I've been searching long and hard but cannot seem to find it. I hope that what little I remember from it is enough and some kind soul will help me find the original article online... :)
Thank you for solving this mystery. :)
It would have been more evil to do it the original way, as described in Thompson's paper: recognize the program sources and emit altered object code only; no mucking with the source.
I don't quite understand this part. How would this work?
They compiled the clean source using the existing, malicious compiler installation. That compiler had a counter-measure against being recompiled from clean sources; it recognized that situation and perpetrated itself.
(A clean compiler binary might not help; suppose the trick involves other binaries, like the C library. They didn't have the kernel source so it was fairly reasonable to regard the kernel as clean.)
The only solution is be to download a binary compiler from someone you trust.
Depending on how advanced the evil compiler is... Plan A would be to use it to compile TCC, then TCC to compile the original compiler. If the evil compiler inserts into every binary the generic command sequence "search for files that look like the original compiler and evil-ify them", then Plan B is to use evil to compile TCC, then use the resulting slightly-evil-TCC to compile TCC, then use the resulting clean TCC to compile the original.
If someone has also modified the kernel such that anytime someone uses the syscall "chmod" to mark a file as executable, it'll add evil instructions to that file... Well, perhaps you could recompile the kernel, but it'd be easy for evil instructions to cover that too... finding a new independent kernel source that runs on your machine is probably pretty hard... it'd also kind of interfere with downloading good binaries onto the machine, if the process was "download to a file, then chmod", though if it was "chmod, then write to the file", the evil kernel would have to be clever enough to make it instead append to after the evil instructions; you also could attach a disk and mount it and run executables already on it, and that would be pretty complicated for the evil code to transparently handle (of course, it could just refuse to run such things, but there are lots of things it could refuse to do).
Even when I was a graduate student a decade later, in a lab with professional administrators, grad students routinely had pretty much all the permissions they would ask for, because we worked odd hours and performed exotic experiments. Policing was done after the fact.
To have a grad student in Psychology with that level of programming skill would be rather unusual, though.
The admins were smart enough to befriend those kids and let them help manage the system. Better to have them to your side than to have them as an adversary.
A good, fun read. Thank you!
