An Analysis of Software Supply Chain Attacks

This means the hypothetical Unix operating system logon software really has two authors – the one who created the tools and the one who created the logon software using those tools. If the author of the tools takes Ken Thompson’s approach, the author of the logon software will not realise the software they produce has the additional backdoor functionality. The software gets widely used, with no apparent ill effects, and consumers of the software feel secure. The attack is totally stealthy with little chance of discovery. We can only hope that nobody put Thompson’s idea into practice.