Trusting-Trust Attack against an Entire Linux Distribution (via the strip utility)
48 points by MarkMLl
48 points by MarkMLl
"Ken Thompson's trusting-trust attack, in which a compromised compiler backdoors the programs it builds and reproduces the backdoor in subsequent rebuilds of itself, is widely regarded as a threat specific to compilers. We show that it is not."
A few weeks ago I came across this https://www.teamten.com/lawrence/writings/coding-machines/ : it's clearly fictional (and furthermore is "pre-AI" in that it was written in 2009) but is interesting in that it raises the question of whether one or more computers could- without "intention" embed code meeting the "trusting trust" criteria in GCC.
They actually built it! Neat. Thompson's attack is fun but I always understood it to be a thought experiment.
while strip is not a compiler it is a thing that manipulates executables. It's not too surprising it could be used to subvert the output. I imagine ld is similarly targetable, as is anything like cp which is copying data around.
The article gets to this in a later section: all this work on reproducible builds and hand-verifiable bootstraps seems practically useful. What's the status of this 2023 Guix bootstrapping now? Is anyone doing something similar for mainstream Linux systems?
It seems, from what I can tell, that Thompson did actually do it at the time.
Guix still uses that bootstrap seed. Guix being a functional package manager and having a policy of building everything from source when possible makes it more straightforward to ensure that other packages are actually rooted in the bootstrap seed. (There are a few examples where that hasn't been possible so far, e.g. haskell, but coverage is pretty good from what I can tell.)
I would guess that NixOS is the other distro where this is most feasible, and it looks like someone has done a lot of work towards a full-source bootstrap there, but I don't think that's in nixpkgs as of now.
Nixpkgs uses the same(-ish, I think) hex0 based chain for {i686-x86_64}-linux, for what it's worth: https://github.com/NixOS/nixpkgs/blob/master/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/hex0.nix
Thompson's attack is fun but I always understood it to be a thought experiment.
In a recent post here on lobsters there was an interview with an old-timer who shared some details about what happened: https://lobste.rs/s/xiwynb/tmp_0ut_volume_5 -> https://tmpout.sh/5/2.html (search for "trusting trust")
Russ Cox asked Ken Thompson for the original code, got it to work on Unix V6, and posted instructions so you can do it too — in a browser!
The paper does say that Thompson implemented a prototype, which he presumably euthanised.
It's unclear at present how much of BFD and/or Gold is potentially compromised, but at the very least I anticipate that this will provide a big boost to the "reproducible builds" incentive.
The dynamic loader (ld-linux.so) could be a fun target as well, injecting the payload into loaded executables.
I highly recommend this podcast rendition: https://lobste.rs/s/oukekp/coding_machines_fiction