Once UNIX got real traction, from the mid '70s onwards
I thought, well, it's only a matter of time [until] they've got to give them the Turing
Award. And it happened, I think, in late '83.
They were given the [ACM] Turing award jointly. I think that
the formal presentation, which required a sort of little
accompanying paper to go with it, didn't happen until 1984.
But it really was an amazing piece of work that went with it.
A lot of people couldn't understand why
it was a bombshell. But it really, really is. The ACM award is given for outstanding
achievements in any area of computer science. So, yes, people like
Maurice Wilkes in the uk won it. People like Steven Kleene
and [Michael] Rabin, and so on, who were all into regular expressions,
Turing machines, all that kind of stuff. All this very worthy theoretical stuff
had won the Turing ACM award. A lot of us began to wonder, though,
whether they might just be so impressed by UNIX as a
down-to-earth achievement, that Dennis Ritchie and Ken Thompson,
the two authors of it, might get jointly honoured, we hoped. Because they deserved it.
It was an amazing achievement. Oh! and by the way,
if any of you want to know what happened with Unix and in what order
I can only point you at my fellow Computerphile
person, Brian Kernighan. He's written lots of books, of course, [e.g.] about C
[which] he co-authored with Dennis, but this one
"A History and a Memoir" i think is the one that i've dipped into most [shows front cover of book]
nd certainly for preparing these recent videos because he basically -- all right
he's a Bell Labs insider [with] a little bit of [pro Bell] bias, maybe, but basically
he gives an unvarnished view about what happened, and in what order,
and why did Berkeley have to happen after
Bell Labs had set the ball rolling and all this. And right on
through to the breakup [of AT&T] and eventually you just had to have something like
Linux. It was the only way everybody was going
to be able to progress. So what did Dennis and Ken do?
And what did Ken say in his acceptance speech
which was so remarkable? The title is: "Reflections on Trusting Trust"
First of all a half-page thank yous to everybody who helped me.
I'm not currently involved (in late '84) in any more development work on the latest UNIX.
[I've] left that to others. Version 7 [of UNIX] has
been out for almost 5 years now. But what i want to do is to use this
opportunity to get you all to think about something
which has now come upon us. You will be clear that Dennis and I have
developed C, largely as a system implementation
language. And, what's more to the point, we have
written the whole of the UNIX operating system in C,
Can you trust us not to have hidden something deadly
inside of the C that we are using all the time?
And most people say well .... this view you see that
compilers were benign. You know they were, wonderful, helpful things
that enable you to get from a high-level language down to a runnable binary
in terms that you could more or less understand. We've done lots of
T-diagrams to explain how this works. You know
[we have a ] C compiler available as a binary. [It] takes input statements,
puts out a certain [near-binary] output. That's what a compiler is for.
It's to provide a binary or near-binary object
that's easier to produce than writing at Assembler code level.
Everybody understands that. But, backing off from all of this a bit, what
Ken asked - although he doesn't make it quite as blatant as this - but if
you read and re-read and re-read and re-read (!)
this four-page article until you've understood it all,
and it "does your head in". The question you end up
asking yourself is: "Have we opened a Pandora's Box" here?
Because what Ken is saying is something like this:
"What happens if your compiler has been engineered to be one of the bad guys ?"
And you think: "Oh, my Lord,
if the operating system is written in C and C is commonplace, and people
understand C and now it'll work with it - it becomes a very powerful weapon for
mucking with the Operating System if you're a good enough C programmer.
So, basically, Ken says: "Yes, consider the following:
i may or may not have done the following" [note from DFB I think he actually has, or did]
How would you feel if I make my compiler
ask ( of the C program that's flowing through it)
I keep an eye on it and I say is this person just
messing about compiling up "Hello World" so you can amaze everybody with your
first binary program. It says "Hello World" [when executed ] Or is it something more serious?
Is this person trying to recompile the whole kernel of the Operating System
because, maybe as a "bad" compiler, I ought to say I've got a view about this
so the first trick he says is how do you know i'm not watching the code go by
and when i say to myself: "He's recompiling me -
the Operating System" I intervene and put in
some extra compiled source code which allows me to get into the system
and log in as super user without knowing the
super-user password. So, I will put in an extra little bit
that says [if] are you a super user as [via] an ordinary user [then]
OK, go through the normal password mechanism. Otherwise
when i say [ask for] "Password", if you give me - what shall we say Sean: "abracadabra" ?
