arXiv cs.SE (Software Engineering)Julien Malka, Aman Sharma, Martin Monperrus, Stefano Zacchiroli, Théo Zimmermann1 min readpaperadvanced
Trusting-Trust Attack against an Entire Linux Distribution through Binary Manipulation
Summary
The authors show that the classic trusting‑trust attack is not limited to compilers: by tampering with GNU strip they can inject a payload that propagates through NixOS's bootstrap and ends up in almost every binary of the final system. The attack succeeds on a real nixpkgs revision, building a full graphical installer while backdooring the majority of its binaries.
- A single compromised binary tool (strip) can seed a supply‑chain attack that survives multiple generations of rebuilds.
- The attack works on NixOS's reproducible build pipeline, demonstrating that reproducibility alone does not guarantee trust.
- Backdoored binaries can be injected without source‑level changes, making detection via code review ineffective.
- Mitigations must include verification of binary utilities and tighter closure checks in bootstrapping processes.
Distribution maintainers and supply‑chain security engineers need to consider binary‑level trust, not just source‑level, when hardening build pipelines.
8/10
