Ghidra

https://www.nsa.gov/resources/everyone/ghidra/

by jakobdabo • 7 years ago

103 59 7 years ago

nsa.gov

amiga-workbench2• 7 years ago

Uhh, what's this about? https://i.imgur.com/e3kNYTH.png

captn3m0• 7 years ago

Link, in case someone wants to dig further. https://nsa.dod.afpims.mil/

hermitdev3• 7 years ago

403'd for me...was forced from https to http for some reason (on mobile with JS disabled - maybe a factor?).

richardwhiuk• 7 years ago

I get:

You cannot visit nsa.dod.afpims.mil at the moment because the website sent scrambled credentials that Google Chrome cannot process. Network errors and attacks are usually temporary, so this page will probably work later.

mcpherrinm• 7 years ago

I haven't worked at US government so I am not 100% sure of the details, but this is my understanding:

HTTPS (tls, really) allows clients to present a certificate, just like the server does. This is commonly used, eg, for microservices authenticating to each other in a backend.

It is less commonly used for people to authenticate to servers.

In particular, the "Common Access Card" is the ID badge used by the DoD, various parts of the armed forces, and in particular the NSA (whose website this is). Those access cards have a key and certificate usable for this.

So your keyboard (or laptop) has a smartcard reader in it, and you can insert your ID badge (maybe with a PIN? not sure if usa gov't does that) to log into any website.

Browser UX for this isn't great. Unlike the newer Webauthn specs where javascript (and thus site-specific instructions) can ask you to log in, the browser has to prompt you in a very generic way to present your certificate.

unknownknowns• 7 years ago

Client certificate PKI is common in this space. Even if it's just a local cert on the user's profile, it works really well as SSO.

Godel_unicode6• 7 years ago

I actually prefer the browser UX for client cert authentication; since it's presented by the browser it's harder to do nefarious things with JavaScript to confuse the user as to what site is requesting authentication.

Edit: for what it's worth, the executive agencies are all required to use PIV (essentially civilian CAC) to authenticate, and those PIVs are required to have significant physical controls including requiring a PIN for access. It's a pretty robust way of enforcing 2fa.

amiga-workbench2• 7 years ago

Thanks for the info, I had no idea this was possible. I'm tempted to give it a go on my site.

chc42• 7 years ago

There was a thread on HN when they first announced a public release at RSA[0]. A lot of reverse engineers I know are excited for it.

0: https://news.ycombinator.com/item?id=18828083

dang• 7 years ago

Since that was less than two months ago, the current submission counts as a dupe. When it's open-sourced, that will be significant new information, which makes for a new story. It will certainly be discussed by HN then.

https://hn.algolia.com/?query=%22significant%20new%20informa...

slimsag• 7 years ago

My brother is into reverse engineering, he is literally counting the days to the open source release of this.

He said there isn't anything quite like it as it can actually stand toe-to-toe with IDA Pro, the commercial software that apparently nothing yet can really beat.

chc42• 7 years ago

Yup. IDA Pro is the gold standard, and was basically the only choice for a long time. It's also stupidly expensive and priced for defense contractor funny money, with an individual license nearly $3000 [0]. Most freelancers just use a cracked copy or the freeware version.

Recently Hopper and BinaryNinja have been rising in use, with much more affordable pricing plans, but they're still second-rate as far as I know.

(There's also radare2, which for all it's mentioned occasionally I don't actually know anyone that uses it)

0: https://www.hex-rays.com/cgi-bin/quote.cgi

joshschreuder• 7 years ago

I've always wondered this - there's a real "pay for your useful tools" philosophy on here at least, for things like Sublime Text. Often quoted is the cost per hour of use, etc. which justify the price (which is admittedly low compared to Ida).

Does the same not apply to Ida where you would make the money back fast enough to justify the pricetag? Or is it that there are more hobbyists and less people making actual money from using Ida?

saagarjha4• 7 years ago

Yeah, IDA is simultaneously the worst piece of software I have used from a usability standpoint but also the best reverse engineering tool out there. The author basically does whatever he likes because most reverse engineers use it :(

tpfour2• 7 years ago

I don't understand why you think 3000$ per seat is asking too much. If there's a market for cheaper products just build it. After putting in the work, you might actually think 3000$ is cheap.

