EmbeddingGemma 2: an open, lightweight multimodal embedding model
deepmind.google·6d ago
AI Engineering
Lobsters·Sep 5·5 min read
Trusting-Trust Attack against an Entire Linux Distribution (via the strip utility)
TL;DR
A new trusting-trust attack demonstrates that even the GNU strip utility can be exploited to backdoor an entire Linux distribution. By manipulating finished ELF files, a compromised strip can propagate malicious payloads through successive builds, affecting numerous binaries.
✦ Why It Matters
Review and secure your build tools to prevent potential backdoor vulnerabilities in your software.
Key Takeaways
- Audit your build tools for potential vulnerabilities.
- Implement strict controls on binary utilities like strip.
- Educate teams about supply chain security risks.
- Regularly update and patch all software dependencies.
How It Works
The attack manipulates the GNU strip utility, which removes symbols from binaries, to implant a backdoor during the build process. By altering the binary seed used in NixOS's bootstrap, the compromised strip propagates the malicious payload through subsequent builds, affecting all binaries that rely on it.