It's not a static binary either, it's a script: $ file `which ldd` /usr/bin/ldd: Bourne-Again shell script text executable It's also worth reading up on L

It's not a static binary either, it's a script: $ file `which ldd` /usr/bin/ldd: Bourne-Again shell script text executable It's also worth reading up on LD_TRACE_LOADED_OBJECTS and the possible exploits therein, e.g. http://news.ycombinator.com/item?id=902958 http://news.ycombinator.com/item?id=902958 If the attacker were a little more clever, they could have faked bogus ldd output too.