I have never used IDA Pro but maybe the licensing comes with some sort of support agreement?

G4BB3R• 7 years ago

Is IDA so superior to OllyDBG? What are the differences? I was into reversing in 2009/2010, was just a hobbist trying to crack some programs and making bots to some games.

rzzzt• 7 years ago

OllyDbg never really stepped out of the 32-bit world; the author's progress reports of the x64 version end in 2014: http://www.ollydbg.de/odbg64.html

I'd like to know if someone is using x64dbg, however, which looks similar in appearance: https://x64dbg.com/

Ded7xSEoPKYNsDd• 7 years ago

They aren't really comparable. While IDA has some debugging features, it's all about static analysis. It has features for browsing and annotating code - you can view the code as a control flow graph, add your own names and comments to functions and variables once you've made sense of them, define structures and their members so you don't have to memorize what each offset to a common type means, jump around in the call graph, find other usages of global variables...

mahmoudimus2• 7 years ago

As someone who learned to program by reverse engineering, I also cannot wait to see this being released.

Nothing really beat the combination of SoftICE and IDA Pro, although some of the newer entrants like radare2 & good ol’ OllyDBG are pretty good, but nothing beats IDA Pro.

I hope the scripting language are real programming language like Lua or Python and some custom DSL.

ypolito• 7 years ago

Can't wait to try it and read articles comparing its features with IDA, Binary Ninja, radare2 or Hopper. Sounds really interesting!

aboutruby• 7 years ago

On a sidenote, looking at their Github, they publish a lot of names / emails in the git logs (~100). Some are encoded / anonymous, but most are real looking names and plausible email addresses.

crb002• 7 years ago

Good to see NSA has got on board that removing the attack surface of US software is a top priority.

tribby• 7 years ago

an open source competitor to IDA pro is very welcome, never thought it would come from NSA. have they said anything about their motivation to open-source it?

monocasa2• 7 years ago

Probably to crowd source maintenance like nearly every other closed to open transition. And ghidra has been leaked a few times (they give it out like candy to contractors) so they're not really losing much.

weaksauce• 7 years ago

any reports on if it's better than IDA?

os2mac3• 7 years ago

I'm still trying to figure out, in this day and age, especially after the Snowden disclosures, why anyone would trust software released by this organization.

you do realize their primary goal is intelligence gathering?

artemisbot• 7 years ago

It's going to be an open source release so depending on your paranoia levels you could just build it yourself.

drchaos• 7 years ago

You'd have to audit the source code first, though, which is not a trivial thing to do.

larkeith• 7 years ago

It's a reverse engineering tool. The community is going to have plenty of ability to do network analysis on it. Also, it's trivial to sandbox it, even if it weren't going to be open-sourced.

saagarjha4• 7 years ago

Sandboxing things is rarely trivial ;)

os2mac3• 7 years ago

I am familiar with the concept. However, I would recommend hesitating to anyone who thinks any software from the organization, open source or no, is entirely harmless to the user...

gpm3• 7 years ago

I wonder what the NSA does with the analytics on a page like this.

TimTheTinker3• 7 years ago

NSA releasing an open-source tool? My first thought is, better subject it to serious, in-depth security review before installing it locally. Even then, build it from source.

mahmoudimus2• 7 years ago

Apache NiFi was also released by the NSA & has seen commercial success in the enterprise.

snazz• 7 years ago

Not to mention SELinux, which was partly developed by the NSA. Red Hat is much more involved in that, though.

TimTheTinker3• 7 years ago

Right, but it’s probably been reviewed and we’re not using NSA binaries.

rplst8• 7 years ago

And Accumulo.

hermitdev3• 7 years ago

Wans't Tor initially developed by NSA/CIA as well?

appleflaxen• 7 years ago

It would also make me want to consider Ken Thompson's compiler trojan, and whether there is any similar vulnerability that could be inserted into an RE tool.

http://wiki.c2.com/?TheKenThompsonHack

TimTheTinker3• 7 years ago

Do RE tools commonly output binaries?

Note that unless your compiler is already bugged (or you’re using a bugged binary), community review of the source should turn out any possible issues... unless there’s a significant competence gap between the NSA and the security community — which may be possible, but I don’t think security professionals are worried about it.

Ghidra

Related Stories