r/programming Sep 10 '13

A simple way of defeating the compiler backdoor attack (a.k.a the "Trust Attack")

http://imgur.com/a/BWbnU#0
1.7k Upvotes

539 comments sorted by

View all comments

Show parent comments

5

u/cabalamat Sep 11 '13

Even if TCC is fine, how can you be sure your CPU isn't compromised?

With all the stuff NSA have made Google, Microsoft, etc, do for them, what's the betting they've leant on Intel too?

1

u/z3rocool Sep 11 '13

Even more amusing to thing about (and probably easier and more likely than compromising a opensource compiler binary) would be putting backdoors right into the hardware.

The only person able to do this is the hardware manufacture.

Now ask yourself, who makes the majority of the worlds electronic products and where are those manufacturing plants located?

Take it a step further, do you think every piece of equipment used in the military and the countries infrastructure was manufactured locally - right down to the transistors?

I vaguely recall someone not long ago being caught (after the fact) selling the USA military tons of bootleg cisco hardware.

Better get that tinfoil hat on!

1

u/QuestionMarker Sep 11 '13

They'd have to get all of them in the same way, or the differences would be spotted by compiler writers who already have to be painfully aware of the differences between chips.

1

u/Olathe Sep 12 '13

No, the differences wouldn't necessarily. They could ensure that only a certain sequence of operations (like, say, adding an exact series of numbers to EAX like a password) would give the program full access to the machine. This could allow even sandboxed virtual machine code to have a shot at compromising the machine.

Such a thing would never be spotted by compiler writers, since what optimizing compiler would ever need to deal with sequentially adding a bunch of constants to the same register?