NixOS Study Extends Trusting-Trust Backdoor Attack Beyond Compilers

A new study demonstrates that Ken Thompson's classic "trusting-trust" attack—long assumed to require a compromised compiler—can be executed entirely through GNU strip, a utility that only manipulates finished ELF binaries and never touches source code. Researchers built a full attack chain around NixOS's bootstrap process, showing that a single tampered strip binary in the seed can implant a self-propagating payload that survives across build generations, even after the original seed is removed from the dependency graph.

Tested against a real nixpkgs revision, the attack successfully built a complete graphical installer without errors, backdooring nearly every resulting binary. This broadens the threat model for reproducible-builds and supply-chain security efforts: any binary-only build tool in a bootstrap chain—not just compilers—can serve as a vector for self-reproducing backdoors, meaning trust verification must extend to the entire toolchain.