backdoors leave a hidden way for attackers to gain unauthorised access to a system, whilst rootkits are actually installed on another computer and install themselves through a backdoor.

Notable Backdoors

Below are four notable examples of backdoors:

Back Orifice - Created in 1998 by hackers from the Cult of the Dead Cow group as a remote administration tool to take advantage of the vulnerabilities in the Windows operating system. It installed backdoors that allowed Windows computers to be remotely controlled over a network.
WordPress backdoors - In March 2014, multiple backdoors in WordPress plugins were discovered. They were inserted as obfuscated JavaScript code. Once installed, they created a hidden admin account in the website database to steal data and even take control of the whole website.
PoisonTap - In this backdoor attack, hackers used malware to gain root-level access to any website, even those protected with two-factor authentication. It makes the victim's web browser and local network remotely controllable by the attacker and allows the user's web traffic and authentication cookies to be intercepted. PoisonTap could quickly install a backdoor onto computers, even if they are locked with a strong password.
DoublePulsar - In 2017, DoublePulsar was leaked by The Shadow Brokers. It allowed others to bypass the security mechanisms of Windows PCs and remotely access their system without permission to inject and run malicious code. The tool infected over 200,000 Windows PCs in just a few weeks and was used in combination with EternalBlue in the May 2017 WannaCry ransomware attack.