News for hackers. Stuff that matters.

A comment on Trusting-Trust Attack against an Entire Linux Distribution (via strip utility). Parent comment

Re:Trusting-Trust Attack against an Entire Linux Distributio... by jdiff on Monday September 07, 2026 @07:53PM (#49604239)
Break expectations. Bootstrap it through an esoteric-enough system. Write an Uxn emulator in assembly targeting the cushy environment that UEFI has and you've got a system with graphics, a text editor, a spreadsheet editor, an assembler, games, and maybe even more. I have a Z80-powered email appliance that can be loaded with programs from a connected device. Whoever is breaking my trust in trust surely won't have planned for that.
[ Parent | on HN ]
Re:Trusting-Trust Attack against an Entire Linux Distributio... by tosapple on Monday September 07, 2026 @08:48PM (#49604458)
but now they will via delegation to an automated analyst/systems programmer.

get ready.

the effort required for a complete infiltration has been lowered a great deal.

[ Parent | on HN ]
Re:Trusting-Trust Attack against an Entire Linux Distributio... by jdiff on Tuesday September 08, 2026 @08:30AM (#49609442)
This automated analyst isn't going to be able to run usefully on hardware that is still otherwise useful, giving you a clear path to choke it out or identify its presence when your hello world is taking 3 months to finish compiling.
[ Parent | on HN ]
Re:Trusting-Trust Attack against an Entire Linux Distributio... by tosapple on Tuesday September 08, 2026 @03:08PM (#49615232)
insertions can be much smaller than full blown LLMs.

simple single bit changes are enough to blast your private keys out to the ether of the public facing internet.

that big fat LLM does know how to make tentacles and eyes.

[ Parent | on HN ]
Re:Trusting-Trust Attack against an Entire Linux Distributio... by jdiff on Tuesday September 08, 2026 @03:29PM (#49615616)
Absolutely true, but even tentacles and eyes will struggle to fit in a system compact enough. Even on larger systems, there is an upper limit on how many tentacles you can cram in something before you can't continue the facade that there are none. And an upper limit on how esoteric the tentacle is before it stops being worth it.
[ Parent | on HN ]