Backdoors

[Resheph]

Attackers may use a backdoor to gain access to a previously attacked target. The owner of the target system has no or very little indications that someone else is using the system.

A backdoor typically achieves one or more of the following goals

• Lets an attacker access a system later by bypassing any countermeasures the system owner may have put in place
• Provides the ability to gain access to a system while keeping a low profile. This allows an attacker to access a system and circumvent logging and other detective methods.
• Provides the ability to access a system with minimal effort in the least amount of time. Under the right conditions, a backdoor lets an attacker gain access to a system without having to actually hack the system again.

Common backdoors that are placed om a target system often has the following properties...

Password-cracking backdoor
Backdoors of this type rely on an attacker uncovering and exploiting weak passwords that have been configured by the owner of the target system.

Process-hiding backdoors
An attacker who wants to stay undetected for as long as possible, will typically attempt to hide the software being executed. Programs such as a compromised service, a password cracker, sniffers, and rootkits are items an attacker will attempt to configure so as to avoid detection and removal. Techniques include renaming a package the the name of a legitimate program and altering other files on a system to prevent them from being detected.

Once a backdoor is in place on the target system, an attacker can access and manipulate the system at will.