What is a Backdoor?

As the name suggests, it refers to a way to penetrate an IT system (server, application, PC) - usually by bypassing existing security measures. Often hackers build backdoors into certain systems to be able to come back later. Sometimes backdoors are also built into sold products (for example software) by manufacturers to quickly fix problems in case of emergency or to be able to offer certain services. The problem here is that these backdoors can often be discovered and misused by third parties.

What is the difference to a Trojan?

Both terms are often thrown into the same pot. A Trojan is actually always understood as a type of malware that serves to hide in the system or to pose as legitimate software - often a Trojan also has backdoor functionalities. Backdoors, on the other hand, don't always have to be malware, they can be built in intentionally to ensure access to a system.

How do backdoors work?

This strongly depends on the context. A backdoor is there to bypass implemented security mechanisms. This can happen when developers build in special "secret" access data to software or hardware, for example. In the context of web applications, the presence of a certain HTTP header, a GET/POST parameter or similar can lead to a backdoor being activated and the user gaining access to the system. Another common example is the deactivation of 2FA when a certain password is used. In cryptography, the topic of backdoor is omnipresent - especially since a backdoor in an encryption algorithm could mean that this algorithm is no longer secure. One could decrypt once encrypted data without knowing the key.

Why are backdoors built in?

Primarily so that criminals can subsequently gain access to critical or interesting systems - topics such as industrial espionage, cryptolockers and Advanced Persistent Threats are just a few examples.

Legitimate, but often dubious and justifiably criticized, uses of backdoors include topics such as remote maintenance and service in general. Occasionally, legitimate users lock themselves out of their systems - backdoors help to reset a password in such cases.

What security risks do backdoors have?

The matter is relatively clear. Backdoors endanger the integrity of IT systems. They facilitate attacks. Data can be more easily stolen or manipulated. Even legitimate backdoors - if there is such a thing - are a risk. Practice shows that backdoors are quite quickly found and published by hackers. Once this knowledge is on the internet, end users can do very little and are helplessly exposed to attacks by third parties - because backdoors cannot usually be deactivated just like that.

Why is Open Source so important when it comes to backdoors?

If you have bought software whose source code you don't know, it's difficult to say whether this software contains backdoors. With Open Source software it's different. The source code can be permanently checked for changes. Implementation of backdoors is not so easy and is noticed much more quickly. This is also the reason why many security experts prefer Open Source software.

How do you find backdoors?

Often IT security experts have no choice but to check and laboriously read the source code of software. In internal networks, it's worth monitoring network traffic - especially traffic related to routers and similar appliances. Occasionally you get lucky and see maintenance personnel using a backdoor access. Backdoors can also be found as part of penetration tests and reverse engineering - but this is often very time-consuming and expensive.