5 ms·
Ken Thompson wrote a paper about trust that was published in ACM in '84 entitled "Reflections on Trusting Trust". He makes the case for a trojan that could be b
by xav0989 6y ago
Ken Thompson wrote a paper about trust that was published in ACM in '84 entitled "Reflections on Trusting Trust". He makes the case for a trojan that could be built in such a way that it would infect a compiler, self-replicate into new versions of the compiler, and inject itself into specific binaries; all without appearing in the source code of the new versions of the compiler or the target binary.
Arguably, the probability of such an attack is extremely low--slim to none might be an overstatement--but it's an interesting thought exercise.
- IggleSniggle 6y agoI remember reading about this attack being implemented and executed in a university system decades ago. Perhaps apocryphal, but it didn’t seem that way.
- SifJar 6y agoYou're possibly thinking of this: https://www.quora.com/What-is-a-coders-worst-nightmare/answer/Mick-Stute https://www.quora.com/What-is-a-coders-worst-nightmare/answe...
- IggleSniggle 6y agoThat's the one!
- david_draco 6y agoAll the godbolt users looking at their binaries from various compilers would quickly notice this, I think.
- jhardy54 6y agoIt doesn't need to go in every binary, the conventional attack only outputs the malware when it's compiling a compiler or sudo (or something).
- coddle-hark 6y agoFor what it’s worth you can detect a “trusting trust” attack using Diverse Double Compiling. David A. Wheeler implemented it as part of his dissertation back in 2009 and verified that gcc had not been infected. https://dwheeler.com/trusting-trust/ https://dwheeler.com/trusting-trust/
- im3w1l 6y agoI read the abstract and it seems kind of obvious: Yes if you have a trusted compiler you can bootstrap another. But have can we know the "trusted compiler" is really to be trusted?