A backdoor on Linux/UNIX Systems - Computer Networks
A backdoor is any deliberate or covert mechanism that allows someone to bypass normal authentication or access controls on a system.
On Linux this can appear as malicious userland binaries, kernel/rootkit modules, modified system libraries, compromised update packages (supply-chain), or even firmware/bootloader changes.
Many classification and adversary-technique frameworks (e.g., MITRE ATT&CK) treat backdoors as a persistence/remote-access capability used after initial access.
_________________________________________
Common types:
* daemons, shell scripts, or hidden processes that accept commands or open reverse shells.
* malicious kernel modules or hooks that hide files/processes or intercept syscalls.
* legitimate projects with malicious commits or trojaned binaries.
* backdoors that hijack or bypass SSH authentication.
* ICMP, DNS, BPF or other protocol channels used to receive commands.
_________________________________________
How to detect a backdoor?
Look for anomalies rather than a single “smoking gun".
* Unexpected new users, scheduled tasks (cron/systemd timers), or setuid binaries.
* Unknown or persistently listening network services (esp. with unusual ports/protocols).
* Processes without clear parentage or with odd command lines.
* Modified system utilities or libraries (library loaders, ld.so, PAM modules).
* New kernel modules or unexpected changes in syscall behavior (rootkit signs).
* Outbound connections at odd times or to suspicious domains/IPs.
_________________________________________
Use integrity and visibility tooling to find anomalies:
* Package verification
Rpm -V, dpkg --verify / debsums to detect modified packages.
* Process and socket inspection
Ps aux, ss -tulpn, lsof -i.
* Kernel modules
Lsmod, cat /proc/modules; check module provenance.
* Rootkit scanners / integrity tools
Rkhunter, chkrootkit, AIDE/tripwire (these can help but aren’t foolproof).
* Audit and logging
Enable auditd rules for sensitive binaries, and centralize logs (syslog/ELK/Splunk) to search for anomalies.
* YARA/IOC scanning
Scan files and memory for known malware signatures if we have IOCs from threat intel.
_________________________________________
Hardening:
* limit SSH access (key-only, forced command, limited user shells), use jump hosts, and segment management networks.
* pin trustworthy package sources, use reproducible builds where possible, enable package signing checks, and monitor upstream project commit activity for unusual changes.
* use 2FA for accounts that can modify systems, and centralize admin access via bastion hosts and short-lived credentials.
* deploy endpoint monitoring that tracks process creation, network connections, and kernel module loads.
* keep tested, offline backups and a recovery plan in case of compromise.
* subscribe to reputable intel feeds and CIRT advisories to map indicators to systems quickly.
Enjoy #linux
Well, that was exciting. See you in the next one!