Trusting-Trust Attack against an Entire Linux Distribution

Ken Thompson's seminal "trusting-trust" attack has long been considered a theoretical threat primarily confined to compilers, where a compromised compiler can subtly inject backdoors into programs it builds, including future versions of itself. This paper, however, presents a startling real-world demonstration that shatters this perception, proving the attack is far more pervasive.

The research details a complete trusting-trust attack leveraging GNU strip, a common build utility that merely manipulates compiled ELF files without inspecting or generating source code. Key aspects of this novel attack include:

• Unconventional Vector: The attack utilizes GNU strip, demonstrating that utilities beyond compilers can serve as powerful vectors for persistent compromise.
• ELF Manipulation: The compromise is achieved solely through manipulations of finished ELF (Executable and Linkable Format) files.
• NixOS Target: The proof-of-concept is built around the bootstrap process of the NixOS Linux distribution.
• Propagation: A single tampered strip binary in the initial binary seed successfully implants a payload that propagates through subsequent generations of strip itself.
• Persistent Compromise: The malicious payload survives in the final standard environment even after the initial seed leaves the dependency closure.
• Widespread Impact: On a real nixpkgs revision, the attack builds a complete graphical installer without failures, backdooring almost every one of its binaries and enabling arbitrary malicious behavior within the subverted packages.

This work fundamentally shifts the understanding of the trusting-trust threat model, highlighting the vulnerability of even seemingly innocuous build components and underscoring the profound challenges in ensuring software supply chain integrity from its very foundations.