Many times, these backdoors allow an intruder to get past TCP Wrapper technology. These backdoors could be run on the SMTP port, which many firewalls allow traffic to pass for e-mail. Many firewalls have been configured to allow UDP packets for services like DNS through. Many times, intruders will place the UDP Shell backdoor on that port and it will be allowed to by-pass the firewall. Ping is one of the most common ways to find out if a machine is alive by sending and receiving ICMP packets.
Many firewalls allow outsiders to ping internal machines.
An intruder can put data in the Ping ICMP packets and tunnel a shell between the pinging machines. An administrator may notice a flurry of Ping packets, but unless the administrator looks at the data in the packets, an intruder can be unnoticed. Because Windows NT does not easily allow multiple users on a single machine and remote access similar as Unix, it becomes harder for the intruder to break into Windows NT, install a backdoor, and launch an attack from it. As Windows NT advances in multi- user technologies, this may give a higher frequency of intruders who use Windows NT to their advantage. And if this does happen, many of the concepts from Unix backdoors can be ported to Windows NT and administrators can be ready for the intruder.