[HN Gopher] Ghidra: Software reverse engineering suite developed...
___________________________________________________________________
Ghidra: Software reverse engineering suite developed by NSA
Author : f1shy
Score : 74 points
Date : 2022-10-16 18:40 UTC (4 hours ago)
(HTM) web link (ghidra-sre.org)
(TXT) w3m dump (ghidra-sre.org)
| curiousgal wrote:
| I always chuckle when I come across this tool, ghidra reads like
| Gdr which means "betrayal of trust" in Arabic.
| boxfire wrote:
| Which is prescient... this is a tool by the NSA after all. I
| would be disappointed if it _wasn 't_ back-doored... Anybody
| working on a feature-parity FOSS alternative from scratch?
| lo_zamoyski wrote:
| To what end? The risk of it being discovered is high and
| would only cause scandal.
| mikepurvis wrote:
| What would a back door look like in a tool like this?
| Silently returning incorrect results for certain binaries?
|
| Perhaps I lack imagination but I'm having trouble picturing
| what that could be good for or how it could even be hidden.
| This isn't like a crypto constant that you can pretend is
| random but secretly has known factors.
| saagarjha wrote:
| Releasing backdoored software to people who are experts in
| finding software backdoors would definitely be a strategy
| uni_rule wrote:
| One of the strategies of all time
| SXX wrote:
| Like, come on. How it's can be back-doored if it can work
| just fine in offline VM?
|
| Also there are only small percent of specialists who even
| know this tool exist let alone have know-how to use it. And
| since it heavily used for mailware reverse engineering it's
| gonna be laughtable to put any "secret backdoors and
| exploits" in it.
|
| Might be worth it as hacker contest for finding good hiring
| candidates, but certainly not at spying attempt. No sane
| person who able to use this software gonna run it on PC
| containing some important secrets.
| brian-armstrong wrote:
| The source is freely available on Github. Show us where the
| backdoor is.
| lobstersammich wrote:
| For folks who are curious, here's a translation. Scroll to the
| bottom of the dictionary page. In the left-hand column there is
| an entry under `gadara`:
| https://ejtaal.net/aa/#hw4=793,ll=2323,ls=5,la=3216,sg=766,h...
| soheil wrote:
| If there is a set of organizations that would consider using this
| tool that could be the justification for releasing it. It's a
| tool to reverse engineer binaries so it's likely to also reverse
| engineer whoever is foolish enough to run it in a production
| environment against an adversary thus putting the NSA in the
| driver's seat.
| saagarjha wrote:
| Are you familiar with how Ghidra works? You run it own your own
| computer on a binary that you feed it. It's not like it talks
| to the NSA to exfiltrate things.
| ackbar03 wrote:
| He's not completely wrong though, you do want to be careful
| when your using something developed by someone like the NSA.
| It's the same reason you want to be careful using cracked
| versions of IDA since the guys that can crack IDA can
| probably do other stuff to it.
|
| I think thats part of the reason NSA open sourced the code
| for it so people could see no backdoor are in there. So in
| this particular case maybe less of a concern
| saagarjha wrote:
| The NSA would suffer reputational damage by doing this.
| Random cracker might do so too but it's definitely a
| different market.
| rouxz wrote:
| I'm genuinely curious if NSA opened up ghidra because of Snowden
| or not.
| anony23 wrote:
| What's the connection?
| rouxz wrote:
| Well, the agency's reputation is not very good so we'll
| recover by playing "it's all for great good & people" card.
| SXX wrote:
| Like any other organization NSA needs to attract talent and
| compete for it with US corporations. Releasing Ghidra as open
| source they solve multiple problems.
|
| 1. Show everyone in reverse engineering and cybersecurity
| community what cool toys NSA have to play with.
|
| 2. Make sure there is huge pool of talent trained to work with
| NSA tools.
|
| 3. Get countless contributions towards processors /
| architecture support, etc.
| smoldesu wrote:
| Yep. The NSA was solving a universal problem (nobody wants to
| pay for IDA Pro licenses) and it makes more sense to pool
| their efforts with the community than to divide them. That,
| and it's also great PR. But mostly the first one, I reckon.
| SXX wrote:
| What worse before Ghidra was released it was actually damn
| hard to even buy IDA license and I not even sure if
| situation changed at all. I cant even imagine that someone
| can "secretly" buy an IDA license and it obvious thing that
| NSA would want to do.
|
| I guess people who come up with conspiracy theories simply
| don't know that all around the world there might be like
| 10,000 good reverse engineering experts. Might be even less
| of them. It's very small talent pool and it does make sense
| for NSA to do everything to make hiring easier.
