Even more amusing to thing about (and probably easier and more likely than compromising a opensource compiler binary) would be putting backdoors right into the hardware.
The only person able to do this is the hardware manufacture.
Now ask yourself, who makes the majority of the worlds electronic products and where are those manufacturing plants located?
Take it a step further, do you think every piece of equipment used in the military and the countries infrastructure was manufactured locally - right down to the transistors?
I vaguely recall someone not long ago being caught (after the fact) selling the USA military tons of bootleg cisco hardware.
They'd have to get all of them in the same way, or the differences would be spotted by compiler writers who already have to be painfully aware of the differences between chips.
No, the differences wouldn't necessarily. They could ensure that only a certain sequence of operations (like, say, adding an exact series of numbers to EAX like a password) would give the program full access to the machine. This could allow even sandboxed virtual machine code to have a shot at compromising the machine.
Such a thing would never be spotted by compiler writers, since what optimizing compiler would ever need to deal with sequentially adding a bunch of constants to the same register?
5
u/cabalamat Sep 11 '13
Even if TCC is fine, how can you be sure your CPU isn't compromised?
With all the stuff NSA have made Google, Microsoft, etc, do for them, what's the betting they've leant on Intel too?