What Is a Backdoor?
A backdoor is a hidden way to bypass normal authentication and get back into a system. Attackers plant backdoors so that a single compromise becomes lasting access: even after the original vulnerability is fixed, they can quietly return. This is the persistence stage of an intrusion, and it is what turns an incident into a long-term problem.
What forms do backdoors take?#
They range from crude to deeply hidden:
| Form | Example |
|---|---|
| Rogue account | A secret admin user added to the system |
| Web shell | A script left on a server for remote command execution |
| Malicious service | A program that reopens a connection on boot |
| Supply-chain implant | Malicious code hidden inside trusted software |
| Hardcoded credential | A vendor’s undocumented default login |
The supply-chain variant is the most alarming: a backdoor shipped inside legitimate software reaches everyone who installs it, which is why supply chain security has become a priority.
Why are backdoors so dangerous?#
Because they defeat the assumption that fixing the entry point ends the incident. Combined with a rootkit for stealth, a backdoor can persist unnoticed for months. They also break trust in software itself when introduced upstream.
Backdoors are the persistence tool in the Cyber Kill Chain. More at the Security Fundamentals hub.
Frequently asked questions#
What is a backdoor in cybersecurity?
A backdoor is a hidden mechanism that bypasses normal authentication to grant access to a system. Attackers plant them to regain entry after an initial compromise, so that even if the original hole is patched, they can return. Backdoors range from a rogue account to malicious code hidden in software.
What is the difference between a backdoor and a vulnerability?
A vulnerability is an unintentional flaw; a backdoor is a deliberate access path. A vulnerability might be exploited once, but a backdoor is placed on purpose to provide durable, repeated access. Backdoors can also be introduced through the supply chain, hidden inside otherwise legitimate software.