Trusting-Trust Attack against an Entire Linux Distribution through Binary Manipulation

2026-07-27

AI Summary

This work challenges the conventional view that Thompson-style trust attacks are confined to compilers by demonstrating, for the first time, a persistent, self-propagating backdoor implanted without any compiler involvement—relying solely on manipulation of ELF binaries. By subverting build tools such as GNU strip, the attack injects a backdoor during the NixOS bootstrapping process, thereby contaminating the entire system environment. The approach integrates precise ELF binary manipulation, in-depth analysis of NixOS’s build mechanisms, and binary seed pollution techniques. It successfully produces a fully functional graphical installation image from a real-world nixpkgs revision, with nearly all binaries compromised. Crucially, the backdoor persists even after the initial seed exits the dependency closure, thereby extending the reach of trust-based attacks beyond traditional compiler-centric assumptions.

Abstract

Ken Thompson's trusting-trust attack, in which a compromised compiler backdoors the programs it builds and reproduces the backdoor in subsequent rebuilds of itself, is widely regarded as a threat specific to compilers. We show that it is not. We construct a complete trusting-trust attack around GNU strip, an ordinary build utility that neither inspects nor generates source code, using only manipulations of finished ELF files. In the bootstrap of the NixOS Linux distribution, a single tampered strip in the binary seed implants a payload that propagates from one generation of strip to the next and survives into the final standard environment after the seed leaves the dependency closure. On a real nixpkgs revision, the attack builds a complete graphical installer without failures and backdoors almost every one of its binaries, enabling arbitrary malicious behavior of the subverted packages.

Problem

• trusting-trust attack
• binary manipulation
• Linux distribution
• ELF files
• build utility

Innovation

• trusting-trust attack
• binary manipulation
• ELF files
• build system compromise
• NixOS