5 ms·
Sounds fascinating. Are there real-world examples of malicious compilers?
by et2o 6y ago
Sounds fascinating. Are there real-world examples of malicious compilers?
- 411111111111111 6y agoi read a story about a compiler adding malware to the compiled binary once. they kept getting owned until they supposedly found a pretty dump hack which just appended the backdoor to the final compilation on the build server... no clue if it was just a story though, as i personally havent experienced anything like that before.
- gryfft 6y agoI don't think this is what you're looking for, but Coding Machines[1] is a great little story in which the Ken Thompson hack[2] plays a role. [1]https://www.teamten.com/lawrence/writings/coding-machines/ https://www.teamten.com/lawrence/writings/coding-machines/ [2]https://www.win.tue.nl/~aeb/linux/hh/thompson/trust.html https://www.win.tue.nl/~aeb/linux/hh/thompson/trust.html
- dwheeler 6y agoYes, that's right, that's another story about a subverted compiler. I don't have any way to verify it, but I have no reason to doubt the story. It is quite possible, and not even that difficult to do if you want to be that malicious. I don't have a URL for it, maybe someone else can provide that.
- dwheeler 6y agoYes, there was a malicious compiler system for Apple iOS that was released in China a few years back and subverted a large number of mobile applications, including apps used in the US and Europe. There was also a subverted Delphi compiler a number of years back, though I don't think the subversion was dangerous it was more like a test case. And of course, Ken Thompson demonstrated the attack in the 1980s. There may be others, but I remember those offhand.
- philsnow 6y agoIIRC this was feasible because people in China are behind the GFW which throttles/blocks the mac app store, so most people download from in-country caches, which circumvents a lot / all of the app signing that Apple uses.