41–50 of 60 posts
Earlier quoted context omitted.
You'd have to audit the source code first, though, which is not a trivial thing to do.
Given the audience I feel like the source code will be audited by the community in record time.
a) audit a tool like this and
b) have the chops to perform that audit
Reverse engineers. If you're nervous, just wait 2 months and follow Twitter.
NSA releasing an open-source tool? My first thought is, better subject it to serious, in-depth security review before installing it locally. Even then, build it from source.
Apache NiFi was also released by the NSA & has seen commercial success in the enterprise.
NSA releasing an open-source tool? My first thought is, better subject it to serious, in-depth security review before installing it locally. Even then, build it from source.
My brother is into reverse engineering, he is literally counting the days to the open source release of this. He said there isn't anything quite like it as it can actually stand toe-to-toe with IDA Pro, the commercial software that apparently nothing yet can really beat.
Is IDA so superior to OllyDBG? What are the differences? I was into reversing in 2009/2010, was just a hobbist trying to crack some programs and making bots to some games.
NSA releasing an open-source tool? My first thought is, better subject it to serious, in-depth security review before installing it locally. Even then, build it from source.
Apache NiFi was also released by the NSA & has seen commercial success in the enterprise.
NSA releasing an open-source tool? My first thought is, better subject it to serious, in-depth security review before installing it locally. Even then, build it from source.
It would also make me want to consider Ken Thompson's compiler trojan, and whether there is any similar vulnerability that could be inserted into an RE tool. http://wiki.c2.com/?TheKenThompsonHack
Note that unless your compiler is already bugged (or you’re using a bugged binary), community review of the source should turn out any possible issues... unless there’s a significant competence gap between the NSA and the security community — which may be possible, but I don’t think security professionals are worried about it.
Earlier quoted context omitted.
Sandboxing things is rarely trivial ;)
Air gapped RE machines (recall you're probably looking at malware anyway). One way transfer of samples. Print reports and OCR. Done.
Earlier quoted context omitted.
It would also make me want to consider Ken Thompson's compiler trojan, and whether there is any similar vulnerability that could be inserted into an RE tool. http://wiki.c2.com/?TheKenThompsonHack
Do RE tools commonly output binaries? Note that unless your compiler is already bugged (or you’re using a bugged binary), community review of the source should turn out any possible issues... unless there’s a significant competence gap between the NSA and the security community — which may be possible, but I don’t think security professionals are worried about it.
Earlier quoted context omitted.
It's going to be an open source release so depending on your paranoia levels you could just build it yourself.
You'd have to audit the source code first, though, which is not a trivial thing to do.
an open source competitor to IDA pro is very welcome, never thought it would come from NSA. have they said anything about their motivation to open-source it?
Probably to crowd source maintenance like nearly every other closed to open transition. And ghidra has been leaked a few times (they give it out like candy to contractors) so they're not really losing much.