What is a backdoor?¶
A backdoor is a hidden, unauthorised or unintended method of gaining access to a system, application or device.
Avoid the dangerous assumption¶
The dangerous assumption is that every remote-access feature is a backdoor.
It is not.
A backdoor may be:
- malware installed by an offender
- a hidden account
- a modified service
- a secret command
- a web shell
- a deliberately embedded access mechanism
- a misused legitimate administration feature.
Its purpose is usually to allow continued or future access while bypassing the normal route.
Investigators should identify:
- how the backdoor was created
- what access it provided
- what authentication it required
- whether it was used
- which systems it contacted
- when it became active
- whether it survived restart or password change.
Evidence may include files, services, scheduled tasks, accounts, configuration changes, listening ports, network connections and command history.
The presence of a backdoor does not prove it was used.
Likewise, unexplained remote access does not automatically prove a backdoor existed. Stolen credentials or legitimate remote services may explain it.
Do not remove the mechanism before its configuration and surrounding evidence are preserved.
A backdoor may be created by one offender and later used by another. It may also remain after the original incident appears contained.
A backdoor may also be restricted to a particular command, address or authentication secret. Preserve those conditions because they may explain why ordinary testing failed to reveal access or why only one controller could use it.
Operational takeaway¶
Identify the hidden access route, preserve how it was created and configured, and prove use separately from presence.