Is Ken Thompson's compiler hack still a threat?
programmers.stackexchange.com
Is Ken Thompson's compiler hack still a threat?
1–10 of 29 posts
Re: Is Ken Thompson's compiler hack still a threat?
#2Did he really do that?
Re: Is Ken Thompson's compiler hack still a threat?
#3Did he really do that?
Better: he announced the exploit in the talk he gave upon receiving the Turing Award:
Re: Is Ken Thompson's compiler hack still a threat?
#4Did he really do that?
yes - look up Reflections on Trusting Trust - its a classic paper.
Re: Is Ken Thompson's compiler hack still a threat?
#5A variation of the threat very much exists: Do you know (meaning, there are no unknown unknowns) that no piece, anywhere in your toolchain (OS, compiler, library, framework, buildtool, CI etc), contains malicious code? At the time Thompson made this comment, he talked about the C compiler because it was the one bit of shared code everything else depended on. Today, the attack surface is much, much larger.
If I was running a foreign intelligence service (or a sophisticated mafia operation (potato, potato)), I'd target trusted members of the communities around popular open source projects. A high ranking committer to a library that Rails depends on slips in a bit of clever code in a fix for a legitimate problem, and I can compromise a large number of websites.
Re: Is Ken Thompson's compiler hack still a threat?
#6Did he really do that?
Better: he announced the exploit in the talk he gave upon receiving the Turing Award: http://cm.bell-labs.com/who/ken/trust.html
And, after he first mentioned the exploit, and before he achieved the award, the AT&T lawyers made him say publicly that he didn't really do that.
Re: Is Ken Thompson's compiler hack still a threat?
#7Very much so. Note the malware hack against Delphi compilers: https://lists.owasp.org/pipermail/owasp-cincinnati/2009-Augu...
Re: Is Ken Thompson's compiler hack still a threat?
#8Earlier quoted context omitted.
Better: he announced the exploit in the talk he gave upon receiving the Turing Award: http://cm.bell-labs.com/who/ken/trust.html
And, after he first mentioned the exploit, and before he achieved the award, the AT&T lawyers made him say publicly that he didn't really do that.
Where can we find records of him stating that this never happened?
Re: Is Ken Thompson's compiler hack still a threat?
#9I've read about this scenario before but I didn't realize it was Ken Thompson who proposed it. Very cool.
When I read the title I thought maybe Ken Thompson's compiler hack was Go (golang), which he co-created, and I was going to hear a bunch of Python or Node fans talk about why Go is not a threat :)
Re: Is Ken Thompson's compiler hack still a threat?
#10A variation of the threat very much exists: Do you know (meaning, there are no unknown unknowns) that no piece, anywhere in your toolchain (OS, compiler, library, framework, buildtool, CI etc), contains malicious code? At the time Thompson made this comment, he talked about the C compiler because it was the one bit of shared code everything else depended on. Today, the attack surface is much, much larger. If I was ru…
Sure, but it sounds like you're talking about a standard hidden backdoor. This is a pretty straightforward and obvious threat.
What Thompson describes is a whole lot more devious and difficult to detect.