bugtraq - Reflections on Trusting Trust [was: Re: Solaris telnet ...]

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <Pine.LNX.4.21.0702151916540.4861-100000@linuxbox.org>
Date: Thu, 15 Feb 2007 19:19:18 -0600 (CST)
From: Gadi Evron <ge@...uxbox.org>
To: Darren Reed <avalon@...igula.anu.edu.au>
Cc: Thierry@...ler.lu, bugtraq@...urityfocus.com
Subject: Reflections on Trusting Trust [was: Re: Solaris telnet ...]

On Thu, 15 Feb 2007, Darren Reed wrote:
> How about putting a backdoor into your C compiler such that it
> generates "special code" when it recognises it is compiling
> /bin/login that allows special access?

Once every 2 years or so I have the chance of mailing in a reference to
the best security paper ever written (or one of the..). It is not just
about compilers, but about the most basic concept in security.

Reflections on Trusting Trust - Ken Thompson
http://www.acm.org/classics/sep95/

	Gadi.