Content
Backdoor: Definition, How It Works, Detection, and Protection
A backdoor is an additional, usually hidden or undocumented point of access to an IT system. It allows users to bypass intended authentication or access controls. Attackers can use such a backdoor to execute commands, extract information, or inject additional malware.
Backdoors can be installed after a system has been compromised or may already be embedded in tampered software, firmware, or hardware. The actions they enable and how long they remain active depend on their technical implementation and the available permissions.
As of October 30, 2026
What is a backdoor?
The English term “backdoor” means “back door.” In IT security, it refers to a means of access that bypasses the intended access controls. NIST describes backdoors, among other things, as undocumented ways to gain access to a computer system. [1]
A backdoor can, for example, consist of a hidden remote-control function, a tampered authentication process, or a secret access point. It does not have to be a standalone piece of malware: even a few changes within an otherwise legitimate application can create a backdoor.
It is important to distinguish this term from others:
- A security vulnerability is a weakness in a system. It can allow a backdoor to be introduced, but it is not automatically a backdoor itself.
- A standard administrator account is not a backdoor, provided it is part of the intended and authorized access policy.
- Remote maintenance software is not inherently harmful. However, it can be exploited by attackers to maintain unauthorized access.
- A misconfiguration can allow unauthorized access even if no hidden access feature has been built in.
Not every backdoor grants full control. Some allow only certain actions or operate with limited privileges. However, even limited access can cause significant damage.
How does a backdoor work?
A backdoor provides an additional way to access a system’s functions or data. Three characteristics can be distinguished:
| Property | Meaning |
|---|---|
| Access | The backdoor allows actions outside the intended access model. |
| Control | Commands reach the backdoor, for example, via network connections or specially crafted requests. |
| Persistence | Additional mechanisms ensure that the backdoor becomes active again after a reboot. |
Not every backdoor exhibits all three characteristics in the same way. A component that runs exclusively in memory may disappear upon a system restart if there is no mechanism in place to reload it. Other backdoors are reactivated via services, scheduled tasks, or manipulated system components.
An openly accessible network port is not a requirement either. Some backdoors even establish an outgoing connection to a command-and-control infrastructure—often referred to as C2 for short. Others receive commands through an existing web application.
Depending on the scope of functionality, attackers can, for example:
- Read, modify, or transfer files;
- Run programs and commands;
- Gather information about the system;
- download additional malware;
- use the compromised computer as a starting point for further attacks.
Whether these actions are possible also depends on the permissions of the affected process.
How does a backdoor get into a system?
Backdoors can be built into a product before it is shipped or installed later on a system that is already in operation.
Malware and Tampered Files
Trojans and other malware may include backdoor functions or download additional components. Possible entry points include malicious attachments, tampered downloads, and counterfeit software packages.
Exploited Security Vulnerabilities
Attackers can exploit vulnerabilities in publicly accessible applications, operating systems, or network devices and then install a backdoor. Both known and previously unknown vulnerabilities can be exploited for this purpose.
Compromised login credentials
Stolen or otherwise obtained privileges can allow attackers to install software, change configurations, or set up additional access points. Not every instance of misused access is necessarily a backdoor; however, it can be used to set one up.
Manipulated Software Supply Chains
An attack can target source code, software dependencies, build systems, or the distribution of updates. The subsequent installation may then take place via a regular update process. The SolarWinds incident shows that malicious code can be injected as early as the software development phase. [3]
Internal Manipulations and Abandoned Special Access Points
Individuals with the appropriate permissions can install hidden access points. Even test or maintenance functions that have not been removed can leave behind problematic access points. Whether a backdoor actually exists must be assessed based on its function and integration.
What types of backdoors are there?
Backdoors can be classified based on their technical location and function. These categories overlap to some extent.
| Form | Description |
|---|---|
| Software Backdoor | An additional access feature in an application or operating system. |
| Webshell | A component placed on a web server that can be used to execute unauthorized actions or commands. |
| Firmware Backdoor | A backdoor in device-level software, such as in a network appliance or a management component. |
| Hardware Backdoor | A hidden function created at the hardware implementation level. |
| Hidden Authentication Path | For example, a tampered login check or an unintended secret access point. |
Webshells are particularly relevant to the security of publicly accessible servers. MITRE describes them as a means by which attackers can establish persistent access to web servers. [2]
Firmware and hardware should be considered separately: Tampered code in a device does not automatically mean that the chip itself has been altered. This distinction is essential for detection and recovery.
