I love that they named it Ghidra and use a dragon for a logo. That endears me to the people who built it.
Ghidra: A software reverse engineering suite of tools developed by the NSA
21–30 of 147 posts
Re: Ghidra: A software reverse engineering suite of tools developed by the NSA
#22Earlier quoted context omitted.
I don't think there is anything fishy here, although I don't think the NSA can just install anything on my computer, even if I were based in the US. There is a lot of bluffing when it comes to cyber security. Still it might be quite a useful tool.
There has been a lot of cyber crime in recent years, e.g. see the recent wave of ransomware attacks. These criminals are mostly amateurs that know some exploits and use them. The NSA is a huge organization that employs many professional experts. Spying is one of their main objectives so you can be pretty certain that they are pretty good at it. Computer systems contain a lot of vulnerabilities and you can be pretty c…
Most of their work probably doesn't even need to be technical. How many high-profile attacks have been based on social engineering?
Re: Ghidra: A software reverse engineering suite of tools developed by the NSA
#23Earlier quoted context omitted.
There has been a lot of cyber crime in recent years, e.g. see the recent wave of ransomware attacks. These criminals are mostly amateurs that know some exploits and use them. The NSA is a huge organization that employs many professional experts. Spying is one of their main objectives so you can be pretty certain that they are pretty good at it. Computer systems contain a lot of vulnerabilities and you can be pretty c…
Most of their work probably doesn't even need to be technical. How many high-profile attacks have been based on social engineering?
Most people hear "social engineering" and think of someone playing journalist to get access to places. The NSA's idea of social engineering is having the CIA work with the BND to buy Crypto AG.
Re: Ghidra: A software reverse engineering suite of tools developed by the NSA
#24It is open source software and it can reverse engineer programs from a lot of different systems. Some people may be worried about installing a piece of software on their computer that comes from the NSA. I don't think that there are real reasons to worry. One of the tasks of the NSA is defending against cyber attacks. Having more people with good tools helps the defense. Also, you can be pretty certain that some secu…
I was quite suspicious of it when it was first announced, but an open source RE tool is probably the stupidest place to put a backdoor. Author considerations aside, it’s a great tool, and does pretty well with decompiling.
I'm amazed at how often it does better than hexrays decompiler wise.
It's pretty spectacular.
Radare2 has a plugin for using ghidra's decompiler too https://github.com/radareorg/r2ghidra
So you can get all of the terminal level unix like goodness of radare2, yet still get really great ghidra quality decompiler output.
Re: Ghidra: A software reverse engineering suite of tools developed by the NSA
#25Earlier quoted context omitted.
>although I don't think the NSA can just install anything on my computer If it's not connected to a network you are probably right....otherwise 100% wrong, if your a enough valuable target. And just lets say for fun your OS is 100% bulletproof, your +30 firmware's are not.
I doubt it. From operations that went public the attack vectors are known and you can extrapolate something about their capabilities. Of course they could get access if I were a valuable target, but that might just as well be with a large wrench. But they cannot just take control of any device. And I think many companies might even have better capabilities. Or defense, since intelligence work is very often about indu…
You don't even exist to them. The NSA wants to infiltrate nations. They do stuff like hire a friendly foreign nation to quietly buy a security company their target depends on and then exploit that vulnerability from a host in a fourth nation.
Re: Ghidra: A software reverse engineering suite of tools developed by the NSA
#26I haven't used Ghidra that extensively, but it worked well when I was using it to assist in modding Minecraft Pi. The big point in its favor for me is that its free and supports ARM32, while IDA's free version only supports x86.
Re: Ghidra: A software reverse engineering suite of tools developed by the NSA
#27I used this again just the other day with the cantor.dust plugin. My rev.eng skills are dull and were never great to begin with, but for anything below a real APT with obfuscation, runtime decoding and unpacking, Ghidra is an equalizer. Between this and Chef from gchq, someone with devops skills can probably skill up to an entry level threat analyst level in a few weeks or months. The tooling available today is really good.
If people are worried about running systems backdoored by NSA, they probably shouldn't use things like electricity either. It's a threat actor you can't really do anything about.
Re: Ghidra: A software reverse engineering suite of tools developed by the NSA
#28I'm not sure why this is news. It is an amazing bit of kit, and cross platform. I've been using g it for many months now and highly recommend it.
For you it is obviously not news, but for other people it probably is. For me, HN is about learning something new, not just for learning about something that happened in the last 24 hours.
There's a plenty of Ghidra content on HN on a regular basis, take a look at
https://hn.algolia.com/?dateRange=all&page=0&prefix=true&que...
Re: Ghidra: A software reverse engineering suite of tools developed by the NSA
#29Few years in with debugger support, how does Ghidra compare to IDA?
Ghidra:
* Affordable for sane people (aka, free)... This of course pushed Hex-Rays to finally make a cheaper version of IDA, but it's massively hobbled and useless for uncommon architectures.
* Almost as good architecture coverage. Missing a few big ones for automotive RE still - SuperH is still hit and miss, and no real C167. But the user-contributed Tricore is really quite impressive.
* Decompiler works across all architectures.
* Debugger is still sketchy, but has progressed extremely quickly.
* Preferable UI (IMO), and better struct handling.
* Decent plugin interfaces but fewer available plugins.
IDA:
* Still slightly better decompilation and disassembly for x86-64. Doesn't get as "lost" in vtables and big switches.
* Much better C++ construct support.
* More plugins and scripts available off the shelf.
* Still a few architectures which Ghidra doesn't have yet.
* Debugger is more stable and works a bit better.
For most architectures I would not start using IDA today as a hobbyist, but if I had a good IDA workflow or was joining a company where it were the gold standard, I wouldn't feel compelled to move over.
Re: Ghidra: A software reverse engineering suite of tools developed by the NSA
#30It is open source software and it can reverse engineer programs from a lot of different systems. Some people may be worried about installing a piece of software on their computer that comes from the NSA. I don't think that there are real reasons to worry. One of the tasks of the NSA is defending against cyber attacks. Having more people with good tools helps the defense. Also, you can be pretty certain that some secu…
I don't think there is anything fishy here, although I don't think the NSA can just install anything on my computer, even if I were based in the US. There is a lot of bluffing when it comes to cyber security. Still it might be quite a useful tool.
"There is a lot of bluffing when it comes to cyber security."
I wish this topic received more discussion.