Runtime backdoor

Code Security Container Security Open Source Security

A runtime backdoor attack is a type of cyber attack where an attacker gains unauthorized access to a computer system or network and installs a malicious software or code that allows them to control the system or steal sensitive information.
This type of attack is called a "runtime" backdoor attack because it involves manipulating the system at runtime, while it is running, rather than during the development or deployment stages.
The attacker typically gains access to the system through a vulnerability, such as an unpatched software flaw or weak authentication mechanism.
Once inside, the attacker can install a backdoor that provides them with persistent access to the system, even after the initial entry point has been closed.

Where this idea came from

Security research

Identified in published CI/CD or supply-chain security research cited below.

Mitigations

M1720 Implement regular patches and updates
M1500 Verify third-party artifacts and open-source libraries
M1501 Require SBOM from all third-party suppliers
M1502 Define trusted package managers and repositories
M1503 Implement SCA analysis

Detections

D1510 Implement Intrusion Detection System and anti-malware
D1520 Implement endpoint detection and response system

Runtime backdoor

Where this idea came from

Mitigations

Detections

Observed in incidents (84)

References