Researchers Demonstrate a Trusting-Trust Attack Against an Entire Linux Distribution

A new paper demonstrates Ken Thompson's trusting-trust compiler attack carried out against an entire Linux distribution. The technique hides a backdoor in the compiler so it reproduces itself in every binary it builds, including new compilers. The authors present reproducible builds as the practical defense.