A backdoor is a method of bypassing normal authentication or security controls to regain or maintain access to software, a device, or a network. Attackers install malicious backdoors after compromise, but hidden access can also result from undocumented vendor accounts, unsafe debug features, or deliberately weakened design.
A legitimate remote-administration tool is not automatically a backdoor. It becomes one when deployed without authorization, concealed, or configured to bypass expected controls.
What is a backdoor in software?
A software backdoor is an undocumented or covert access path that avoids the application’s expected login, authorization, or security checks. It may be malicious code, but it can also be a hard-coded password, hidden account, web shell, debug route, or unauthorized remote-management configuration. For that reason, “backdoor” describes an access mechanism and is not synonymous with a computer virus.
Common types of backdoors
- Web shells placed on compromised web servers.
- Remote-access malware and covert command agents.
- New administrator accounts, SSH keys, API keys, or OAuth grants.
- Modified services, startup tasks, boot components, or firmware.
- Hidden application routes, hard-coded credentials, or debug interfaces.
- Cloud persistence through roles, federation, functions, or access policies.
Backdoor vs. vulnerability
A vulnerability is a weakness that may allow unintended access. A backdoor is an access mechanism that bypasses the normal path, whether intentionally designed or maliciously installed. Attackers often exploit a vulnerability first and then create a backdoor so they can return after the original flaw is patched.
Backdoor vs. remote-access software
Authorized remote tools have an owner, documented purpose, approved configuration, strong authentication, restricted network reach, logging, and a removal process. Attackers may abuse the same products using stolen accounts or unattended configurations. Detect authorization and behavior, not just the product name.
Warning signs
Investigate unfamiliar listening ports, unexpected outbound beacons, new privileged identities, changed SSH keys, modified web files, unusual scheduled tasks, disabled logs, unexplained firewall rules, or management agents installed outside change control. A stealthy backdoor may have few visible symptoms.
How to investigate
- Preserve volatile data, logs, disk images, and cloud audit history.
- Identify the process, account, privilege, parent process, and first-seen time.
- Compare files and configuration with a known-good baseline.
- Search other systems for the same behavior and infrastructure.
- Determine the initial access route and every persistence mechanism.
Containment and removal
Isolate affected assets, revoke malicious accounts, keys, sessions, and tokens, and block confirmed command infrastructure. Removing one file is insufficient when the attacker had privileged access. Rebuild from trusted images and rotate all accessible secrets when integrity cannot be established. Patch or mitigate the original entry point before restoration.
Firmware and supply-chain concerns
Backdoors below the operating system or inside a compromised dependency can survive ordinary reinstallation. Validate firmware and software through vendor signatures and trusted channels, review build and deployment systems, and replace hardware when a trustworthy state cannot be restored.
Prevention
Use least privilege, phishing-resistant MFA, network segmentation, secure development review, code signing, application allowlisting, and centralized logging. Inventory remote-management tools and external access. Monitor identity and cloud control-plane changes as closely as endpoint files. See command-and-control detection for related network behavior.