Trusting-Trust Attack against an Entire Linux Distribution (via the strip utility)

针对整个 Linux 发行版的“信任信任”攻击（通过 strip 工具实现）

Ken Thompson’s trusting-trust attack, in which a compromised compiler backdoors the programs it builds and reproduces the backdoor in subsequent rebuilds of itself, is widely regarded as a threat specific to compilers. Ken Thompson 的“信任信任”（Trusting-Trust）攻击——即受感染的编译器在构建程序时植入后门，并在随后的自我重建中复制该后门——长期以来被认为是一种仅针对编译器的威胁。

We show that it is not. We construct a complete trusting-trust attack around GNU strip, an ordinary build utility that neither inspects nor generates source code, using only manipulations of finished ELF files. 我们证明事实并非如此。我们围绕 GNU strip 构建了一个完整的“信任信任”攻击。GNU strip 是一个普通的构建工具，它既不检查也不生成源代码，我们仅通过对已完成的 ELF 文件进行操作就实现了这一攻击。

In the bootstrap of the NixOS Linux distribution, a single tampered strip in the binary seed implants a payload that propagates from one generation of strip to the next and survives into the final standard environment after the seed leaves the dependency closure. 在 NixOS Linux 发行版的引导过程中，二进制种子中一个被篡改的 strip 工具植入了一个有效载荷。该载荷从一代 strip 传播到下一代，即使在种子离开依赖闭包后，它依然能存活于最终的标准环境中。

On a real nixpkgs revision, the attack builds a complete graphical installer without failures and backdoors almost every one of its binaries, enabling arbitrary malicious behavior of the subverted packages. 在真实的 nixpkgs 版本上，该攻击成功构建了一个完整的图形化安装程序且未出现故障，并对其几乎所有的二进制文件植入了后门，从而使被篡改的软件包能够执行任意恶意行为。