3 ms·

A variation of the threat very much exists: Do you know (meaning, there are no unknown unknowns) that no piece, anywhere in your toolchain (OS, compiler, librar

A variation of the threat very much exists: Do you know (meaning, there are no unknown unknowns) that no piece, anywhere in your toolchain (OS, compiler, library, framework, buildtool, CI etc), contains malicious code? At the time Thompson made this comment, he talked about the C compiler because it was the one bit of shared code everything else depended on. Today, the attack surface is much, much larger. If I was running a foreign intelligence service (or a sophisticated mafia operation (potato, potato)), I'd target trusted members of the communities around popular open source projects. A high ranking committer to a library that Rails depends on slips in a bit of clever code in a fix for a legitimate problem, and I can compromise a large number of websites.

eli 14y ago
Sure, but it sounds like you're talking about a standard hidden backdoor. This is a pretty straightforward and obvious threat. What Thompson describes is a whole lot more devious and difficult to detect.
- mseebach 14y ago
  The crude variation of the attack-vector I'm describing is a backdoor, that is correct - but that's also what Thompson is imagining his attack being used for. Thompson's scenario is more devious, more difficult to detect, and a lot, lot harder to implements (near impossible, as some of the SO answers point out). But at that time, people didn't generally download millions of lines of code written by perfect strangers and incorporate them into their programs, so that was the only way to pull such a thing off.
patio11 14y ago
I think you vastly overestimate the difficulty of getting a code execution bug on Rails relative to the resources of a nation-state. You don't need to do anything remotely suspicious; just hire vulnerability researchers. They're ridiculously cheaper than aircraft carriers. Or, to put it another way, anybody with $20k can uncover an RCE in Rails without needing to suborn any community member.
- tptacek 14y ago
  $20k is too low, but your point stands.
SkyMarshal 14y ago
>I'd target trusted members of the communities around popular open source projects. I'm sure everyone here is already aware, but the FBI may have already experimented with that: http://arstechnica.com/information-technology/2010/12/fbi-accused-of-planting-backdoor-in-openbsd-ipsec-stack/ http://arstechnica.com/information-technology/2010/12/fbi-ac...

eli 14y ago

Sure, but it sounds like you're talking about a standard hidden backdoor. This is a pretty straightforward and obvious threat. What Thompson describes is a whole lot more devious and difficult to detect.

mseebach 14y ago
The crude variation of the attack-vector I'm describing is a backdoor, that is correct - but that's also what Thompson is imagining his attack being used for. Thompson's scenario is more devious, more difficult to detect, and a lot, lot harder to implements (near impossible, as some of the SO answers point out). But at that time, people didn't generally download millions of lines of code written by perfect strangers and incorporate them into their programs, so that was the only way to pull such a thing off.

patio11 14y ago

I think you vastly overestimate the difficulty of getting a code execution bug on Rails relative to the resources of a nation-state. You don't need to do anything remotely suspicious; just hire vulnerability researchers. They're ridiculously cheaper than aircraft carriers. Or, to put it another way, anybody with $20k can uncover an RCE in Rails without needing to suborn any community member.

tptacek 14y ago
$20k is too low, but your point stands.

SkyMarshal 14y ago

>I'd target trusted members of the communities around popular open source projects. I'm sure everyone here is already aware, but the FBI may have already experimented with that: http://arstechnica.com/information-technology/2010/12/fbi-accused-of-planting-backdoor-in-openbsd-ipsec-stack/ http://arstechnica.com/information-technology/2010/12/fbi-ac...