# What is a Backdoor?

> A backdoor is a hidden or unauthorized mechanism that bypasses normal authentication to grant access to a system, application, or device.

- Canonical URL: https://yellowcube.eu/glossary/backdoor/
- Publisher: Yellow Cube
- Language: en
- Contact: hello@yellowcube.eu

## Content

Backdoors arrive by different routes: installed by an attacker after compromise, planted by malware, embedded by a malicious insider or supplier, or left — intentionally or not — by developers as undocumented maintenance access. The defining property is circumvention: whoever uses the path does not pass through the controls everyone else must.

Detection depends on what the backdoor bypasses. Covert accounts, implanted services, modified binaries, rogue remote-access tools, and undocumented interfaces each leave different evidence — configuration artifacts, unexpected listeners, unexplained sessions — and none of it appears in the authentication path being skipped.

### Key points

- **Common forms:** Implant components, covert local or domain accounts, unauthorized remote-access tooling, modified authentication code, vendor or developer maintenance paths, and supply-chain-planted mechanisms.
- **Detection:** Inventory accounts, services, listeners, and remote-access tooling against approved baselines; investigate sessions and administrative actions that lack a matching authentication trail.
- **Removal:** Identify how the path was created before closing it — deleting the account or tool without addressing the entry vector leaves the mechanism that rebuilds it.
- **Important limitation:** Finding one backdoor does not establish the full scope of a compromise, and a legitimate remote-access tool abused by an attacker is not automatically a “backdoor” — the unauthorized use is the violation, not necessarily the software.

### Related terms

[Malware](<https://yellowcube.eu/glossary/malware/>) · [Remote access trojan (RAT)](<https://yellowcube.eu/glossary/remote-access-trojan/>) · [Rootkit](<https://yellowcube.eu/glossary/rootkit/>) · [Persistence](<https://yellowcube.eu/glossary/persistence/>) · [Supply-chain attack](<https://yellowcube.eu/glossary/supply-chain-attack/>)

### Sources

[NIST SP 800-83 Rev. 1: Guide to Malware Incident Prevention and Handling](https://csrc.nist.gov/pubs/sp/800/83/r1/final) · [MITRE ATT&CK TA0003: Persistence](https://attack.mitre.org/tactics/TA0003/) · [CISA: AA22-131A — Protecting Against Cyber Threats to Managed Service Providers](https://www.cisa.gov/sites/default/files/publications/AA22-131A_Protecting_Against_Cyber_Threats_to_MSPs_and_their_Customers.pdf)

## Attribution and scope

This Markdown representation is generated from the same approved content records as the canonical HTML page. Cite the canonical URL above when referencing this material. Product and service descriptions are informational; confirm project-specific requirements with Yellow Cube.