Software Integrity: Detecting Backdoors and Hidden Functionality in Commercial Software

The article reflects on how security leaders should assess whether commercial software may contain backdoors or undeclared capabilities. It recalls historical precedents, including the Crypto AG case, in which encryption equipment was reportedly compromised by intelligence agencies, showing that trust in a supplier extends to its products. It cites Ken Thompson's 1984 lecture on compromised compilers and DARPA's TRUST program on hardware integrity as earlier signs of the same problem. The author argues that enterprise products with privileged access and automatic updates now pose similar risks, and that malicious functionality must be treated as a distinct concern beyond ordinary vulnerabilities. The piece proposes a dedicated software integrity assurance track covering source, build, binary, and update chains.