Backdoors 😈

Illustration of a glowing door in a wall made of green code

A backdoor is a hidden method of bypassing a system’s authentication mechanism. It allows unauthorized access, often without the knowledge of the system owner. Backdoors can be introduced intentionally (e.g., for remote administration) or by attackers.

Why it matters

In 2006, the US National Institute of Standards and Technology (NIST) published the standard NIST SP 800–90A, an algorithm for random number generation. The standard includes Dual_EC_DRBG, an algorithm with an algorithmic weakness that very likely allowed the NSA to break encryptions which made use of this random number generation algorithm. It’s a cryptographic backdoor.

In 2015, it was discovered that Juniper Networks’ Netscreen firewalls had hardcoded passwords (source).

In 2024, the XZ Utils backdoor was discovered by a professional software developer who wondered why a program used an unexpected amount of processing power. We were lucky. This backdoor introduced a vulnerability to the code which would have allowed attackers to bypass the sshd authentication. That would have been a big deal as it’s so widespread across the internet.

What can I do?

Leaking secrets is a common issue, especially for open source projects. It’s just easy to have a hardcoded password in the beginning of a project that is never removed. I’ve already written an article about how to deal with that:

Leaking Secrets How it happens and how you prevent it

The same tools allow you to search for secrets within your code.

When you want to find rootkits on your base-system, rkhunter might be useful.

For containers, you might want to make them read-only:

Running Containers Read-Only - LinuxServer.io Welcome to the home of the LinuxServer.io documentation!

The only action that helps to make sure your code doesn’t have backdoors is to do code reviews and audits.

Why it matters

What can I do?

More in this series