# Backdoor A backdoor is a covert method of bypassing normal authentication or encryption in a computer system, a cryptosystem, or an algorithm. It is a hidden entry point into a system that allows unauthorized access. Backdoors are often created for malicious purposes, such as remote access by an attacker, but can also be created by developers for legitimate reasons like troubleshooting, though this is a risky practice. **Pronunciation:** /ˈbækˌdɔːr/ **Difficulty:** Intermediate **Synonyms:** trapdoor, covert channel, hidden entry point **Categories:** Cybersecurity, Software Development **Tags:** security, vulnerability, malware, cybersecurity, exploit, trojan Canonical: https://scaleengineer.com/glossaries/backdoor --- ## Definitions - **In Cybersecurity:** In the context of cybersecurity, a **backdoor** is a covert mechanism that bypasses normal security controls to grant unauthorized access to a system, network, or application. It acts as a **hidden entry point** that attackers can exploit. ***Key Concepts*** * **Persistence**: Attackers often install a **backdoor** after an initial breach to maintain access to the system, even if the original vulnerability they used is patched. * **Stealth**: Backdoors are designed to be hidden and difficult to detect. They may not show up in lists of running processes or network connections. * **Bypassing Authentication**: The core function is to circumvent standard authentication procedures like usernames, passwords, and multi-factor authentication. ***Example*** An attacker exploits a software vulnerability to gain initial access to a web server. To ensure they can always get back in, they install a small web shell—a script that executes commands sent via a web browser. This web shell is a **backdoor**, allowing the attacker to control the server without needing to exploit the original vulnerability again. This is a form of a **trapdoor**. - **In Software Development:** In software development, a **backdoor** can refer to a feature intentionally added by developers to allow special access to the software, often for debugging or administrative purposes. While intended for legitimate use, these are considered a major security risk. ***Key Concepts*** * **Hardcoded Credentials**: A common example is a developer leaving a hardcoded username and password in the code that grants administrative privileges. * **Debug Hooks**: These are special commands or conditions that trigger debugging or diagnostic modes, which might expose sensitive information or allow elevated actions. * **Security Risk**: If discovered by an attacker, a developer-installed **backdoor** or **trapdoor** becomes a critical vulnerability. Best practices strongly advise against shipping production code with such features. ***Example*** A developer for a network appliance adds a special, undocumented command that can be sent to the device to get a root shell, bypassing the normal login process. This was intended to make field diagnostics easier. However, if an attacker discovers this command, they can use this **hidden entry point** to take full control of any of these devices. ## Etymology The term 'backdoor' is a metaphor derived from the physical world, where a backdoor is a secondary, often hidden or less-guarded, entrance to a building. In computing, it refers to a similar hidden entry point into a system. ## First used 1980s ## Historical context The concept of a **backdoor**, or **trapdoor**, predates modern computing and is rooted in cryptography and physical security. In the context of computer science, one of the most famous early discussions was by Ken Thompson in his 1984 Turing Award lecture, "Reflections on Trusting Trust." He described how a compiler could be modified to insert a **backdoor** into the login program, and then further modified to hide the backdoor-insertion code itself, making it virtually undetectable in the source code. During the 1990s, with the rise of the internet, backdoors became a common payload for malware like Trojan horses. The infamous "Back Orifice" program, released in 1998, was a remote administration tool that functioned as a powerful **backdoor**, giving attackers extensive control over infected Windows systems. The debate over government-mandated backdoors in encryption technologies also intensified during this period, a conflict that continues to this day, pitting privacy advocates against law enforcement agencies. ## Q&A - **What is the primary purpose of a backdoor in a computer system?:** The primary purpose of a **backdoor** is to provide a secret method for bypassing standard security measures, such as logins and firewalls. This allows an individual, often an attacker, to gain unauthorized remote access to a computer or system. While sometimes created for legitimate administrative purposes, their existence poses a significant security risk. - **How can a backdoor be installed on a system?:** A **backdoor** can be installed in several ways: * **Malware**: It can be part of a malware package, like a Trojan horse or a virus, that a user unknowingly installs. * **Developer-installed**: A developer might intentionally leave a **trapdoor** in the software for debugging or maintenance, which could later be exploited. * **System Compromise**: An attacker who has already gained initial access might install a **backdoor** to ensure persistent access even if their initial entry point is discovered and closed. * **Hardware**: In rare cases, backdoors can be embedded in hardware components. ## Usage examples - The security audit revealed a **backdoor** in the server's firmware, allowing attackers to bypass the firewall completely. - That piece of malware installed a **trapdoor** on the user's machine, giving the hacker a **hidden entry point** for future attacks. - Developers were accused of intentionally leaving a **backdoor** in their encryption software for government surveillance purposes. ## Related terms - Trojan Horse - Rootkit - Zero-Day Exploit - Firewall - Authentication ## Popular related terms - Trojan Horse - Rootkit - Malware - Vulnerability