Given that I have an "acceptable" source code of some program (Tor was mentioned in a previous version of this question), where "acceptable" means that I trust this source code and want to use it for my needs; is there a possibility, that if I use pre-complied binaries (someone else's compilation), that I will get an "unacceptable" binary that contains different code than the "acceptable" source code I saw (e.g. backdoored binary)?
2
-
3You'll have to define what "that most of us use" means exactly. Which exact OSs are you interested in, and who distributes the Tor binaries you use?– Steve Dodier-LazaroCommented Jun 14, 2015 at 22:11
-
Did you build your compiler from source code as well? Do you inspect the tapeout for every chip in your system? There are varying levels of trust people are willing to place on their chain of computing, and one must decide based on one's own technical abilities and skills, where that line is drawn. There is always some part of the chain out of individual control, for anything capable of interacting with the modern world.– Don SimonCommented Jun 15, 2015 at 16:17
Add a comment
|
2 Answers
The answer is, of course, that it's possible. There are four major ways that can happen.
1) The binaries you downloaded include a vulnerability and weren't built with the signed source code.
- Answer: Perform your own deterministic build based on the instructions provided at blog.torproject.org, which states "We achieve our build security through a reproducible build process that enables anyone to produce byte-for-byte identical binaries to the ones we release. Elsewhere on the Internet, this process is varyingly called "deterministic builds", "reproducible builds", "idempotent builds", and probably a few other terms, too."
2) The compiler you used included a vulnerability in your binaries, perhaps a specific implementation of the Ken Thompson hack from 1984
- Partial Answer: This one's harder, though using different compilers from different sources and then doing careful analysis on the results to see if they have the same behaviors would be reasonable, if time-consuming.
3) Your OS or drivers are compromised.
- That's outside of the scope of this answer.
4) Your CPU and/or NIC is compromised.
- That's also outside the scope of this answer.
answered Jun 14, 2015 at 22:46
Nowadays compilers will generate different binary each time:
- BuildID will be different
- compiling time (present in some types of binaries) will be different
So don't ever expect getting identical files from identical code.
Apart from this, TOR is a very specific software, that is pain-in-the-ass for many governments, 3-letter agencies and everyone responsible for deffensive security. So expect, that there are many people with a vital interest to add some backdoor to it.
There is no straight 100% sure answer, if TOR binaries are backdoored. It's a matter of trust to its publishers:
if you're trying to hide some minor activities, you can trust them (in general), as it would too much noise if someone would really use such backdoor to raid existing TOR users doing minor activities
if you're trying to avoid live in prison for some really serious activities like Silk Road X.0, then trust no one
