Slashdot Mirror
NSA To Release a Free Reverse Engineering Tool (zdnet.com)
The US National Security Agency will release a free reverse engineering tool at the upcoming RSA security conference that will be held at the start of March, in San Francisco. From a report: The software's name is GHIDRA and in technical terms, is a disassembler, a piece of software that breaks down executable files into assembly code that can then be analyzed by humans. The NSA developed GHIDRA at the start of the 2000s, and for the past few years, it's been sharing it with other US government agencies that have cyber teams who need to look at the inner workings of malware strains or suspicious software. GHIDRA's existence was never a state secret, but the rest of the world learned about it in March 2017 when WikiLeaks published Vault7, a collection of internal documentation files that were allegedly stolen from the CIA's internal network. Those documents showed that the CIA was one of the agencies that had access to the tool.
Eg Ndisasm
Taking assembly at university in the early '90's I used a decompiler in the process.
How is this "a disaster"? What is unique about this one other than the maker?
I thought it was illegal to reverse engineer software?
Have you seen what the Obfuscated C project can do? I wouldn't trust NSA source code beyond 'print "Hello World";' and even that is iffy. God help anyone who touches it if this release is binary only.
Does it come with a free thumbdrive? If not, I won't be interested.
Is that a roll of dimes in your pocket or are you happy to see me?
Its nice to read the CIA Marble Framework results when the code shows what foreign language text the CIA wanted to be found.
Domestic spying is now "Benign Information Gathering"
That's kind of trivial. Tedious and laborious, but trivial - you do not need the NSA to tell you how to do that. If the tool were able to spit out code in some high-level language (even something as low-level as C) that is not unintelligible spaghetti code, that would be something.
I have been a long time supporter of IDA Pro, for better than 15 years. Every year I would dig down deep into my pockets and hand over about $600 for my maintenance contract renewal, for my own personal use. My "named" license allowed me to install the product on any machine where I need to analyze something down to the assembly level, and chase the rabbit down the hole. I could code in IDAPython, to script up some magic to analyze things in ways you just could not do with any other tool. Except of course the infamous GHIDRA, which although people I knew at work all used it, I had no direct access to the tool. They said it was better than IDA Pro. Still, there were reasons for them to keep IDA Pro on their tool shelf because no one tool fits every problem.
Well in 2018 HexRays changed the licensing, and removed the "named" licenses from their offerings. For twice the price I could own a single license for one single machine, that was of course not going to be the one I needed to analyze. My desktop machine is essentially a Xen virtualizing service with lots of smaller task-oriented virtual machines. Which single virtual machine do I now choose to run IDA Pro in? Whichever one I choose there will be some other place I need to debug something. The new IDA Pro licensing sucks, and I can not justify that kind of money for software that I can not even run where I need it.
Now I can not wait to get my hands on GHIDRA.
GHIDRA is supposed to be released at RSA. They have a talk scheduled about it. I've seen some people eager (setting aside backdoor risks) for a strong competitor to IDA Pro and its ridiculously high prices.
You can never go home again... but I guess you can shop there.
...so you want to monitor who will download it, isn't it ?!?
Sorry, no mod points - well deserved here :-)
I would guess that it's not only download monitoring - how many people will use this tool to analyze the very tool itself?
Yes, obfuscated programming contests can serve as important learning tools for those who want to liberate themselves from continued ignorance driven by fear of the unknown.
I think it's safe to say you won't be doing anything with the program (as far as you know) but programmers simply can't afford the luxury of being ignorant and non-programmers are not well served by inculcating fear. The result of your suggestion is to maintain a small group of elites who ought to be blindly trusted rather than kept in check through software freedom.
I'm not sure what constitutes 'touching' in this context but disassembling the binary and examining how that works (even running the code once understood on a spare computer or VM, perhaps one that isn't networked) should be encouraged particularly for the purposes of providing a free software replacement. Running the program temporarily might be necessary to provide a free software replacement. One hopes that any release comes with complete corresponding source code and build instructions. But really, there's no more reason to trust the proprietary software people run every day than there is to trust any code from the NSA. Proprietary software is often malware. We have no good reason to trust the NSA nor software proprietors; in fact, the proprietors sometimes work with the NSA (like when Microsoft specifically changed Skype to make it easier to spy upon).
Digital Citizen
objdump -D ....