Glossary
Backdoor
A backdoor is a secret entrance attackers leave behind. Even if you fix how they got in originally, the backdoor lets them come back whenever they want. Finding and closing all backdoors is crucial after a breach.
What is Backdoor?
A hidden method for bypassing normal authentication to gain remote access to a system, often installed by attackers for persistent access.
Why Should You Care?
Backdoors enable attackers to maintain ongoing access to compromised systems, bypassing the effort required for each new intrusion and allowing data exfiltration, lateral movement, and ransomware deployment to occur on the attacker's schedule rather than under time pressure. A single overlooked backdoor can turn a brief intrusion into months of undetected compromise. Incident response teams must assume attackers may have planted multiple backdoors during their initial access, which makes thorough cleanup significantly more complex and costly than addressing the original entry point alone.
Is your business exposed?
Real-World Example
The SolarWinds SUNBURST supply-chain attack, disclosed in December 2020, inserted a sophisticated backdoor into SolarWinds Orion software updates that were downloaded by thousands of organizations, including U.S. government agencies. The backdoor used evasion techniques—including a dormancy period of roughly two weeks before activating and traffic designed to mimic legitimate SolarWinds communications—allowing the attackers to remain undetected for months while moving laterally and exfiltrating data across targeted networks.
How to Protect Against Backdoor
- 1.
After incidents, hunt for backdoors thoroughly
- 2.
Monitor for unusual listening ports and services
Related Terms
Is your business exposed?
Check if your company data is circulating on the dark web
Free scan • No credit card required