Are rootkits also backdoors?
Rootkits and backdoors can be used together, but they serve different purposes.
A backdoor provides additional access. A rootkit is primarily used to conceal changes or activities and, if necessary, to maintain privileged access. A rootkit can disguise a backdoor or contain corresponding functions. Therefore, the terms are neither synonymous nor generally suitable as parent and child categories. [1]
What is the difference between a backdoor and an exploit?
An exploit takes advantage of a vulnerability. A backdoor provides an additional means of access.
A typical sequence of events might look like this: An attacker first exploits a vulnerability in an application. The attacker then installs a backdoor to gain access again later without having to use the same entry point.
These terms differ in terms of their function, not in terms of a fixed lifespan. Exploits can be executed automatically. Backdoors do not need to be permanently active or survive a system reboot.
Patching the original security vulnerability does not reliably remove a backdoor that has already been installed. Once a security breach has been confirmed, additional access points and other changes must therefore also be investigated.
How can backdoors be detected?
A backdoor can rarely be reliably identified based on a single characteristic. It is more promising to analyze various clues together.
Examine Network Communication
Unexpected outbound connections, recurring attempts to establish contact, unusual DNS queries, or unexplained data transfers may be cause for suspicion. Incoming access attempts to services not intended for that purpose also warrant attention.
Encrypted communication can complicate an investigation. However, it is not in itself an indication of an attack.
Review Processes and System Changes
Unusual process chains, new services, changes to autostart settings, or unexpected scheduled tasks may indicate a security breach. On web servers, suspicious files and unexplained changes to applications are also relevant.
Check Accounts and Permissions
New administrator accounts, unknown access keys, or unexpected changes to permissions can create additional access paths. Such changes should be cross-checked against authorized administrative activities.
Consolidate Safety Data
Antimalware solutions can detect known malicious components. Endpoint Detection and Response (EDR) complements the analysis of activity on endpoints. Network Detection and Response (NDR) monitors network behavior. A Security Information and Event Management (SIEM) system can consolidate alerts and logs from various sources.
These tools support detection but do not guarantee it. Their effectiveness depends, among other things, on configuration, data coverage, and analysis. Regulatory guidelines therefore also recommend taking inventory of remote access software and investigating its actual use. [4]
A conspicuous process does not necessarily prove the presence of a backdoor. Conversely, an inconspicuous scan does not prove that a system is free of backdoors.
How do you protect yourself from backdoors?
Effective protection combines the reduction of entry points with restricted access, monitoring, and a prepared response.
Keep Systems Up to Date
Security updates should be applied in a risk-based and timely manner. Publicly accessible applications and devices are particularly important. Firmware and management components must be included in the patch management process.
Securing Administrative Access
Multi-factor authentication, separate administrator accounts, and minimal permissions make many initial access attempts more difficult. However, MFA does not automatically protect against a backdoor that bypasses the regular login process.
Check Remote Maintenance
Companies should know which remote maintenance tools are in use, who is authorized to use them, and which connections are permitted. Any access that is not needed should be deactivated.
Segment Networks
The separation of workstation systems, servers, and administrative areas makes it more difficult for the infection to spread. Outgoing connections should also be monitored based on actual needs. [4]
Securing Software Supply Chains
Trusted sources, secure development and build processes, and controlled software dependencies reduce risks. Digital signatures help verify origin and integrity within the respective trust model. However, they do not guarantee the absence of malicious code: In the SolarWinds case, the tampered component was also legitimately signed. [5]
Prepare for Detection and Response
Centralized logging, appropriate detection systems, and a well-rehearsed incident response process facilitate the investigation. Audits and penetration tests can uncover vulnerabilities, but they do not prove the complete absence of hidden access points.
What Should You Do If You Suspect a Backdoor?
A reasonable suspicion should be treated as a potential security incident. Deleting individual files too hastily can destroy evidence and cause you to overlook other points of access.
- Notify the appropriate departments: Contact IT Security or Incident Response and document your observations, including the time and the affected systems.
