Trusting-Trust Attack against an Entire Linux Distribution (via the strip utility)

58 points by MarkMLl 22 hours ago on lobsters | 11 comments

nelson | 18 hours ago

They actually built it! Neat. Thompson's attack is fun but I always understood it to be a thought experiment.

while strip is not a compiler it is a thing that manipulates executables. It's not too surprising it could be used to subvert the output. I imagine ld is similarly targetable, as is anything like cp which is copying data around.

The article gets to this in a later section: all this work on reproducible builds and hand-verifiable bootstraps seems practically useful. What's the status of this 2023 Guix bootstrapping now? Is anyone doing something similar for mainstream Linux systems?

jfred | 17 hours ago

It seems, from what I can tell, that Thompson did actually do it at the time.

Guix still uses that bootstrap seed. Guix being a functional package manager and having a policy of building everything from source when possible makes it more straightforward to ensure that other packages are actually rooted in the bootstrap seed. (There are a few examples where that hasn't been possible so far, e.g. haskell, but coverage is pretty good from what I can tell.)

I would guess that NixOS is the other distro where this is most feasible, and it looks like someone has done a lot of work towards a full-source bootstrap there, but I don't think that's in nixpkgs as of now.

winter | 14 hours ago

Nixpkgs uses the same(-ish, I think) hex0 based chain for {i686-x86_64}-linux, for what it's worth: https://github.com/NixOS/nixpkgs/blob/master/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/hex0.nix

Russ Cox asked Ken Thompson for the original code, got it to work on Unix V6, and posted instructions so you can do it too — in a browser!

Running the “Reflections on Trusting Trust” Compiler

tomsmeding | 16 hours ago

Thompson's attack is fun but I always understood it to be a thought experiment.

In a recent post here on lobsters there was an interview with an old-timer who shared some details about what happened: https://lobste.rs/s/xiwynb/tmp_0ut_volume_5 -> https://tmpout.sh/5/2.html (search for "trusting trust")

mutagen | 5 hours ago

Thanks, that tmpout.sh interview is an awesome read, such a great look back into the beginnings of computing history.

[OP] MarkMLl | 17 hours ago

The paper does say that Thompson implemented a prototype, which he presumably euthanised.

It's unclear at present how much of BFD and/or Gold is potentially compromised, but at the very least I anticipate that this will provide a big boost to the "reproducible builds" incentive.

sammko | 12 hours ago

The dynamic loader (ld-linux.so) could be a fun target as well, injecting the payload into loaded executables.

altano | 14 hours ago

I highly recommend this podcast rendition: https://lobste.rs/s/oukekp/coding_machines_fiction

[OP] MarkMLl | an hour ago

My OP included a link to the original author's version, where he could- if he chose- profit from advertising etc.

I suggest that it is more appropriate to use that, rather than promote somebody else who seeks to benefit from his creativity (whose transgression is, however, lessened by providing a link to Thompson's paper etc.).

This is like objecting to your people performing Shakespeare on the stage or people linking to a YouTube video of a performance. Adam created a wonderful derivative work and gave Thompson lots of credit. I don’t understand the objection.