Search papers, labs, and topics across Lattice.
This paper extends the concept of the trusting-trust attack beyond compilers by demonstrating a complete attack vector using the GNU strip utility, which manipulates finished ELF binaries without requiring source code access. The authors successfully implant a backdoor in the NixOS Linux distribution's bootstrap process, showcasing how a single compromised binary can propagate malicious payloads through successive generations of builds. Their findings reveal that nearly all binaries in the final environment can be compromised, highlighting a critical vulnerability in the software supply chain.
A single compromised utility can backdoor an entire Linux distribution, compromising nearly all binaries in the final environment.
Ken Thompson's trusting-trust attack, in which a compromised compiler backdoors the programs it builds and reproduces the backdoor in subsequent rebuilds of itself, is widely regarded as a threat specific to compilers. We show that it is not. We construct a complete trusting-trust attack around GNU strip, an ordinary build utility that neither inspects nor generates source code, using only manipulations of finished ELF files. In the bootstrap of the NixOS Linux distribution, a single tampered strip in the binary seed implants a payload that propagates from one generation of strip to the next and survives into the final standard environment after the seed leaves the dependency closure. On a real nixpkgs revision, the attack builds a complete graphical installer without failures and backdoors almost every one of its binaries, enabling arbitrary malicious behavior of the subverted packages.
