Is Ken Thompson's compiler hack still a threat?

Re:Is Ken Thompson's compiler hack still a threat? by mseebach on Sunday January 27, 2013 @10:14AM (#5124468)

A variation of the threat very much exists: Do you know (meaning, there are no unknown unknowns) that no piece, anywhere in your toolchain (OS, compiler, library, framework, buildtool, CI etc), contains malicious code? At the time Thompson made this comment, he talked about the C compiler because it was the one bit of shared code everything else depended on. Today, the attack surface is much, much larger.

If I was running a foreign intelligence service (or a sophisticated mafia operation (potato, potato)), I'd target trusted members of the communities around popular open source projects. A high ranking committer to a library that Rails depends on slips in a bit of clever code in a fix for a legitimate problem, and I can compromise a large number of websites.

[ Parent | on HN ]

Re:Is Ken Thompson's compiler hack still a threat? by patio11 on Sunday January 27, 2013 @06:38PM (#5126209)

I think you vastly overestimate the difficulty of getting a code execution bug on Rails relative to the resources of a nation-state. You don't need to do anything remotely suspicious; just hire vulnerability researchers. They're ridiculously cheaper than aircraft carriers.

Or, to put it another way, anybody with $20k can uncover an RCE in Rails without needing to suborn any community member.

[ Parent | on HN ]

Re:Is Ken Thompson's compiler hack still a threat? by tptacek on Sunday January 27, 2013 @11:38PM (#5127159)

$20k is too low, but your point stands.

[ Parent | on HN ]

Re:Is Ken Thompson's compiler hack still a threat? by eli on Sunday January 27, 2013 @11:13AM (#5124625)

Sure, but it sounds like you're talking about a standard hidden backdoor. This is a pretty straightforward and obvious threat.

What Thompson describes is a whole lot more devious and difficult to detect.

[ Parent | on HN ]

Re:Is Ken Thompson's compiler hack still a threat? by mseebach on Sunday January 27, 2013 @11:27AM (#5124677)

The crude variation of the attack-vector I'm describing is a backdoor, that is correct - but that's also what Thompson is imagining his attack being used for.

Thompson's scenario is more devious, more difficult to detect, and a lot, lot harder to implements (near impossible, as some of the SO answers point out). But at that time, people didn't generally download millions of lines of code written by perfect strangers and incorporate them into their programs, so that was the only way to pull such a thing off.

[ Parent | on HN ]

Re:Is Ken Thompson's compiler hack still a threat? by SkyMarshal on Sunday January 27, 2013 @09:20PM (#5126734)

>I'd target trusted members of the communities around popular open source projects.

I'm sure everyone here is already aware, but the FBI may have already experimented with that:

http://arstechnica.com/information-technology/2010/12/fbi-ac...

[ Parent | on HN ]