研究人员成功构建了一个针对整个NixOS Linux发行版的信任链攻击（trusting-trust attack），打破了这类攻击仅限于编译器的传统认知1。该攻击通过操纵GNU strip等普通构建工具的ELF二进制文件实现，在NixOS的bootstrap过程中向二进制种子中植入单个被篡改的strip工具1。
攻击利用了strip既不检查也不生成源代码的特性进行二进制操纵，使恶意负载能够从一代strip传播到下一代，并在种子离开依赖链后持续存在于最终的标准环境中1。研究人员的演示成功构建了完整的图形安装程序，并对几乎所有二进制文件进行了后门植入1。
Researchers have successfully constructed a trusting-trust attack targeting the entire NixOS Linux distribution by manipulating ELF binaries of common build tools like GNU strip 1. The attack, traditionally understood as a compiler-specific threat following Ken Thompson's original work, demonstrates that the vulnerability extends far beyond compilation toolchains 1.
The exploit operates by injecting a single compromised strip binary into the bootstrap seed, which then propagates malicious payloads across successive generations of the tool while persisting in the final standard environment even after the dependency chain is severed 1. Unlike conventional build tools, GNU strip neither examines nor generates source code, making it an effective vector for binary manipulation 1. The attack successfully constructed a complete graphical installer and compromised nearly all binary files in the distribution with backdoors 1.
评论
还没有评论，欢迎留下第一条。