Trusting-Trust Attack against an Entire Linux Distribution (via the strip utility)
ArXiv paper shows the trusting-trust compiler backdoor technique can compromise an entire Linux distribution via the strip utility.
The paper (arXiv 2607.24888) demonstrates that Ken Thompson's trusting-trust attack, long viewed as a compiler-specific threat, can backdoor an entire Linux distribution by targeting the strip utility. A compromised tool reproduces its backdoor in subsequent rebuilds of itself, generalizing the attack surface beyond compilers. The finding has supply-chain implications for build reproducibility and distribution trust, though it is a research result with no observed real-world exploitation.
- Trusting-trust attack shown to apply beyond compilers
- Backdoor propagation demonstrated via the strip utility
- Whole-distribution compromise scenario presented
- Implications for reproducible builds and supply-chain trust
"Ken Thompson's trusting-trust attack, in which a compromised compiler backdoors the programs it builds and reproduces the backdoor in subsequent rebuilds of itself, is widely regarded as a threat specific to compilers. We show that it is not." A few weeks ago I came across this https://www.teamten.com/lawrence/writings/coding-machines/ : it's clearly fictional (and furthermore is "pre-AI" in that it was written in 2009) but is interesting in that it raises the question of whether one or more computers could- without "intention" embed code meeting the "trusting trust" criteria in GCC. Comments
This source does not provide full text. Read it at arxiv.org.