Given that I have an "acceptable" source code of some program (Tor was mentioned in a previous version of this question), where "acceptable" means that I trust this source code and want to use it for my needs; is there a possibility, that if I use pre-complied binaries (someone else's compilation), that I will get an "unacceptable" binary that contains different code than the "acceptable" source code I saw (e.g. backdoored binary)?

  • 3
    You'll have to define what "that most of us use" means exactly. Which exact OSs are you interested in, and who distributes the Tor binaries you use? – Steve Dodier-Lazaro Jun 14 '15 at 22:11
  • Did you build your compiler from source code as well? Do you inspect the tapeout for every chip in your system? There are varying levels of trust people are willing to place on their chain of computing, and one must decide based on one's own technical abilities and skills, where that line is drawn. There is always some part of the chain out of individual control, for anything capable of interacting with the modern world. – Don Simon Jun 15 '15 at 16:17

The answer is, of course, that it's possible. There are four major ways that can happen.

1) The binaries you downloaded include a vulnerability and weren't built with the signed source code.

  • Answer: Perform your own deterministic build based on the instructions provided at blog.torproject.org, which states "We achieve our build security through a reproducible build process that enables anyone to produce byte-for-byte identical binaries to the ones we release. Elsewhere on the Internet, this process is varyingly called "deterministic builds", "reproducible builds", "idempotent builds", and probably a few other terms, too."

2) The compiler you used included a vulnerability in your binaries, perhaps a specific implementation of the Ken Thompson hack from 1984

  • Partial Answer: This one's harder, though using different compilers from different sources and then doing careful analysis on the results to see if they have the same behaviors would be reasonable, if time-consuming.

3) Your OS or drivers are compromised.

  • That's outside of the scope of this answer.

4) Your CPU and/or NIC is compromised.

  • That's also outside the scope of this answer.

Nowadays compilers will generate different binary each time:

  • BuildID will be different
  • compiling time (present in some types of binaries) will be different

So don't ever expect getting identical files from identical code.

Apart from this, TOR is a very specific software, that is pain-in-the-ass for many governments, 3-letter agencies and everyone responsible for deffensive security. So expect, that there are many people with a vital interest to add some backdoor to it.

There is no straight 100% sure answer, if TOR binaries are backdoored. It's a matter of trust to its publishers:

  • if you're trying to hide some minor activities, you can trust them (in general), as it would too much noise if someone would really use such backdoor to raid existing TOR users doing minor activities

  • if you're trying to avoid live in prison for some really serious activities like Silk Road X.0, then trust no one

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.