Trusting-Trust Attack against an Entire Linux Distribution through Binary Manipulation

본문 미리보기

arXiv:2607.24888v1 Announce Type: new Abstract: Ken Thompson's trusting-trust attack, in which a compromised compiler backdoors the programs it builds and reproduces the backdoor in subsequent rebuilds of itself, is widely regarded as a threat specific to compilers. We show that it is not. We construct a complete trusting-trust attack around GNU strip, an ordinary build utility that neither inspects nor generates source code, using only manipulations of finished ELF files. In the bootstrap of t