| secondcoming wrote:
| You can download a free version of IDA at [0]. It only
| supports x86/x64
|
| [0]https://hex-rays.com/ida-free/#download
| kekebo wrote:
| Chris Delikat presented iirc mostly practical reasons for
| open sourcing Ghidra, like interoperability with other
| agencies or non-government groups, at Black Hat 2019:
| https://youtu.be/kx2xp7IQNSc?t=1838
|
| If the reasons presented were actually decisive can of course
| be questioned.
| SXX wrote:
| Okay I haven't seen this speech before. I guess we can
| actually trust the guy who worked at NSA at time to know
| their reason for releasing it. I mean Chris Delikat.
|
| And yeah he does mention recruitment benefits on second
| slide.
| dang wrote:
| Related:
|
| _Ghidra: A software reverse engineering suite of tools developed
| by the NSA_ - https://news.ycombinator.com/item?id=27818492 -
| July 2021 (142 comments)
|
| _Ghidra 9.2_ - https://news.ycombinator.com/item?id=25086519 -
| Nov 2020 (78 comments)
|
| _Ghidra Decompiler Analysis Engine_ -
| https://news.ycombinator.com/item?id=19599314 - April 2019 (30
| comments)
|
| _Ghidra Capabilities - Get Your Free NSA Reverse Engineering
| Tool [pdf]_ - https://news.ycombinator.com/item?id=19319385 -
| March 2019 (17 comments)
|
| _Ghidra, NSA 's reverse-engineering tool_ -
| https://news.ycombinator.com/item?id=19315273 - March 2019 (405
| comments)
|
| _Ghidra_ - https://news.ycombinator.com/item?id=19239727 - Feb
| 2019 (59 comments)
|
| _NSA to Release Their Reverse Engineering Framework GHIDRA to
| Public at RSA_ - https://news.ycombinator.com/item?id=18828083 -
| Jan 2019 (90 comments)
|
| Also:
|
| _Patching an embedded synthesiser OS from 1996 with Ghidra_ -
| https://news.ycombinator.com/item?id=31144106 - April 2022 (32
| comments)
|
| _Analysis of large binaries and games in Ghidra-SRE_ -
| https://news.ycombinator.com/item?id=27972308 - July 2021 (22
| comments)
|
| _Ghidra Analyzer for UEFI Firmware_ -
| https://news.ycombinator.com/item?id=26819673 - April 2021 (23
| comments)
|
| _Legalizing gay marriage in Crusader Kings III with Ghidra_ -
| https://news.ycombinator.com/item?id=26703404 - April 2021 (170
| comments)
|
| _Using Ghidra to Reverse Engineer Super Monkey Ball for
| GameCube_ - https://news.ycombinator.com/item?id=26315368 - March
| 2021 (64 comments)
|
| _A first look at Ghidra's Debugger - Game Boy Advance Edition_ -
| https://news.ycombinator.com/item?id=25553105 - Dec 2020 (14
| comments)
|
| Others?
| mdaniel wrote:
| I don't know if you exclusively meant other HN links, but these
| are usually interesting:
|
| https://github.com/AllsafeCyberSecurity/awesome-ghidra#readm...
| (and derivatives since GH awesome lists are only as awesome as
| PRs against them:
| https://github.com/AllsafeCyberSecurity/awesome-ghidra/netwo...
| )
|
| https://github.com/topics/ghidra
| aborsy wrote:
| I'm curious, is it known how far the NSA goes in hacking
| computers and phones? Is there any NSA proof setup?
|
| For example, do they have a surveillance system that remotely
| monitors or can remotely every Apple's device (they are all
| closed source)? If small companies can do it, surely nsa does it
| too!
|
| Or a system through which they can login to anyone's account
| linked to American companies (eg, existence of a software system
| through which they login to anyone's Gmail or AWS account when
| needed, without subpoena or request to those companies).
|
| This basic means complete mass or targeted surveillance.
| Encryption seems futile against such actors that can hack end
| points easily.
| YetAnotherNick wrote:
| I would assume that NSA could totally do targeted surveillance
| on anyone as even if we assume that NSA couldn't do anything,
| they clearly have money and contact to buy everything from
| Israel, which has proven technology to hack phones with 0
| click.
|
| For mass surveillance, the problem is not technical but more
| legal. It is almost plain and clear illegal for any agency to
| do in US to do it on all data so they have to come up with
| loopholes for things like metadata or risk the agency.
