Persistence · Learn

What is a backdoor?

A backdoor is a hidden way back into a system that bypasses normal authentication. It is the mechanism behind most persistence. Here is what a backdoor is and the forms it takes.

Persistence · LearnAll services
TL;DR

A backdoor is a hidden method of accessing a system that bypasses normal authentication, planted by an attacker (or shipped in malicious software) so they can return at will. Backdoors range from a web shell on a server, an extra SSH key, or a rogue account, to deep rootkits and firmware implants. They are the mechanism behind most persistence: a quiet, reliable door back in that survives reboots and avoids the front-door login.

By John Dill, Red Team Lead, SecureLayer7Updated

What a backdoor is

A backdoor is any concealed way into a system that sidesteps the normal login. Where the front door checks a password and MFA, a backdoor is a path the attacker controls that asks for none of that, or uses a secret only they know.

It is the practical form persistence usually takes: not just "keep access" in the abstract, but a specific hidden door, a web shell URL, an extra key, a rogue service, the attacker can knock on whenever they want.

The forms backdoors take

Backdoors exist at every layer:

Why backdoors are dangerous

A backdoor combines stealth and durability. It avoids the authentication and logging the front door has, and it is designed to persist. Attackers also plant several, so removing the obvious one still leaves a way in.

That is why eradicating an intrusion means hunting every backdoor and autostart location, not just closing the hole the attacker first used.

References

  1. [1]MITRE ATT&CK: Persistence (TA0003)(MITRE)
  2. [2]MITRE ATT&CK: Server Software Component (T1505)(MITRE)
  3. [3]NIST SP 800-83 Malware Incident Prevention and Handling(NIST)
Related terms

Common questions

Persistence, asked often

Want your environment checked for attacker persistence?

Scope an engagement

Find the backdoors an attacker would leave behind.

Our red-team and internal penetration tests show where an intruder could hide to survive a reboot or a password reset, registry keys, scheduled tasks, services, web shells, and rogue accounts, then hand your team the evidence and the fix. Free re-test included.

See all services30-min scoping call, fixed-price proposal in 48 hours.