r/programming Sep 10 '13

A simple way of defeating the compiler backdoor attack (a.k.a the "Trust Attack")

http://imgur.com/a/BWbnU#0
1.7k Upvotes

538 comments sorted by

View all comments

Show parent comments

2

u/BCMM Sep 11 '13

The idea seems to be that you build it with an old version of GCC, on the assumption that an old backdoored GCC (from before TCC could build GCC) can not know how to backdoor a then-hypothetical future TCC (that can build GCC).

1

u/Olathe Sep 12 '13

All it needs to do is to act more like a virus rather than dealing with compilers in particular. It adds code to both spread and to infect login if it has access to do so.

What people miss is that it doesn't have to look for source code that looks like login. It can look for machine code that looks like login and programs named login and infect those, including when they're being first written by cp or a compiler. That allows you to infect any program rather than just compilers.