Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Endpoint

8/15/2019
04:40 PM
Connect Directly
Twitter
LinkedIn
Google+
RSS
E-Mail
50%
50%

NSA Researchers Talk Development, Release of Ghidra SRE Tool

NSA researchers took the Black Hat stage to share details of how they developed and released the software reverse-engineering framework.

The National Security Agency released its classified Ghidra software reverse-engineering (SRE) tool as open source to the cybersecurity community on April 4. NSA researchers Brian Knighton and Chris Delikat shared how Ghidra was built and the process of releasing it at Black Hat 2019.

Ghidra is a framework developed by the NSA's Research Directorate for the agency's cybersecurity mission. It's designed to analyze malicious code to give security pros a better understanding of potential vulnerabilities in their networks and systems. To do this, it comes with software analysis tools to research code on Windows, macOS, and Linux, and capabilities including disassembly, assembly, decompilation, graphing, and scripting, among others.

"Ghidra has been on going project in research for many years now," said Delikat, researcher and cyber team lead for the NSA, in their Black Hat briefing. The tool has been in development for roughly 20 years, he added, and it's meant to be a foundation to support future research. The NSA publicly released Ghidra in March at RSA ahead of its open source debut in April.

Why use SRE? Organizations may find a binary on their network and want to analyze it for vulnerabilities so they can defend themselves, Delikat continued. If there's a binary on your network you didn't put there, you'll want to figure out what it's doing and where it came from. Back in 2000, when development began, there weren't any tools to do these things, he noted. Now, as software grows and the possibility of vulnerabilities increases, the agency wanted to give organizations a framework to explore potential malware on progressively larger networks.

The was to bring three key features — scaling, teaming, and extendability — into a single body of work, said Knighton, Ghidra developer and IoT vulnerability researcher at the NSA.

Delikat and Knighton elaborated on some of the details and design decisions involved with building Ghidra. It's a project-based framework, meaning instead of bringing in a single binary to investigate, researchers can create a project and include all the binaries they want to analyze. A "Project Window" provides a view where a binary can be annotated and marked up.

A file system browser, introduced after Ghidra was created, lets researchers drill down into firmware bundles, Delikat continued. Its script manager can be used to automate tasks and find functions. Researchers can write scripts in Java or Python, which was added after Ghidra was open sourced. If someone else wanted to add Ruby, he noted, they'd be able to do that.

Developers chose Java for the tool because of its popularity in the early 2000s, said Knighton. They tried C++ but the language didn't give a platform-independent GUI from the start. If they were building today, they'd still use Java, he said, but would likely do things differently.

Government policies pushed Ghidra over the finish line. Delikat pointed to Executive Order 13691, "Promoting Private Sector Cybersecurity Information Sharing," which was issued on February 13, 2015, and recognizes that organizations engaged in sharing information related to security risks and incidents have an "invaluable role" in national cybersecurity. The EO encourages the development of organizations to share data, establishes mechanisms to improve their capabilities, and aims to make it easier for them to voluntarily partner with the government.

"Using the same tool across different groups is really going to improve the ability to share," Delikat said. Open sourcing Ghidra was a slow process: The NSA did a prepublication review in which two people reviewed each line of code. "Think about any internal software project you've got in-house for a decade or more," he added. "Now all of a sudden, you want to make it open source so everyone can download it. … This was a moonshot for us."

The next version of Ghidra, 9.1, will be coming out soon and bring additional processor modules, support for data type bit fields, and support for SysCalls and a Sleigh editor. In the future, they hope to bring Android OAT/ART support, a debugger, and external engagement.

"Part of what we're trying to leverage by getting the tool into the open source community is the creativity," said Knighton.

Related Content:

Check out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Today's top story: 5 Things to Know About Cyber Insurance.

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Navigating Security in the Cloud
Diya Jolly, Chief Product Officer, Okta,  12/4/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Navigating the Deluge of Security Data
In this Tech Digest, Dark Reading shares the experiences of some top security practitioners as they navigate volumes of security data. We examine some examples of how enterprises can cull this data to find the clues they need.
Flash Poll
Rethinking Enterprise Data Defense
Rethinking Enterprise Data Defense
Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industrys conventional wisdom. Heres a look at what theyre thinking about.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-16772
PUBLISHED: 2019-12-07
The serialize-to-js NPM package before version 3.0.1 is vulnerable to Cross-site Scripting (XSS). It does not properly mitigate against unsafe characters in serialized regular expressions. This vulnerability is not affected on Node.js environment since Node.js's implementation of RegExp.prototype.to...
CVE-2019-9464
PUBLISHED: 2019-12-06
In various functions of RecentLocationApps.java, DevicePolicyManagerService.java, and RecognitionService.java, there is an incorrect warning indicating an app accessed the user's location. This could dissolve the trust in the platform's permission system, with no additional execution privileges need...
CVE-2019-2220
PUBLISHED: 2019-12-06
In checkOperation of AppOpsService.java, there is a possible bypass of user interaction requirements due to mishandling application suspend. This could lead to local information disclosure no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVers...
CVE-2019-2221
PUBLISHED: 2019-12-06
In hasActivityInVisibleTask of WindowProcessController.java there?s a possible bypass of user interaction requirements due to incorrect handling of top activities in INITIALIZING state. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction ...
CVE-2019-2222
PUBLISHED: 2019-12-06
n ihevcd_parse_slice_data of ihevcd_parse_slice.c, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-8.0 Android...