Re:System programming in Rust: beyond safety
by infogulch on Thursday June 15, 2017 @01:38PM
(#14562505)
I think nickpsecurity's point is that there are many more lucrative targets to attack than compiler binaries. More lucrative in both effort/reward payoff and also difficulty of detection. For example: Analog Malicious Hardware [1], that would allow a single component added to the chip mask to compromise the entire chip only by the attacker and be undetectable and maintain plausible deniability. Other targets like BIOS, Intel AMT, etc would also be better.
[1]: https://www.ieee-security.org/TC/SP2016/papers/0824a018.pdf