miniblog.

← Back to all posts
Apr 20, 2014 at 17:28
Defeating 'trusting trust' attacks: https://www.schneier.com/blog/archives/2006/01/countering_trus.html Ingenious and elegant.
Countering "Trusting Trust" - Schneier on Security
Way back in 1974, Paul Karger and Roger Schell discovered a devastating attack against computer systems. Ken Thompson described it in his classic 1984 speech, “Reflections on Trusting Trust.” Basically, an attacker changes a compiler binary to produce malicious versions of some programs, INCLUDING ITSELF. Once this is done, the attack perpetuates, essentially undetectably. Thompson demonstrated the attack in a devastating way: he subverted a compiler of an experimental victim, allowing Thompson to log in as root without using a password. The victim never noticed the attack, even when they disassembled the binaries—the compiler rigged the disassembler, too...

Related Posts

Oct 19, 2022 at 00:56
Today I learnt about the NonNull<T> type in Rust: https://doc.rust-lang.org/nightly/core/ptr/struct.NonNull.html It's a *mut T that is never null. Rust is trusting you even more than a normal *mut T, which is slightly daunting.
NonNull in core::ptr - Rust
`*mut T` but non-zero and covariant.
May 22, 2020 at 08:24
I'd love to see a package repository where libraries had permissions like Android apps. It would simplify trusting obscure new libraries if I could see e.g. libfoo never accesses the network.
Nov 2, 2019 at 13:01
How do you prevent "trusting trust" attacks with malicious compilers? You don't need a trusted production-grade compiler. It's sufficient to have a really limited trusted compiler or even an untrusted compiler provided the triggers don't overlap.
Countering "Trusting Trust" - Schneier on Security
Way back in 1974, Paul Karger and Roger Schell discovered a devastating attack against computer systems. Ken Thompson described it in his classic 1984 speech, “Reflections on Trusting Trust.” Basically, an attacker changes a compiler binary to produce malicious versions of some programs, INCLUDING ITSELF. Once this is done, the attack perpetuates, essentially undetectably. Thompson demonstrated the attack in a devastating way: he subverted a compiler of an experimental victim, allowing Thompson to log in as root without using a password. The victim never noticed the attack, even when they disassembled the binaries—the compiler rigged the disassembler, too...