I’ve heard the name come up a lot recently when talking about the new Lua U, and I’ve always assumed it’s a vulnerability that lets exploiters to access server-side by abusing some RemoteEvent. Is this correct, or do I have it all wrong?
9 Likes
I suggest searching up a definition before posting here as a backdoor isnt only limited to roblox its best to just search up a term before asking.
8 Likes
Back door is just hole in security
A backdoor put simply: A vulnerability in your code that allows unwanted users to access and execute custom (or a few premade) commands.
In Roblox, many models have intentional backdoors that allow select people to execute commands, for instance killing people. Hopefully this clarifies the definition for you.
1 Like
“a feature or defect of a computer system that allows surreptitious unauthorized access to data.”
Essentially. For example if somebody had a backdoor to your PC then they could bypass all security (Depending on backdoor severity) to get to your data. If the new Lua VM had a backdoor then it might allow something like easier access to client side data which could in turn lead to an abuse of remotes much easier.
They can’t really get server side data unless you got a remote that can give it to them.
1 Like
A backdoor is when someone is able to get in and use the core of your system when they really shouldn’t be able to.
We can prevent this happening by securing our Remote Events and Functions.
How do we secure them? Server Side Checking.
Example
When firing a Remote Event to purchase an item from the shop you need to check on the server (which is the most important part) if the player can afford the item.
If they can? Give it to them.
If they can’t? Don’t.
If you don’t have that check on the server then an exploiter can fire the Remote Event and get all the items for free.
3 Likes
Generally in the outside world, backdoors allow hackers to gain complete access to your computer, and can even insert files, delete stuff, and such. I’ve once had a backdoor-recieved file with an imposter of sethc.exe on my Windows PC long ago. And as you’d expect, it was an undetected virus, and wrecked my old PC as usual. So basically my 100th re-install of Windows 10.
As in Roblox backdoors, they’re mostly common in free models that are botted (e.g. over 100k takes with only at least 10 thumbs-ups, that’s when you know it’s fake.) and contain well-hidden code lines such as getfenv() and setfenv(). But then you realize that they’re not visible in the backdoor model’s script(s).
Okay, now actually back to what it does. Simply put, it allows the owners of those “backdoor free models” to gain full access to the place that you put it in. Before it was just done with loadstring(), a heavily exploited use to execute powerful code, and it allowed them to do anything they wanted with the place.
Loadstring is already disabled by default but these “backdoor models” have still found some workarounds. So just don’t trust free models.
17 Likes
I’d recommend removing this. Data from the Server such as Player Data (what else would you get tbh) is harmless and safe. In a lot of games there are systems that let you view information about a player such as their stats in the game.
Practice nuance and less assumptions about what I am saying! 
backdoor thing is script in your roblox game
backdoor is giving acces to whitelisted players and this players can acces to data store , banning player, stealing players items , etc.
for example :
server-sided executer aka ss executer, this things are script executer and danger