Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Endpoint

8/15/2019
04:40 PM
Connect Directly
Twitter
LinkedIn
Google+
RSS
E-Mail
50%
50%

NSA Researchers Talk Development, Release of Ghidra SRE Tool

NSA researchers took the Black Hat stage to share details of how they developed and released the software reverse-engineering framework.

The National Security Agency released its classified Ghidra software reverse-engineering (SRE) tool as open source to the cybersecurity community on April 4. NSA researchers Brian Knighton and Chris Delikat shared how Ghidra was built and the process of releasing it at Black Hat 2019.

Ghidra is a framework developed by the NSA's Research Directorate for the agency's cybersecurity mission. It's designed to analyze malicious code to give security pros a better understanding of potential vulnerabilities in their networks and systems. To do this, it comes with software analysis tools to research code on Windows, macOS, and Linux, and capabilities including disassembly, assembly, decompilation, graphing, and scripting, among others.

"Ghidra has been on going project in research for many years now," said Delikat, researcher and cyber team lead for the NSA, in their Black Hat briefing. The tool has been in development for roughly 20 years, he added, and it's meant to be a foundation to support future research. The NSA publicly released Ghidra in March at RSA ahead of its open source debut in April.

Why use SRE? Organizations may find a binary on their network and want to analyze it for vulnerabilities so they can defend themselves, Delikat continued. If there's a binary on your network you didn't put there, you'll want to figure out what it's doing and where it came from. Back in 2000, when development began, there weren't any tools to do these things, he noted. Now, as software grows and the possibility of vulnerabilities increases, the agency wanted to give organizations a framework to explore potential malware on progressively larger networks.

The was to bring three key features — scaling, teaming, and extendability — into a single body of work, said Knighton, Ghidra developer and IoT vulnerability researcher at the NSA.

Delikat and Knighton elaborated on some of the details and design decisions involved with building Ghidra. It's a project-based framework, meaning instead of bringing in a single binary to investigate, researchers can create a project and include all the binaries they want to analyze. A "Project Window" provides a view where a binary can be annotated and marked up.

A file system browser, introduced after Ghidra was created, lets researchers drill down into firmware bundles, Delikat continued. Its script manager can be used to automate tasks and find functions. Researchers can write scripts in Java or Python, which was added after Ghidra was open sourced. If someone else wanted to add Ruby, he noted, they'd be able to do that.

Developers chose Java for the tool because of its popularity in the early 2000s, said Knighton. They tried C++ but the language didn't give a platform-independent GUI from the start. If they were building today, they'd still use Java, he said, but would likely do things differently.

Government policies pushed Ghidra over the finish line. Delikat pointed to Executive Order 13691, "Promoting Private Sector Cybersecurity Information Sharing," which was issued on February 13, 2015, and recognizes that organizations engaged in sharing information related to security risks and incidents have an "invaluable role" in national cybersecurity. The EO encourages the development of organizations to share data, establishes mechanisms to improve their capabilities, and aims to make it easier for them to voluntarily partner with the government.

"Using the same tool across different groups is really going to improve the ability to share," Delikat said. Open sourcing Ghidra was a slow process: The NSA did a prepublication review in which two people reviewed each line of code. "Think about any internal software project you've got in-house for a decade or more," he added. "Now all of a sudden, you want to make it open source so everyone can download it. … This was a moonshot for us."

The next version of Ghidra, 9.1, will be coming out soon and bring additional processor modules, support for data type bit fields, and support for SysCalls and a Sleigh editor. In the future, they hope to bring Android OAT/ART support, a debugger, and external engagement.

"Part of what we're trying to leverage by getting the tool into the open source community is the creativity," said Knighton.

Related Content:

Check out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Today's top story: 5 Things to Know About Cyber Insurance.

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Stop Defending Everything
Kevin Kurzawa, Senior Information Security Auditor,  2/12/2020
Small Business Security: 5 Tips on How and Where to Start
Mike Puglia, Chief Strategy Officer at Kaseya,  2/13/2020
Architectural Analysis IDs 78 Specific Risks in Machine-Learning Systems
Jai Vijayan, Contributing Writer,  2/13/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
6 Emerging Cyber Threats That Enterprises Face in 2020
This Tech Digest gives an in-depth look at six emerging cyber threats that enterprises could face in 2020. Download your copy today!
Flash Poll
How Enterprises Are Developing and Maintaining Secure Applications
How Enterprises Are Developing and Maintaining Secure Applications
The concept of application security is well known, but application security testing and remediation processes remain unbalanced. Most organizations are confident in their approach to AppSec, although others seem to have no approach at all. Read this report to find out more.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-1842
PUBLISHED: 2020-02-18
Huawei HEGE-560 version 1.0.1.20(SP2); OSCA-550 and OSCA-550A version 1.0.0.71(SP1); and OSCA-550AX and OSCA-550X version 1.0.0.71(SP2) have an insufficient authentication vulnerability. An attacker can access the device physically and perform specific operations to exploit this vulnerability. Succe...
CVE-2020-8010
PUBLISHED: 2020-02-18
CA Unified Infrastructure Management (Nimsoft/UIM) 9.20 and below contains an improper ACL handling vulnerability in the robot (controller) component. A remote attacker can execute commands, read from, or write to the target system.
CVE-2020-8011
PUBLISHED: 2020-02-18
CA Unified Infrastructure Management (Nimsoft/UIM) 9.20 and below contains a null pointer dereference vulnerability in the robot (controller) component. A remote attacker can crash the Controller service.
CVE-2020-8012
PUBLISHED: 2020-02-18
CA Unified Infrastructure Management (Nimsoft/UIM) 9.20 and below contains a buffer overflow vulnerability in the robot (controller) component. A remote attacker can execute arbitrary code.
CVE-2020-1791
PUBLISHED: 2020-02-18
HUAWEI Mate 20 smartphones with versions earlier than 10.0.0.185(C00E74R3P8) have an improper authorization vulnerability. The system has a logic judging error under certain scenario, successful exploit could allow the attacker to switch to third desktop after a series of operation in ADB mode.