| random314 wrote:
| Mass surveillance has been on for more than a decade. You can
| assume that all non encrypted communication is logged.
| Snowden's leak showed that NSA was tapping internal Google
| fiber at the transcontinental connection points. Google
| immediately switched to encrypted communication within
| Google's data center.
|
| https://www.eff.org/nsa-spying
|
| https://www.washingtonpost.com/world/national-
| security/nsa-i...
| aborsy wrote:
| The legality applies to American residents. I assume the
| surveillance can be uncontrolled with foreign citizens.
|
| This then brings up the question about intellectual property.
| How do weaker nations protect their IP on important
| technologies against more powerful nations such U.S. or
| China?
|
| This seems to lead to a widening information gap between
| nations.
| Quarrel wrote:
| > The legality applies to American residents. I assume the
| surveillance can be uncontrolled with foreign citizens.
|
| This is one of the reasons the 5 eyes nations are in bed
| together. I'll spy on you if you spy on me.
| beauHD wrote:
| Pegasus was detected by sending sample devices to Citizen
| Lab[0]. Currently there is no known evidence of an NSA
| 'backdoor' in iPhones, and if there is, it's very well hidden.
| And it's not like we can't inspect traffic going in and out of
| iPhones. If you are concerned about data being sent to Fort
| Meade, MITM all the traffic and then blow the whistle to alert
| others.
|
| [0] https://citizenlab.ca/2022/10/new-pegasus-spyware-abuses-
| ide...
| O__________O wrote:
| This is likely NSA's most popular repository on GitHub, but worth
| checking out their others too:
|
| - https://github.com/NationalSecurityAgency
|
| Prior HN coverage is here:
|
| - https://hn.algolia.com/?q=https%3A%2F%2Fgithub.com%2FNationa...
|
| I would be curious if anyone knows what their filter, reasoning,
| etc - for open sourcing X vs Y. In case of Ghidra, think its
| existence was originally revealed to the public via WikiLeaks in
| 2017; might be wrong, but think the software was posted too --
| for sure though was open sourced two years later in 2019.
| Quarrel wrote:
| If their reasoning was to spur on development in the reverse
| engineering space they've done amazing things by releasing
| this.
|
| The obvious step 1) Lots of people use & improve ghidra, write
| plugins etc. It is good now, but in 5 years it could be best in
| class.
|
| step 2) their biggest & bestest competitor IDA has massively
| accelerated the rate of their development, engagement &
| community responsiveness. IDA was this slow moving dinosaur
| that had good ideas and people that has been poked to life by a
| proper competitor.
|
| If the NSA wants a robust RE scene, with experience engineers
| and good tools, then I think they've done themselves a massive
| favour by releasing and stewarding the development of ghidra as
| an OSS tool.
| jdm2212 wrote:
| Ghidra was already best-in-class, and the goal isn't to build
| a community around Ghidra -- it's to spur recruiting by
| giving people a taste of how far ahead the NSA is of what's
| commercially available. If this is what they can give away
| for free, imagine what you can use if you go work there.
| Quarrel wrote:
| What are you using it for that you think it is best in
| class?
|
| For everything I use it for IDA is still well ahead.
|
| I only do x86 work, so maybe in other areas, but I doubt
| it? The decompiler is getting better, but still has quite a
| ways to go, the plugin support is way behind, etc etc.
| mdaniel wrote:
| Maybe they meant the class of open source reverse
| engineering tools
|
| Just as others have mentioned, it can be problematic to
| even _buy_ IDA Pro, so if Jane Haqor is able to get
| started with Ghidra and then develops a passion for the
| space, then that makes Ghidra best for that class, also
| jdm2212 wrote:
| They open source stuff that is no longer a differentiated
| capability (hence no harm in releasing it to the public), and
| the goal is recruiting. Same as any tech company that open
| sources projects because it'll attract positive attention from
| hiring prospects.
| beauHD wrote:
| > I would be curious if anyone knows what their filter,
| reasoning, etc - for open sourcing X vs Y.
|
| NSA is both red team and blue team. This is a blue team tool
| used by reverse engineers to analyze malware, so it was NSA's
| little gift to researchers, an agency known for hoarding
| secrets for our 'security'.
| jasonladuke0311 wrote:
| > This is a blue team tool used by reverse engineers to
| analyze malware
|
| It's also a red team tool for binary exploitation.
|
| EDIT: The cynic in me posits it was used far more for exploit
| development than for analyzing malware, unless that had
| offensive applications too. But I don't know anything, I
| never worked there.
___________________________________________________________________
(page generated 2022-10-16 23:01 UTC)