Earlier quoted context omitted.
It's not Open Source.
not everything in the world has to be open source
True, but we do need one of everything to be open source.
Ghidra, NSA's reverse-engineering tool
321–330 of 425 posts
Re: Ghidra, NSA's reverse-engineering tool
#322Earlier quoted context omitted.
My office is in the same building as BitDefender. I casually talked to some of the guys and they do use IDA Pro in their malware research department. They mostly hire their researchers straight out of college if they have high C proficiency and train them internally to use IDA Pro. I know my comment isn't exactly what you asked, but I hope it clears some light.
> My office is in the same building as BitDefender. (...) They mostly hire their researchers straight out of college if they have high C proficiency Also partially OT, just wanted to say that I was a sort of college-roommate with one of their present-day senior security researchers in the early 2000s and to this day I remember that person as one of the most code-obsessed persons I have ever met, and I say that in a g…
So he is basically Stallman's hacker.
Re: Ghidra, NSA's reverse-engineering tool
#323RCE included ;) https://github.com/NationalSecurityAgency/ghidra/issues/6
This not being the top comment kinda scares me. Sure, it might be a great tool for free, but who knows what else might be hidden in there?
Likely nothing, it's the source code for an RE toolkit with an NSA sticker right on the box. There is literally no worse place to try to hide back doors.
At worst they will know how to mask their real malware from analysis with their own tools.
Re: Ghidra, NSA's reverse-engineering tool
#324Earlier quoted context omitted.
Even if it is open source, I might worry about using an open source tool from the NSA.
Yeah, my mouse was hovering over the download button eager to test it out when my brain suddenly went "wait, don't do that!" If you wanna run this thing, you should probably build it from source yourself (don't trust the binaries) and even then run it in a pretty well sandboxed virtual machine. I would not be surprised at all if the NSA left some surprises in that thing.
If you're decompiling and analysing ANYTHING, you should be running it on a reflashable, airgapped machine in case it does something unexpected, even if it isn't intentionally malicious. Plus you probably don't want it phoning-home either...
Re: Ghidra, NSA's reverse-engineering tool
#325This is Sanskrit name for Vulture Ghid = Vulture Ra = In Sanskrit RA is the acoustic root of fire. RA also connotes with light or spiritual light.
No. This is clear apophenia. Ghidra is a reference to the Japanese video game boss of the same name, which was supposed to be called Hydra, but due to mis-translation, came as Ghidra In Sanskrit, a vulture is vocally spoken aloud like [Giddh], emphasis on the end. > Ra is the acoustic root of fire Any source for that?
Funny, I'd assumed it was a reference to the movie monster.
Re: Ghidra, NSA's reverse-engineering tool
#326Earlier quoted context omitted.
I hope you don't use Linux, because the NSA contributes to quite a lot of OSS. They also created SELinux for instance.
Those changes on OSS are reviewed by a lot of people, this here is just released and reviewed by themselves only.
Sure, the ones officially contributed by the NSA. What you have to wonder is how much code was contributed by some seemingly normal community member that is actually a front for the NSA to introduce subtly flawed code that they can use to their advantage while being plausibly just a bug?
There are those who suspect Heartbleed came about this way.
Re: Ghidra, NSA's reverse-engineering tool
#327Earlier quoted context omitted.
Think BinaryNinja has been acting pretty effectively as a competitor to IDA Pro. Its much cheaper than IDA, has a good API and I have been a very happy customer.
And they didn't take my money, break my key in an update, and ghost me while I was still in the support period. So they've got that going for them.
Did they ever tell you why they did that?
I'd like to hear the rest of this story, I was considering buying IDA Pro (though these days I'm having a lot of fun adding M68k support to Avast's Retdec)
Re: Ghidra, NSA's reverse-engineering tool
#328Probably not run that on networks you care about: https://twitter.com/hackerfantastic/status/11030878690637045...
… in debug mode. Normally it doesn't load the debugging tools.
Re: Ghidra, NSA's reverse-engineering tool
#329From someone who does binary reverse engineering full time, in my experience, BinaryNinja, Hopper, radare2, etc are toys compared to IDA Pro + Hex Rays Decompiler. The quality of the results and the features supported are unmatched... until now. I haven’t spent too much time with ghidra yet but it’s the real deal. The output of the decompiler looks alright (not complete garbage like I’ve seen with other tools). Even…
Out of curiosity what kind of job involves doing binary reverse engineering full time?
Reverse engineering the firmware for an embedded product where someone lost the source code.
Bonus points available for:
* "the source control is ZIP files on a network share"
* "yeah we use forced squash commits on everything to keep the Git history nice and linear"
* "it was designed by a contractor who is now uncontactable"Re: Ghidra, NSA's reverse-engineering tool
#330Earlier quoted context omitted.
Even if it is open source, I might worry about using an open source tool from the NSA.
Yeah, my mouse was hovering over the download button eager to test it out when my brain suddenly went "wait, don't do that!" If you wanna run this thing, you should probably build it from source yourself (don't trust the binaries) and even then run it in a pretty well sandboxed virtual machine. I would not be surprised at all if the NSA left some surprises in that thing.
> I would not be surprised at all if the NSA left some surprises in that thing.
Huh. I would be extremely surprised if the NSA were to include some kind of malicious or pseudo-malicious easter egg in the open source RE toolkit they're releasing. How dumb would they have to be to pull a move like that, and for what? The self interest just doesn't line up.