- Contain the incident: Isolate the affected systems in a coordinated manner. For production-critical systems, operational and security-related impacts must be taken into account.
- Preserve evidence: Save relevant logs and, if necessary, memory or disk images. Restarting the system without careful consideration can destroy fleeting traces.
- Investigate the scope: Examine the point of entry, other affected systems, additional points of access, and any data that may have been stolen.
- Restore a Trusted State: Depending on the findings, a reinstallation or a complete rebuild may be necessary.
- Renew and re-verify access credentials: Coordinatedly reset or revoke affected passwords, keys, and sessions, and continue to monitor the environment.
Official recommendations place particular emphasis on containment, preservation of evidence, and a systematic investigation. [6]
Backups can assist with recovery. However, they should be checked for suitability and possible compromise. Restoring from a backup alone does not eliminate the original cause or necessarily resolve other compromised access points.
Are backdoors legal?
The term “backdoor” alone does not allow for a definitive legal assessment. Decisive factors include, among others, authority, purpose, actual use, and applicable law.
A documented and authorized maintenance access point is not a backdoor simply because of its function. Conversely, claiming that access is for maintenance purposes does not automatically make covert access permissible.
In Germany, for example, Section 202a of the Criminal Code (StGB) may apply if unauthorized access is gained to specially secured data by circumventing the security measures. Whether the requirements are met in a particular case depends on the specific facts of the matter. [7]
Calls for government access must also be considered separately from a technical and legal perspective. Legal authorization does not answer the question of how additional access channels would affect the security of all users.
Where are backdoors used?
Backdoors are used, among other things, for espionage, data theft, and to prepare for further attacks. Workstations, servers, web applications, network devices, and virtualization environments may be affected.
A general incidence rate is not very meaningful: Safety reports examine different incidents and sometimes use different categories. Therefore, figures should always be accompanied by the time period, data source, and definition.
When reporting on alleged backdoors, it is also important to distinguish between technical feasibility, reasonable suspicion, and proven manipulation.
What are some well-known examples?
SolarWinds/SUNBURST: Software Supply Chain Compromise, 2020
In the SolarWinds attack, the SUNBURST backdoor was delivered to customers via compromised Orion software. The SUNSPOT malware was used to inject the malicious code during the build process. The malware was then distributed via regular software updates. [3]
This case demonstrates that even software that appears trustworthy and is digitally signed can contain a backdoor. The distribution of the compromised component must be distinguished from the subsequent stages of the attack targeting specific organizations. [5]
XZ Utils: Tampered Open-Source Components, 2024
A backdoor was discovered in versions 5.6.0 and 5.6.1 of XZ Utils. Under certain technical conditions, it could interfere with the SSH server’s processing and allow an attacker with the appropriate key to execute commands.
Not all Linux systems were affected. The specific versions used, as well as the particular integration and system environment, were decisive factors. This case highlights the importance of dependencies and build processes for software security. [8]
BRICKSTORM: Covert Access to Corporate Environments
BRICKSTORM was investigated in connection with espionage incidents in corporate and virtualization environments, among other things. Mandiant published detailed findings in 2025; a joint government report followed that same year.
This example underscores the fact that even core infrastructure, such as virtualization and management systems, must be included in detection and response. [9]
Sources and Further Information
- NIST: Backdoor and Rootkit.
- MITRE ATT&CK: Web Shell – T1505.003.
- SUNSPOT Malware: A Technical Analysis, 2021.
- CISA and Partner Agencies: Guide to Securing Remote Access Software, 2023.
- Microsoft: Technical description of Solorigate and analysis of the subsequent attack steps.
- Canadian Centre for Cyber Security: What to Do When Your Organization Has Been Compromised by a Cyberattack.
- Laws on the Internet: Section 202a of the German Criminal Code (StGB) – Data Spying.
- CERT-EU: Critical Vulnerability in XZ Utils, 2024; Microsoft: FAQ and guidance on the XZ Utils backdoor, 2024.
- Google Threat Intelligence/Mandiant: Another BRICKSTORM, 2025; Canadian Centre for Cyber Security: Joint malware analysis report on the Brickstorm backdoor, 2025.
Zurück zur Übersicht des Glossars