Backdoor
A backdoor is an undocumented way of gaining access to a computer system that lets attackers bypass security measures. The term covers both a weakness or defect in a system, application, or service and a malicious program that listens for an attacker's commands.
Updated
Overview
As a program, a backdoor listens for commands on a certain TCP or UDP port. Most backdoors let an attacker perform a set of actions on the host, such as acquiring passwords or executing arbitrary commands. NIST names two types: zombies, better known as bots, which are installed to make the host attack other hosts, and remote administration tools, which give a remote attacker access to the host's functions and data as needed.
Backdoors are among the attacker tools that malware often delivers to a host. These tools give attackers unauthorized access to or use of infected hosts and their data, or a way to launch additional attacks. NIST describes any backdoor as a potential security risk.
Network behavior analysis systems, which learn normal traffic patterns and flag significant deviations, can identify the use of backdoors. A host that has had a backdoor installed may also have been subjected to other malicious actions, so NIST considers rebuilding it the most reliable way to restore its integrity, instead of disinfecting it.
Similar Terms
2 termsTrojan Horse
A trojan horse is a program that appears benign while hiding a malicious purpose, and it often delivers other attacker tools. A backdoor is one such tool. It provides ongoing access, for example by listening for commands on a network port.
Rootkit
A rootkit conceals an attacker's activity on a host and keeps root-level access through covert means. A backdoor is an undocumented way in that bypasses security measures.
Frequently Asked Questions
What can an attacker do with a backdoor?→
Most backdoors let an attacker perform a set of actions on the host, such as acquiring passwords or executing arbitrary commands. Some turn the host into a bot that attacks other hosts, and remote administration tools give access to the host's functions and data.
Is a backdoor always malware?→
No. Definitions also include a weakness or defect of a system, application, or service that allows attackers to bypass security measures, and any undocumented way of gaining access to a computer system.
How do you remove a backdoor?→
NIST advises rebuilding any host where unauthorized administrator-level access was available through a backdoor, or where system files were replaced by one, instead of performing typical eradication actions such as disinfection.
Related
Tool categories
Career roles
Glossary terms
Sources
Definitions follow the government and standards body sources listed above. This site is not affiliated with the agencies or organizations cited.