1

Every article I have read on backdoor attack prevention says pretty much this:

Protecting against them may be difficult.

I am tired of reading how it can be ~difficult~ to protect against. Difficult is a fuzzy word. I want to know concretely, yes or no. If you can protect against them or not. Wondering if one could answer yes you can protect against them, or no ultimately you cannot, along with a brief reason why. I don't care that it is difficult, I would prefer to know if there is anything possible to implement to be secure.

I am pretty sure there are a class of things that are completely unprotectable, such as firmware updates which may insert undetectable code below the operating system. So it would be good if the answer could be divided into two sections, the things that can't be protected against (firmware updates which may inject malware), and things that can be protected against at the boundary of all possible things to protect against. That is, there's a huge amount of things you could protect against, so outlining them all is way too much. But there is probably a very small amount of things right at the edge of the most difficult to detect things. I would like to know what those things are that are extremely difficult to detect, yet are still 100% detectable. I don't want to know about the things in which ~you might be able to detect it~ or ~it is difficult to detect~. Only if it is guaranteed detectable, given enough knowledge, the things at the edge of difficulty. Things in which it would take millions of computation-years to break like password hashes are considered undetectable for this post. I am only wondering about things in which, if you are educated enough, you could detect in a matter of a few months of work or something.

Another example of how this is confusingly presented is this:

Generally if they’re a good hacker, you never will know. One of the only ways to know for sure is to use another computer to “sniff” the network traffic coming in and out of your computer to see if there’s anything that seems out of the ordinary.

To me that says:

You cannot detect it if they are good. But you can still detect it.

That is, it's an oxymoron.

3

I'm not really sure what you are asking. For me it looks like you are mainly complaining about the fuzzy answers you get regarding backdoors and you'll like to get some clear yes|no answers which kinds of backdoors can be found and which can not be found. Only it is not that simple.

First, while "backdoor" sounds like it was deliberately added and many are, most backdoors into systems probably result from inadvertently added bugs which can be used as backdoor by a knowledgeable attacker (and then of course the backdoors done with the help of inside users by employing phishing mails or similar).

In theory all such backdoors/bugs can be found given unlimited time and resources - only nobody has unlimited time and resources. But with more time and resources more backdoors can be found, i.e. the ability of detecting backdoors is related to the amount of money one can throw at the problem. Only, the ones who have a lot of money are usually also the ones who are most likely to get attacked with the more advanced and hard to find backdoors since the purpose of the backdoors is ultimately to get a high return on investment - and the more money or equivalent (information, data...) are there the more attractive the target is.

Backdoors might be explicitly added or just happen (i.e. bugs) at lots of places, like in the firmware of network cards, CPU, graphic card, USB controllers, printers ..., in mainstream software like Windows or other OS, Office, browser extensions, some arbitrary software downloaded from the internet, ... . Backdoors might also exist at the hardware level, like a specific sequence of CPU instructions might switch off memory protection or similar or side channels (like Meltdown) allow reading over memory protection barriers.

In order to fully protect against backdoors one must either be aware of all possible backdoors and how they work or one must be sure that no backdoor exists at all. This means that one must either create all hardware, firmware and software oneself and never make a serious bug, or one need to get these things from vendors one can fully trust (i.e. 100.00% - 99.99% is not enough) to never add an explicit backdoor and to never add serious bugs. Even if one will find such vendors (unlikely) these usually need to rely on other vendors and there the trust problem is the same.

The best strategy against backdoors is probably to assume that there will always be some backdoor or bug. The goal is then to make sure that there are as few backdoors/bugs as possible and to make sure that their impact will be as low as possible. This means to buy only from really trustable vendors where one can also (mostly) trust their delivery chain but also to add resilience against possible backdoors/bugs in strategic places. This might for example be a strict firewall which only allows connections to a few places or this might be use of IPSec or similar inside the local LAN since one does not fully trust switches and routers and physical network cards. This means also to isolate different parts of the network from each other but also isolation at the application level (sandboxes, containers, privilege segmentation techniques...) or the OS level (microkernel). This means also to use only the really necessary software and hardware etc. The simpler and the stricter defined an environment is, the easier it can be audited for possible vulnerabilities and the better possible attack vectors can be determined and addressed.

  • In addition to Steffen's answer, do consider that threats change and new detection technologies change along (albeit slower). What may be a right answer today, may not be valid tomorrow. – Lucas Kauffman Dec 30 '18 at 17:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.