More specifically, we have source code S A of compiler A, and executable code E A and E T.

Suppose we have two completely independent compilers: A and T. Wheeler explains how to defeat this more robust attack. Since that will be done from time to time as bugs are fixed or features are added, a more robust form of of the attack adds a step: Whenever the compiler is itself compiled, it emits the code to insert malicious code into various programs, including itself.Īssuming broadly that the compiler source is updated, but not completely rewritten, this attack is undetectable. Now, this would be easy to get around by just recompiling the compiler. In a simple form, the attacker modifies the compiler binary so that whenever some targeted security code like a password check is compiled, the compiler emits the attacker’s backdoor code in the executable. To see how this works, look at the attack. This paper describes the technique, justifies it, describes how to overcome practical challenges, and demonstrates it. This technique has been mentioned informally, but its issues and ramifications have not been identified or discussed in a peer-reviewed work, nor has a public demonstration been made. If the result is bit-for-bit identical with the untrusted binary, then the source code accurately represents the binary. Simply recompile the purported source code twice: once with a second (trusted) compiler, and again using the result of the first compilation. This paper describes a practical technique, termed diverse double-compiling (DDC), that detects this attack and some unintended compiler defects as well. If this attack goes undetected, even complete analysis of a system’s source code will not find the malicious code that is running, and methods for detecting this particular attack are not widely known. It’s “Countering Trusting Trust through Diverse Double-Compiling,” and here’s the abstract:Īn Air Force evaluation of Multics, and Ken Thompson’s famous Turing award lecture “Reflections on Trusting Trust,” showed that compilers can be subverted to insert malicious Trojan horses into critical software, including themselves. This attack has long been part of the lore of computer security, and everyone knows that there’s no defense. The victim never noticed the attack, even when they disassembled the binaries - the compiler rigged the disassembler, too.

Thompson demonstrated the attack in a devastating way: he subverted a compiler of an experimental victim, allowing Thompson to log in as root without using a password.

Once this is done, the attack perpetuates, essentially undetectably. Ken Thompson described it in his classic 1984 speech, “ Reflections on Trusting Trust.” Basically, an attacker changes a compiler binary to produce malicious versions of some programs, INCLUDING ITSELF. Way back in 1974, Paul Karger and Roger Schell discovered a devastating attack against computer systems.

Andy mac emulator trojan