A backdoor is concealed access that bypasses normal sign in controls, letting someone enter a system while ordinary users still pass through the front door.
It may be planted after a break in, left by a developer for convenience, or hidden in a dependency that many products share.
How it works
The danger is persistence: even after passwords change, the hidden route can remain and invite a return.
Because the route pretends to be part of the system, reviews that only watch failed logins can miss it entirely.
Honest remote support tools can look similar, so context matters, including who installed the component and whether it was approved.
Removing a backdoor means finding the hidden route, cutting it, and then checking that no second route was left behind.
Concrete examples
- After a break in, an intruder adds a hidden administrative account that does not appear in the usual onboarding list.
- A forgotten maintenance account in a shipped product lets anyone who learns the secret enter customer systems.
- A tainted library update opens a quiet management channel that the application vendor did not design or document.
Protective measures
- Inventory remote access tools and administrative accounts, and remove any that lack a named owner and an approval.
- Rebuild systems that were entered by an intruder instead of trusting that a password change closed every route.
- Monitor integrity of startup paths and management services so a new hidden listener stands out.
- Require code review and signed builds for changes that affect authentication or remote administration.
Related articles
The article What is a virus in computing? explains host attached code, which is different from a hidden access route.
The article What is a threat actor? describes the people who benefit from keeping a quiet route open.
The article What is authentication in security? covers the front door checks that a hidden route is built to skip.