The threat is long proven and it&#x27;s wise you consider it. The high assurance sector &amp; CompSci demonstrated it repeatedly in pentests and evaluations going back to the 70&#x27;s. Here&#x27;s some stuff for you or anyone interested in the subversion threat.<p>Landmark work by Myer in 1980 fleshing it out
<a href="http:&#x2F;&#x2F;csrc.nist.gov&#x2F;publications&#x2F;history&#x2F;myer80.pdf" rel="nofollow">http:&#x2F;&#x2F;csrc.nist.gov&#x2F;publications&#x2F;history&#x2F;myer80.pdf</a><p>Demonstration of simplicity of it against NFS by Anderson
<a href="http:&#x2F;&#x2F;www.dtic.mil&#x2F;dtic&#x2F;tr&#x2F;fulltext&#x2F;u2&#x2F;a401762.pdf" rel="nofollow">http:&#x2F;&#x2F;www.dtic.mil&#x2F;dtic&#x2F;tr&#x2F;fulltext&#x2F;u2&#x2F;a401762.pdf</a><p>Lack&#x27;s use of one against Windows XP
<a href="https:&#x2F;&#x2F;calhoun.nps.edu&#x2F;bitstream&#x2F;handle&#x2F;10945&#x2F;962&#x2F;03Jun_Lack.pdf?sequence=1" rel="nofollow">https:&#x2F;&#x2F;calhoun.nps.edu&#x2F;bitstream&#x2F;handle&#x2F;10945&#x2F;962&#x2F;03Jun_Lac...</a><p>All the same group, Navy Postgraduate School, with some of the professors being founders of information security field. They never forget the old stuff that works. Always mention the old strategy, high-assurance, as a solution as it was only thing proven to work. People never learn, though. Hence, endless opportunities in new projects for 0-days and subversion. ;)