In this lesson, we'll cover backdoors and logic bombs.
Now, a backdoor is originally placed
into computer programs to bypass the normal security
and authentication functions of those systems.
Now, if this sounds like a horrible idea to you,
you're right,
because it really is a horrible security practice.
So why were backdoors created
in some of our applications and programs?
Well, it's actually something
that goes all the way back to the 1980s
because manufacturers and programmers
were adding in these back doors
as a way to get back into their system
to do maintenance and repairs
without having to go through all the authentications
or going through the firewalls
and all the layers of security
that they normally would if they went through
the public facing portions of that application.
Now, back in the 1980s and 1990s
and even into the early 2000s,
backdoors were a commonplace thing
that was put into our applications by programmers.
But in modern networks, we consider this
to be a breach of secure coding best practices,
even though you'll still find some programmers
who add backdoors into their code.
So these days, most software will not have a backdoor
because they've been patched up
because we know how bad these things are for security
but there is still some things out there
that act like back doors.
Do you know what those might be?
Well, it's a Remote Access Trojan.
Now, a Remote Access Trojan can be placed by a threat actor
onto your computer to help them maintain
persistent access to your system.
So if an attacker is able to trick one of your users
into clicking on a sphere phishing link in an email,
they may be able to install some kind of malware
based on clicking that link, and now they have something
that can create a callback connection to their system.
This callback to the remote system
will then allow the attacker to connect to your system
while bypassing the system's default security posture.
And this allows a remote access Trojan
to basically act like a backdoor
in order to allow the attacker to gain access to your system
anytime they want.
Next, we need to talk about something
known as an Easter Egg.
Now, Easter Eggs are another insecure coding practice
that was used by programmers to provide a joke
or gag gift to their users.
Essentially, there would be different things
that would happen in different video games
or different pieces of software
when certain pieces of code were executed.
For example, several years ago,
Google added an Easter Egg into their search application
and you can actually still access it today.
If you want to try it out,
simply head over to google.com right now
and type in do a barrel roll into the search bar
and then press enter.
Then you'll see the whole webpage do a 360 degree rotation
as if it was doing a barrel roll inside of an airplane.
Now, this code has no real function
except to act as a joke or a gag
or a hidden secret inside of the search application.
And that is why this is considered to be an Easter Egg
because the Google programmers
decided to put this silly feature into the code
for the company's most widely used product,
the Google search bar.
Now in general,
you're going to find Easter Eggs are pretty harmless
but they do add additional code into the applications
which could create some additional vulnerabilities
that a threat actor could exploit.
Now, over the years, I have worked as a penetration tester
and I have found that Easter Eggs
generally have more vulnerabilities associated with them
than the rest of the application.
And the reason for this is that this type of code
that creates the Easter Egg is usually meant as a joke
and it's added right before a product
is going to be released.
And this means it doesn't always go through
the same rigorous forms of security testing
that the rest of the application did.
Now, you may be wondering
why am I talking about Easter Eggs inside of this video?
Well, it's because Easter Eggs
are closely linked to logic bombs.
Now, logic bombs is the next thing we're going to talk about.
And as I said, they're very similar to Easter Eggs
and many consider them to be an evolution
of earlier Easter Eggs
but they have a more malicious intent.
Logic bombs are a type of malicious code
that's inserted into a program and that malicious code
will only execute when certain conditions have been met.
For example, a disgruntled employee may insert a logic bomb
into the server's code so that the program
will query the company's active directory server
every single day at midnight.
If that disgruntled employee's account was terminated
because they got fired, then that malicious code
will perform some kind of bad action
like deleting all the files on the server
or transferring money from the corporate bank account
over to the employee's personal bank account
anytime they find that this account was deleted
by the system when they do their midnight checks.
Now, one of my favorite examples of a logic bomb
actually comes from the classic 1993 movie "Jurassic Park."
In the movie, the parks programmer Dennis Nerdy,
decides he's going to put a logic bomb into the computer system
that's operating the power grid
that is going to keep all the dinosaurs inside
their electrified enclosures.
His logic bomb is designed to shut down the power
for a few minutes so he can run in,
steal some dinosaur embryos, and then sell them to get rich.
Now everything begins to go according to his plan.
At the designated time,
the power is cut off to the enclosures
and Dennis is able to sneak out of the room,
go past all the alarms,
because there's no power to them anymore,
and get into the nursery
to steal some of those dinosaur embryos.
He thinks he's going to get off
and sell those embryos and become a millionaire.
Of course, it all goes bad for him
and the dinosaurs are running rampant in the park
because he turned off the electrical grid
and he ends up getting killed by one of those dinosaurs.
Now, that's not really the point here,
but instead I want to provide you with a classic example
of a logic bomb 'cause he set up some malicious code
to create an action at a certain time
and he had this malicious intent when he did it.
So remember, a backdoor is a covert method
of bypassing normal authentication or security controls
in a system that's often introduced
by the system's original designers or programmers.
An Easter Egg is going to be a hidden feature
or novelty within a program that's typically inserted
by the software developers as an inside joke,
and a logic bomb is the type of malicious code
that's inserted into a piece of software
that will then execute a harmful action
when specific conditions have been met.
In our modern applications,
we should never include back doors,
Easter Eggs or logic bombs
because they do go against our secure coding standards
and best practices.
So you want to make sure you're scanning
your customer developed applications
to ensure that none of these three things
are included in them if you want to ensure
that you have the most secure network for your organization.