Re: getting around Ken Thompson's compiler Trojan

From: stanislav shalunov (shalunov@internet2.edu)
Date: 01/23/03 

From: stanislav shalunov <shalunov@internet2.edu>
Date: 22 Jan 2003 18:23:16 -0500

christopherlmarshall@yahoo.com (Chris Marshall) writes:

> First, write a program to obfuscate the source code of any other
> program by randomizing the variable and function names, as well as
> the names of the source code files.

The obfuscation program will have to do a lot more than that unloess
the detection algorithm is really simplistic. The detection algorithm
must be smart enough to detect at least minor modifications of the
compiler, so it would probably be designed to be rather robust.

> My sense is that obfuscation is easier than detection, although I
> don't know how you would prove such a thing.

You don't need to. Rice already did. The compiler's check will be
provably inaccurate for some inputs. Further, one can write a program
that, given the (real, not clean) code of the check and code of the
compiler, obfuscate the compiler's code so that the check would come
out negative. On the other hand, the check modification based on
obfuscation method cannot be automated. So, obfuscation *is* easier
than detection.

However, this doesn't help you to prove anything about your scheme.
Since you have no idea about the way detection works, you won't be
able to provably fool it... 

-- 
Stanislav Shalunov		http://www.internet2.edu/~shalunov/
"The power of accurate observation is commonly called cynicism by
those who have not got it."			-- G. B. Shaw

Relevant Pages

  • Re: [fw-wiz] Efficiently detecting obfuscated shell code
    ... Intrusion Detection Specialist ... I think it depends on the obfuscation. ... you want to be at the point of execution. ... out" trojans and shellcode in the wild (for the primary shellcode vectors ...
    (Firewall-Wizards)
  • Re: [fw-wiz] Efficiently detecting obfuscated shell code
    ... I think it depends on the obfuscation. ... out" trojans and shellcode in the wild (for the primary shellcode vectors ... I don't think you can do good detection on the wire for obfuscation ...
    (Firewall-Wizards)
  • Re: Dotfuscator - major flaw in Microsoft dotNET?
    ... NET assembly and convert it back into source code such as .NET ... The idea of obfuscation is to make the goal of reverse ... value of the string used in reflection or dynamic class loading, ... With Dotfuscator Professional Edition, ...
    (microsoft.public.dotnet.general)
  • Re: Is Delphi 8 dangerous ?
    ... idea of something important vs what the competition has. ... >> like your opinion on that. ... But obfuscation is not making me feel this ... Maybe *none* of those is about source code. ...
    (borland.public.delphi.non-technical)
  • Re: gfortran vs. g95
    ... > obfuscate source code by removing all comments and indentation, ... > obfuscated form. ... That's a pretty good explaination of obfuscation. ... qualify as distributing source for the purposes of the GPL since the GPL ...
    (comp.lang.fortran)