&gt; Why did they store the plaintext instead of a hash?<p>Since we haven&#x27;t seen the source it&#x27;s difficult to speculate but I would venture to guess that the less function calls around your backdoor the better. It may look weird putting the code in another place where hash comparisons may be needed but in the place they put it where it&#x27;s plaintext must have been harder to notice.