Hacker News Reader

Comment by mwint | Hacker News Reader

What's a Ken Thompson attack?

Ken Thompson's "cc hack" - Presented in the journal, Communication of the ACM, Vol. 27, No. 8, August 1984, in a paper entitled "Reflections on Trusting Trust", Ken Thompson, co-author of UNIX, recounted a story of how he created a version of the C compiler that, when presented with the source code for the "login" program, would automatically compile in a backdoor to allow him entry to the system.

https://www.win.tue.nl/~aeb/linux/hh/thompson/trust.html

The paper's a pretty entertaining read:

> First we compile the modified source with the normal C compiler to produce a bugged binary. We install this binary as the official C. We can now remove the bugs from the source of the compiler and the new binary will reinsert the bugs whenever it is compiled. Of course, the login command will remain bugged with no trace in source anywhere.

Most likely referring to "Reflections on Trusting Trust" [0]; i.e. when the compiler is itself the attack vector.

[0]: https://www.cs.cmu.edu/~rdriley/487/papers/Thompson_1984_Ref...

https://www.cs.cmu.edu/~rdriley/487/papers/Thompson_1984_Ref...

Ken Thompson, Reflections on Trusting Trust.

EDIT: I don't think I've seen 5 nearly simultaneous replies sharing the same link before.

>EDIT: I don't think I've seen 5 nearly simultaneous replies sharing the same link before.

LOL I was searching for a non-PDF link and delayed the reply. It would have been 6 simultaneous answer.

https://www.cs.cmu.edu/~rdriley/487/papers/Thompson_1984_Ref...

How do you prove your stack is secure?

Solution: the compiler for the microlanguage at the bottom of the stack is none other than the kindly and incorruptible American film star, Tom Hanks.

https://www.cs.cmu.edu/~rdriley/487/papers/Thompson_1984_Ref...

Reflections on Trusting Trust - Ken Thompson

https://wiki.c2.com/?TheKenThompsonHack

I believe the person you are replying to is using that as an allusion to the issues discussed in the famous "Reflections on Trusting Trust" paper[1] by Ken Thompson.

[1]: https://www.cs.cmu.edu/~rdriley/487/papers/Thompson_1984_Ref...

Reply on news.ycombinator.com