Backdoor

Description

The attacker usually plants it after the first break-in, to secure a way back even when the main entrance is closed. Sometimes it is left behind by employees or service providers, deliberately or by accident. Sometimes it surfaces as a software or hardware vulnerability. It always serves the same purpose — permanent access to the victim's machine or network, regardless of patching, changed credentials or a reinstalled system.

Blocking the initial way in is not the end of the fight. Until you establish which backdoor was opened during the attack, the job is not finished.

Examples

• After the break-in, the attacker creates an administrator account nobody notices; the IT team patches the vulnerability the infection came through, but the hidden account lets the attacker back.
• A web shell is placed on a ministry's web server — a script that runs on its own and gives the attacker remote control. The access lasts for months without anyone suspecting anything.
• A contractor maintaining a local company's network leaves themselves remote access, just in case. The contract expires; the access stays.

Notes

• Closing the door the attacker came through is not the same as closing the one they left behind.
• A backdoor is rarely the work of exotic malware and most often a banal oversight: one administrative account too many, an ancient vulnerability, a forgotten supplier's access, a script nobody can account for.