Is there a standard for labeling a vulnerability as an intentional backdoor?

Question

US concerns of intentional vulnerabilities placed in foreign manufactured equipment has lit up headlines. Is there a standard that sorts (differentiates) poor-designs from intentionally placed vulnerabilities?

Example: An undocumented backdoor vulnerability is found in a system, what is the thought process to decide whether the vulnerability is intentionally placed for remote access or is a result of poor design.

Update: there may be more than one definition for backdoor. That being said, for our purposes, a backdoor is any undocumented remote access to the system. All responses have been thoughtful and are appreciated.

Answer 1

I don't think there is such "standard" and I don't think there can be one. It is hard or impossible to find out if a vulnerability was accidentally added as a byproduct of bad design or bad development process, slipped through even though both design and development process were fine or was intentionally added to a good design but well hidden to look harmless as in The Underhanded C Contest etc. There are probably some cases where a specific issue can be traced back to malicious intend but in most cases this is not possible.

Answer 2

If you browse through a CISSP manual you will find that this high level security course actually touches on back doors for systems. Universally, it states that such back doors are of poor design, even if they are made with the best of intentions. Any backdoor can be discovered and executed against a known entity and is therefor a major security risk. As such, creating a "standard" for this bad practice would be equivalent to saying there's a minimum approved number of malwares you can have on your computer before you need to take action.

That said, there have been many attempts by NSA, NIST, and other government entities (around the globe I might add) to influence developers to leave such backdoor. The consistent feedback from the security community is that backdoors have no method to learn the intent of the user and prevent malicious individuals from coming through. This is especially apparent when you look at industries such as healthcare where 65% of there attackers are internal threats. The only standard, then is to not have back doors.

Answer 3

What is required for a backdoor

By definition, a backdoor is created by someone with access to the system or code in question in order to facilitate future access.

A backdoor is software functionality built or installed by someone intentionally. In contrast, a typical vulnerability has no purpose. A typical vulnerability is the result of an accident or oversight by a developer, integrator, or administrator.

How to identify one

There is no definitive standard for identifying a backdoor. This is usually judged by considering the method by which it operates as well as whether it appears to be designed rather than accidental.

The overriding concern is whether the party who created it would also be the one to use it (or, perhaps, to sell access to it).

Examples

E.g., if a login utility always accepts a specific undocumented username/password, then it is likely a backdoor. It is quite reasonable to assume that a developer coded that functionality specifically to allow him access.

On the other hand, it could be a simple truncation bug or "performance" tweak if a login utility is built so that it only uses the first 8 characters of a password to generate a hash. Obviously, this makes the system vulnerable to brute forcing or rainbow table attacks, but there is no clear basis to presume that the developer would exploit it.

Answer 4

These answers really don't seem appropriate.

The answer (in my book) is No, there is not a standard... because the usage of the term 'Backdoor' to refer to 'accidental vulnerabilities' is incorrect. The terminally 'Backdoor' refers very clearly to a subset of a computer virus. Not surprisingly then, the anti-virus industry came up with naming conventions and terminology for categorising groups and strains of computer virus many many years ago. The one for a Backdoor... simple... 'Backdoor'.

A backdoor thats only seen as a windows 32-bit binary? easy. 'W32/Backdoor' or 'Backdoor.Win32' (the anti-virus products agree for the most part on lots of naming conventions, but do seem conflicted on others [assuming i am interpreting the names right]).

How about a Backdoor, thats a windows 32-bit binary, that has its own cool name 'DoubleAgent'? Easy again... 'Backdoor.Win32.DoubleAgent.c'.

I'd encourage you to go to https://www.virustotal.com/ and search for 'backdoor'. Check out any of the millions of uploaded virus samples and look at the different names that anti-virus products have given them. Its a really interesting space, but they will all share one commonality... 'Backdoor'.