How do i know a compiler isn't injecting malware into my program

user_15253423 0
Viewed 352

I recently wrote my first application in python and it works quite well. A bit later my anti-virus program flagged and uninstalled it as a trojan.

After a bit of research, I believe it is because I haven't signed my code but it made me think. Couldn't a compiler modify my Program by basically adding a piece of malware into your otherwise legit code? And how would I figure out if it does it?

This might be a really dumb question but I couldn't find any answers by googling and am new and trying to learn and understand. =

security python
2 Answers

Couldn't a compiler modify my Program by basically adding a piece of malware into your otherwise legit code. And how would I figure out if it does it?

Ken Thompson wrote a great article about this

To what extent should one trust a statement that a program is free of Trojan horses? Perhaps it is more important to trust the people who wrote the software.

He described how a trojan horse can be put into the C compiler and based on the fact that a new C compiler is compiled with the current C compiler ( chicken-egg)

  • First, insert the trojan into C compiler code
  • Compile it, now the new C compiler has the trojan that injects itself into every code it compiles.
  • Rollback to the old C compiler code, and compile it with the new compiler.
  • The C compiler source code doesn't have the trojan, but the compiler has it and carries it into every program it compiles even the future C compilers.

Well at some time this can be detected. The moral, however, is that

The moral is obvious. You can't trust code that you did not totally create yourself. (Especially code from companies that employ people like me.) No amount of source-level verification or scrutiny will protect you from using untrusted code. In demonstrating the possibility of this kind of attack, I picked on the C compiler. I could have picked on any program-handling program such as an assembler, a loader, or even hardware microcode. As the level of program gets lower, these bugs will be harder and harder to detect. A well-installed microcode bug will be almost impossible to detect

This is a trust issue. Until now, you trusted to your the compiler, your antivirus program, and your OS. Now your compiler and your antivirus are fighting. Couldn't be it the case that your antivirus has been corrupted? Couldn't be the case that your operating system is corrupted?

The best action is to turn off the PC and do an external analysis of the system.

Wait, will you trust the external analyzer?

And, will you trust your hardware?

This is a serious issue unfortunately poisoned by Bloomberg.

Note: Need an example for outsourcing then see the SolarWinds attack.

user_18205530

I am working for Anti-malware company and I am really surpriser by your post.

  1. Anti-malware programs do not "uninstall" malware. They remove file. Though they can do some cleanup, but it is not "uninstalling"
  2. Your python code can not be "signed" as it should be .EXE file or some driver.
  3. 99% is that you have faced "false positive" - some heuristic/Machine Learning detection that found that your code is simmilar to known malware.

Name of malware and name of antivirus product could help. You can address this problem to antivirus company support.

user_34316350
Related