4 ms·
What's a Ken Thompson attack?
by mwint 5y ago
What's a Ken Thompson attack?
- Jtsummers 5y agohttps://www.cs.cmu.edu/~rdriley/487/papers/Thompson_1984_ReflectionsonTrustingTrust.pdf https://www.cs.cmu.edu/~rdriley/487/papers/Thompson_1984_Ref... Ken Thompson, Reflections on Trusting Trust. EDIT: I don't think I've seen 5 nearly simultaneous replies sharing the same link before.
- ksec 5y ago>EDIT: I don't think I've seen 5 nearly simultaneous replies sharing the same link before. LOL I was searching for a non-PDF link and delayed the reply. It would have been 6 simultaneous answer.
- febstar 5y agoMost likely referring to "Reflections on Trusting Trust" [0]; i.e. when the compiler is itself the attack vector. [0]: https://www.cs.cmu.edu/~rdriley/487/papers/Thompson_1984_ReflectionsonTrustingTrust.pdf https://www.cs.cmu.edu/~rdriley/487/papers/Thompson_1984_Ref...
- esarc 5y agohttps://www.cs.cmu.edu/~rdriley/487/papers/Thompson_1984_ReflectionsonTrustingTrust.pdf https://www.cs.cmu.edu/~rdriley/487/papers/Thompson_1984_Ref...
- bombcar 5y agohttps://www.cs.cmu.edu/~rdriley/487/papers/Thompson_1984_ReflectionsonTrustingTrust.pdf https://www.cs.cmu.edu/~rdriley/487/papers/Thompson_1984_Ref... How do you prove your stack is secure?
- gmfawcett 5y agoSolution: the compiler for the microlanguage at the bottom of the stack is none other than the kindly and incorruptible American film star, Tom Hanks.
- mindcrime 5y agoI believe the person you are replying to is using that as an allusion to the issues discussed in the famous "Reflections on Trusting Trust" paper[1] by Ken Thompson. [1]: https://www.cs.cmu.edu/~rdriley/487/papers/Thompson_1984_ReflectionsonTrustingTrust.pdf https://www.cs.cmu.edu/~rdriley/487/papers/Thompson_1984_Ref...
- deleted 5y ago[deleted]
- nl 5y agoKen Thompson's "cc hack" - Presented in the journal, Communication of the ACM, Vol. 27, No. 8, August 1984, in a paper entitled "Reflections on Trusting Trust", Ken Thompson, co-author of UNIX, recounted a story of how he created a version of the C compiler that, when presented with the source code for the "login" program, would automatically compile in a backdoor to allow him entry to the system. https://www.win.tue.nl/~aeb/linux/hh/thompson/trust.html https://www.win.tue.nl/~aeb/linux/hh/thompson/trust.html The paper's a pretty entertaining read: > First we compile the modified source with the normal C compiler to produce a bugged binary. We install this binary as the official C. We can now remove the bugs from the source of the compiler and the new binary will reinsert the bugs whenever it is compiled. Of course, the login command will remain bugged with no trace in source anywhere.
- ksec 5y agoReflections on Trusting Trust - Ken Thompson https://wiki.c2.com/?TheKenThompsonHack https://wiki.c2.com/?TheKenThompsonHack
- deleted 5y ago[deleted]