Trusting-Trust Attack against an Entire Linux Distribution

AI 导读

研究展示通过篡改GNU strip工具，可实现对整个Linux发行版的Trusting-Trust攻击，影响构建过程中的所有二进制文件。

The study demonstrates a Trusting-Trust attack on an entire Linux distribution via binary manipulation, compromising all generated binaries through a tampered build tool.

重点速览

• 攻击利用GNU strip工具，不涉及源代码审查 Attack uses GNU strip, a build utility without source code inspection
• 篡改二进制种子可使后门在构建过程中持续传播 Tampered binary seed enables backdoor propagation across builds
• 攻击成功植入NixOS系统所有生成二进制文件 Backdoor infects all generated binaries in NixOS system
• 攻击在真实nixpkgs版本中实现无故障构建 Attack successfully builds packages without failures
• 被入侵软件包可执行任意恶意行为 Compromised packages can execute arbitrary malicious actions

一句话：Trusting-Trust攻击可扩展至非编译器工具，威胁整个系统安全。 / The Trusting-Trust attack extends beyond compilers, posing systemic security risks.