Name: Trusting-Trust Attack against an Entire Linux Distribution through Binary Manipulation - Aman Sharma, KTH Royal Institute of Technology
Start: 2026-10-06T16:23:00+0200
End: 2026-10-06T16:41:00+0200

Trusting-Trust Attack against an Entire Linux Distribution through Binary Manipulation - Aman Sharma, KTH Royal Institute of Technology

Tuesday October 6, 2026 16:23 - 16:41 CEST

South Hall 3A

Ken Thompson's trusting-trust attack, in which a compromised compiler backdoors the programs it builds and reproduces the backdoor in subsequent rebuilds of itself, is widely regarded as a threat specific to compilers. We show that it is not. We construct a complete trusting-trust attack around GNU strip, an ordinary build utility that neither inspects nor generates source code, using only manipulations of finished ELF files. In the bootstrap of the NixOS Linux distribution, a single tampered strip in the binary seed implants a payload that propagates from one generation of strip to the next and survives into the final standard environment after the seed leaves the dependency closure. On a real nixpkgs revision, the attack builds a complete graphical installer without failures and backdoors almost every one of its binaries, enabling arbitrary malicious behavior of the subverted packages.

Speakers

Aman Sharma

PhD Student, KTH Royal Institute of Technology

Aman Sharma is a doctoral researcher at KTH Royal Institute of Technology in Stockholm, where he works on software supply chain security. His research digs into how we can trust the software we depend on. His expertise spans the Maven/Java ecosystem and the broader open-source supply... Read More →

Tuesday October 6, 2026 16:23 - 16:41 CEST
South Hall 3A

SCORED Sessions, SBOM and Beyond

about <br>

OpenSSF Community Day Europe 2026

Aman Sharma

Get help with the event

OpenSSF Community Day Europe 2026

Aman Sharma

Sign up or log in to save this to your schedule, view media, leave feedback and see who's attending!

Get help with the event