Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ghidra: A software reverse engineering suite of tools developed by the NSA

ghidra-sre.org

Post reply on HN
Print view View original

61–70 of 147 posts

Re: Ghidra: A software reverse engineering suite of tools developed by the NSA

#61

Post by NotSwift »

rjzzleep wrote: post #45
userbinator wrote: post #35

Earlier quoted context omitted.

How well does it decompile itself ? I've always considered that a great test, much like a self-compiling compiler is a notable milestone. (I believe IDA has a check to stop you from doing this. Cracking that was one of the "rite of passage" exercises back in the day.)

Isn't it written in Java? Why would it need to do that? IDA has had watermarks and all sorts of other fancy stuff. The real challenge with IDA was extending the demo to allow it to save databases before they started publishing a working older free version. I like IDA a lot more than I like all the other tools, especially since I consider the user experience and hotkeys far superior, but the other day I did look at so…

Even better, the NSA provides the sources which you can compile yourself:

https://github.com/NationalSecurityAgency/ghidra/releases

Re: Ghidra: A software reverse engineering suite of tools developed by the NSA

#62

Post by nix23 »

o8r3oFTZPE wrote: post #30
raxxorrax wrote: post #3

Earlier quoted context omitted.

I don't think there is anything fishy here, although I don't think the NSA can just install anything on my computer, even if I were based in the US. There is a lot of bluffing when it comes to cyber security. Still it might be quite a useful tool.

"There is a lot of bluffing when it comes to cyber security." I wish this topic received more discussion.

Yes we can talk about that, let's start with the FSB an why they are always so stupid ;) to left the compilation time with the working-hours of moscow and the cyrillic keyboard in the compiled binary.

Re: Ghidra: A software reverse engineering suite of tools developed by the NSA

#63

Post by NotSwift »

pkaye wrote: post #13
ShepherdKing wrote: post #8

Earlier quoted context omitted.

I would be curious to know if anyone has audited this for malicious code, or how one would go about doing that in the first place. Is that kind of software auditing a use case for Ghidra? A demo of using Ghidra to audit Ghidra would be interesting I suppose.

Its used to reverse engineer an unknown binary without the matching source code. Since Ghidra already is open source it be no use to audit Ghidra itself except for learning purposes. It might be useful to reverse engineer a closed source driver so you can write an open source one from scratch.

A security audit is still useful when you have sources to the program. There may still be some intended or just accidental security problems with it. Having the sources makes such an audit a lot easier to do.

Re: Ghidra: A software reverse engineering suite of tools developed by the NSA

#64

Post by rapjr9 »

NotSwift wrote: post #2

It is open source software and it can reverse engineer programs from a lot of different systems. Some people may be worried about installing a piece of software on their computer that comes from the NSA. I don't think that there are real reasons to worry. One of the tasks of the NSA is defending against cyber attacks. Having more people with good tools helps the defense. Also, you can be pretty certain that some secu…

I can think of one concern about downloading and installing it, the NSA might be interested in who uses it. No need for anything malicious in the code, they just watch to see who downloads it.

Re: Ghidra: A software reverse engineering suite of tools developed by the NSA

#65

Post by rytis »

klyrs wrote: post #55
ragona wrote: post #32

Earlier quoted context omitted.

I’m quite sure they could, but mostly just because they could simply walk into your house and tamper with the hardware. You don’t need a fancy zero day when you’re the government.

Funny thing about lockdown/wfh4l... they're really gonna wait a while to get in

Turn up with a bunch of fire engines, and a gas company van. Knock on your door, and 3-4 neighbors on each side, for good measure. Tell there's been a report of a gas leak, and you need everyone to leave their houses/apartments immediately for the inspection. 15-20 mins later - you can come back in, all's safe. Thank you for your cooperation.

Re: Ghidra: A software reverse engineering suite of tools developed by the NSA

#66

Post by nix23 »

nextlevelwizard wrote: post #48
nix23 wrote: post #7

Earlier quoted context omitted.

>although I don't think the NSA can just install anything on my computer If it's not connected to a network you are probably right....otherwise 100% wrong, if your a enough valuable target. And just lets say for fun your OS is 100% bulletproof, your +30 firmware's are not.

What’s with the doomer mentality. NSA isn’t some magical unicorn that can just walk through everything

>NSA isn’t some magical unicorn

With unlimited money and the given job to crack encryption, hack into systems and secure the networks of the wealthiest nation and only superpower on earth atm. It IS pretty much a unicorn, and i am pretty sure they are +20 years in the future technology-wise, and with that:

>>Arthur C. Clarke — 'Magic's just science that we don't understand yet.'

So yes Magic Unicorn describes the NSA pretty well.

Re: Ghidra: A software reverse engineering suite of tools developed by the NSA

#67

Post by rytis »

Datagenerator wrote: post #41
shadilay wrote: post #37

Earlier quoted context omitted.

Powerline ethernet?

Some people like me, can hear data movement on PCB's. The electrical circuit has noise signatures which change if other data is injected by Ethernet over powerline equipment. The distance from which this works is quite large, up to a few houses with consumer hardware. Fear equipment with built-in LoFi.. that's reachable without cooperation of LAN equipment..

> The electrical circuit has noise signatures which change if other data is injected by Ethernet over powerline equipment.

What does this even mean?

Re: Ghidra: A software reverse engineering suite of tools developed by the NSA

#68

Post by aj3 »

rapjr9 wrote: post #64
NotSwift wrote: post #2

It is open source software and it can reverse engineer programs from a lot of different systems. Some people may be worried about installing a piece of software on their computer that comes from the NSA. I don't think that there are real reasons to worry. One of the tasks of the NSA is defending against cyber attacks. Having more people with good tools helps the defense. Also, you can be pretty certain that some secu…

I can think of one concern about downloading and installing it, the NSA might be interested in who uses it. No need for anything malicious in the code, they just watch to see who downloads it.

But it's hosted on Github. And some distros have ghidra in official repos.

Re: Ghidra: A software reverse engineering suite of tools developed by the NSA

#69

Post by aj3 »

NotSwift wrote: post #63
pkaye wrote: post #13

Earlier quoted context omitted.

Its used to reverse engineer an unknown binary without the matching source code. Since Ghidra already is open source it be no use to audit Ghidra itself except for learning purposes. It might be useful to reverse engineer a closed source driver so you can write an open source one from scratch.

A security audit is still useful when you have sources to the program. There may still be some intended or just accidental security problems with it. Having the sources makes such an audit a lot easier to do.

It's a huge code base, of course there are security issues. Same way IDA and radare have security issues. People who reverse malware take that into account.

Re: Ghidra: A software reverse engineering suite of tools developed by the NSA

#70

Post by NotSwift »

inlikealamb wrote: post #22
NotSwift wrote: post #4

Earlier quoted context omitted.

There has been a lot of cyber crime in recent years, e.g. see the recent wave of ransomware attacks. These criminals are mostly amateurs that know some exploits and use them. The NSA is a huge organization that employs many professional experts. Spying is one of their main objectives so you can be pretty certain that they are pretty good at it. Computer systems contain a lot of vulnerabilities and you can be pretty c…

Most of their work probably doesn't even need to be technical. How many high-profile attacks have been based on social engineering?

Social engineering can be highly effective. However, from what we know about the NSA, especially from the Snowden leaks, it appears to be mainly a technical agency. It seems likely that the NSA does not use social engineering on a large scale itself but hands it off to other agencies like the CIA or the FBI.
Post reply on HN