These backdoors could be run on the SMTP port, which many firewalls allow traffic to pass for e-mail. UDP Shell Backdoors Administrator many times can spot a TCP connection and notice the odd behavior, while UDP shell backdoors lack any connection so netstat would not show an intruder accessing the Unix machine. Many firewalls have been configured to allow UDP packets for services like DNS through. Many times, intruders will place the UDP Shell backdoor on that port and it will be allowed to by-pass the firewall. ICMP Shell Backdoors Ping is one of the most common ways to find out if a machine is alive by sending and receiving ICMP packets.
Many firewalls allow outsiders to ping internal machines.
An intruder can put data in the Ping ICMP packets and tunnel a shell between the pinging machines. An administrator may notice a flurry of Ping packets, but unless the administrator looks at the data in the packets, an intruder can be unnoticed. An administrator can set up a sniffer trying to see data appears as someone accessing a shell, but an intruder can add encryption to the Network traffic backdoors and it becomes almost impossible to determine what is actually being transmitted between two machines. Because Windows NT does not easily allow multiple users on a single machine and remote access similar as Unix, it becomes harder for the intruder to break into Windows NT, install a backdoor, and launch an attack from it. As Windows NT advances in multi-user technologies, this may give a higher frequency of intruders who use Windows NT to their advantage.