If you say "abracadabra", i open up the entire system for you.
You can do absolutely everything. How would you feel about that? And then
when he's got through that, on Part 1 of the paper, saying
"How about a rogue operating system that we've propagated all over the world now?"
I, Ken Thompson know the magic super super *super*
password that will get me in anyway. [If] some angry person has come up and says
"There is bad code in your C compiler it will let people do horrible things"
And they say to you "show me the [C] source now!". If you're foolish
you show them the [amended] source and they see the [extra] code and that's it.
But what happens -- and this, for those of you who watched it, is a bit like going
back to T-diagrams, what happens if the thing
effectively says: "I'm going to squirt some extra source [text] for the rogue
code into [the output] every time you recompile the C compiler with itself. I won't put it in
every program because people will detect it and will get mightily upset.
But i promise you ... I mean the the binary from a C-ompiler recompile is pretty big
I will hide in there the [extra] rogue source
code in a string of characters which, if I trigger it and reactivate it,
will get compiled as part of a C-compiler recompilation.
Are you still with me ?! ... and will always propagate itself
into the [generated binary] programs. And you might say well but ... but .... you come along with a [new] version
of the C compiler that's got that bad code and you will recompile it [without the bad insert]
And i say "Yes, but at the base of your T-diagram
is a still a [binary] rogue version of you that you are using to [re-]compile yourself!"
Because until your new one [i.e. your new binary] is created you've got no hope
but to use what the [software] company has given you, or what Ken has given you.
And Ken is saying, basically, [that] if you are happy with that ....
"Am i a nice sort of person - would I do this to you,
maybe i would ...?". There's very good reasons that this has been described by a
gentleman called Cory Doctorow who describes it as:
" ... total f***ing bombshell !" What he's saying is that ...
if somebody angrily comes up to you and doesn't understand
says "Look - I'm going to really punch you up and
kill you unless you give me the source code to this compiler and show me it's clean"
So, you show them clean source code [with no sign of the 'bug'] and
[you] say: "Go on, recompile it". And it compiles and it's fine.
But then when you run [i.e. execute] that compiled recompile of the binary
it still [is compromised] and allows you to get in as super-user.
But you knocked the pieces of source code out that enables you to go super-user.
You're not recompiling [ that 'back door bug' ] The answer is it's embedded so deeply
because of [previous] versions of the compiler ensuring that as you bootstrap up you
still propagate that code even if the user
hasn't said that they want it (if you see what i mean)
So, it's deadly because it's embedded and hidden in the
old *binary* - not in the [current] source You can masquerade [and assert]
that the source is OK: "Honestly this source corresponds to this binary :-)
It's a bit like trying to get rid of Japanese Knot Weed in your garden.
You know there's always enough spores in the ground
from previous [invasions] that they will reinfect you.
Yeah! And i suppose you might tear your hair out and say
"How can i cope with this?!" And the answer is - and i'm going to leave it to
Sean and the 'Computerphile' organization - tentacles everywhere (!)
to find somebody suitable to follow me and to say: "This is still an issue!"
And in fact I think Ken invented the word 'trojan' for this [situation].
[He] said: "This thing is masquerading as 'Oh! I'm
just a perfectly innocent C compiler' " But it isn't ! It's a Trojan Horse.
There's trapdoors in the underside of it that will let you do these awful things
and enable you to -- because of its self-replicating capability
-- will enable you to propagate for evermore.
And he basically just says: " Consider ... !"
It's sobering. >> Sean: So this was 1984 this came out >> DFB: [Yes] this was 1984 ...
>> Sean: Truly Orwellian >> DFB: Truly Orwellian. The article we're
pointing you [to] by Cory Doctorow was published in 2020.
All i'm saying is -- [and I] am not part of the great UNIX Security industry - I know nothing (!)
I'm just telling you what Ken did originally. But what Doctorow was
saying is [that] this is still a big big issue.
Because if you consider what kind of things you could propagate
using techniques like this ... if you were a 'bad' company
You could for example be a supplier of printer inks
and start interrogating your printer and say "Are you running the right
sort of ink or is it 'rogue' ink? Because if so we're going to disable your print routines"
Or alternatively [if you've] got one of these newfangled [by 1984 standards!]
CD-ROM burners in your computer what happens if it's made by a company that's
subverted the system software in UNIX in such a way
that it won't let you copy rogue CDs that haven't been made with its own facilities.
Stuff like that. The possibilities are limitless.