@spizzat2@lemmy.zip
member since 8 Jun 2025 02:07
comments
- on Thanks FedEx, This is Why we Keep Getting Phished in c/technology@lemmy.world · 4d ago
-
on I got a new router,what do? in c/privacy@lemmy.ml · 11 Sep 2026
Thanks. Fixed the link.
- on I got a new router,what do? in c/privacy@lemmy.ml · 11 Sep 2026
-
on Ken Thompson Hack 2.0 in c/linuxmemes@lemmy.world · 23 Aug 2026
notice
javascript required to view this site
why
measured improvement in server performance
awesome incremental search
Boo! Just give me the text!
Edit: It’s long, but here’s the opening section, at least:
In 1984 KenThompson was presented with the ACM TuringAward. Ken’s acceptance speech Reflections On Trusting Trust (cm.bell-labs.com/who/ken/trust.html) describes a hack (in every sense), the most subversive ever perpetrated, nothing less than the root password of all evil.
Ken describes how he injected a virus into a compiler. Not only did his compiler know it was compiling the login function and inject a backdoor, but it also knew when it was compiling itself and injected the backdoor generator into the compiler it was creating. The source code for the compiler thereafter contains no evidence of either virus.
Ken wrote, In demonstrating the possibility of this kind of attack, I picked on the C compiler. I could have picked on any program-handling program such as an assembler, a loader, or even hardware microcode. As the level of program gets lower, these bugs will be harder and harder to detect. A well installed microcode bug will be almost impossible to detect.
Ken does not mean bug in the sense of error, but in the sense of listening device. And it is “almost” impossible to detect because TheKenThompsonHack easily propagates into the binaries of all the inspectors, debuggers, disassemblers, and dumpers a programmer would use to try to detect it. And defeats them. Unless you’re coding in binary, or you’re using tools compiled before the KTH was installed, you simply have no access to an uncompromised tool.
In fact, given the amenability of microcode to the KTH, not even then.
All manner of controls and monitors could be secreted this way in the OSes of all the devices we all use day to day. It isn’t very far fetched to suggest that the hack, in software, can create an updatable backdoor. This way every piece of software on the planet can be KTH bugged without any possibility of detection by any mortal engineer anywhere.
Well, maybe with the diligent use of an electron microscope.
Given last week’s horrifying revelations concerning the US government’s TotalInformationAwareness of every US domestic phone call, it is difficult to imagine that the ThreeLetterAgency’s KTH-hacked binaries are not omnipresent. I mean, can you really imagine AdmiralPoindexter would pass up an ability like this?
A competent government would set up best practice rules, and tools to improve systems. They could even provide some sort of system for consumers to report these issues. Then they could assign companies a cyber security score. Basically, a wall of shame for this stuff, ideally with the option for fines for non-compliance.
Unfortunately, “competent government” seems to be an oxymoron in most places.
Edit: to be clear, I provided examples of half-hearted implementations of what I’m talking about from a couple sources, but I’m making no claims about the competency of those governments.