Researchers backdoor an entire Linux distro via a tampered GNU strip binary — trusting-trust beyond compilers

jedisct1 · x · 2026-09-08

An arXiv paper (2607.24888) extends Ken Thompson's trusting-trust attack beyond compilers: by manipulating only finished ELF files, the authors build a full attack around GNU strip. In NixOS's bootstrap, a single tampered strip binary seed implants a payload that propagates across generations of strip and survives into the final standard environment. On a real nixpkgs revision, the attack builds a complete graphical installer and backdoors nearly all of its binaries. The result challenges the assumption that trusting-trust is compiler-specific and is a major warning for reproducible builds and binary seed trust chains.

Original post →

More from Research

Research channel →