I've been reading about famous hacking groups targeting law firms, corporations and individuals. They always use remote access backdoors to get into a victim's computer or phone and lock the system with ransomware or steal files and information. This made me wonder if there's a way, no matter how complicated, to close or block these backdoors?
Operating System(s): Any
Short answer: possible, but not doable.
Long answer: not possible.
It's relatively easy to create a backdoor. Anyone with a minimal programming knowledge can search around and create another backdoor. Most of them will be easily detected, but some can evade detection. Add that to the almost unlimited ways to communicate with the command and control servers, and you see how is impossible to detect and block every backdoor.
I once saw a report on the Turla family of malware that used comments on a Britney Spears post to send the C&C server address to the agents. As usually Instagram is not blocked, and Britney looks like a famous person, nobody would suspect it was used as a malware communications channel. And sending data back is easy too: they can use Domain Fronting, DNS-over-TLS, DNS-over-HTTPS requests, even plain DNS queries.
That's why is impossible to a common user to detect backdoors by himself: too many possible infection vectors (Word macros, browser exploits, infected PDF files, phishing), too many C&C communication paths, and too many exfiltration paths too.
Backdoors targeting normal users (any user, not a specific individual) can be detected and stopped by anti-malware, antivirus and firewalls. Most of them are not sophisticated enough to bypass basic defenses. Keeping your defenses up to date is enough to protect you from most of them.
But backdoors aimed at large corporations, governments, high profile law firms and specific individuals are a different kind. They use undocumented features, abuse normal OS components to disguise their actions, mix with expected traffic, and are tested against the target defenses. Their owners research the environment first, and create a specific backdoor to bypass the target defenses. They are not the normal, off-the-shelf malware, and employ a lot of effort to remain hidden for as long as possible.
So it's useless to try? No. Employing strong defenses makes you not be a sitting duck and the lowest hanging fruit, so the attackers will look elsewhere. But if the attackers have plenty of time, skills, and strong financial/political motivation (and external funding), they can break any defense.
Sure, you observe all traffic to detect anomalous traffic. Whatever is not supposed to be there should be blocked.
Or, if you know what is supposed to be there, you simply block everything that you have not defined (block lists) or only allow what you have defined (allow lists).
Firewalls, IDS, anti-virus, sandboxes, proxies, and many other types of technologies are used to limit or block this type of traffic.
