Technology
Researchers demonstrate trusting-trust attack against Linux distribution using build tool
A research team demonstrated a trusting-trust attack compromising an entire Linux distribution using GNU strip, according to Hacker News.
The short version
- Researchers developed a trusting-trust attack targeting the NixOS Linux distribution using the GNU strip utility rather than a compromised compiler.[Hacker News]
- A tampered binary seed propagated across successive build stages into the final standard environment without triggering any build errors.[Hacker News]
- The demonstration produced a fully functional graphical installer while backdooring almost all of its resulting binary packages.[Hacker News]
Key facts
- Researchers built a trusting-trust attack using GNU strip and manipulated finished ELF files rather than modifying a compiler.[Hacker News]
- The proof of concept targeted the NixOS bootstrap sequence, allowing a seed payload to survive across rebuild generations into the final environment.[Hacker News]
- The process successfully produced an entire graphical installer without build failures while implanting backdoors into nearly every binary.[Hacker News]
Sources
Outlet counts describe coverage, not independent confirmation. Reports may share a wire service or original source.