Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Endpoint

8/15/2019
04:40 PM
Connect Directly
Twitter
LinkedIn
Google+
RSS
E-Mail
50%
50%

NSA Researchers Talk Development, Release of Ghidra SRE Tool

NSA researchers took the Black Hat stage to share details of how they developed and released the software reverse-engineering framework.

The National Security Agency released its classified Ghidra software reverse-engineering (SRE) tool as open source to the cybersecurity community on April 4. NSA researchers Brian Knighton and Chris Delikat shared how Ghidra was built and the process of releasing it at Black Hat 2019.

Ghidra is a framework developed by the NSA's Research Directorate for the agency's cybersecurity mission. It's designed to analyze malicious code to give security pros a better understanding of potential vulnerabilities in their networks and systems. To do this, it comes with software analysis tools to research code on Windows, macOS, and Linux, and capabilities including disassembly, assembly, decompilation, graphing, and scripting, among others.

"Ghidra has been on going project in research for many years now," said Delikat, researcher and cyber team lead for the NSA, in their Black Hat briefing. The tool has been in development for roughly 20 years, he added, and it's meant to be a foundation to support future research. The NSA publicly released Ghidra in March at RSA ahead of its open source debut in April.

Why use SRE? Organizations may find a binary on their network and want to analyze it for vulnerabilities so they can defend themselves, Delikat continued. If there's a binary on your network you didn't put there, you'll want to figure out what it's doing and where it came from. Back in 2000, when development began, there weren't any tools to do these things, he noted. Now, as software grows and the possibility of vulnerabilities increases, the agency wanted to give organizations a framework to explore potential malware on progressively larger networks.

The was to bring three key features — scaling, teaming, and extendability — into a single body of work, said Knighton, Ghidra developer and IoT vulnerability researcher at the NSA.

Delikat and Knighton elaborated on some of the details and design decisions involved with building Ghidra. It's a project-based framework, meaning instead of bringing in a single binary to investigate, researchers can create a project and include all the binaries they want to analyze. A "Project Window" provides a view where a binary can be annotated and marked up.

A file system browser, introduced after Ghidra was created, lets researchers drill down into firmware bundles, Delikat continued. Its script manager can be used to automate tasks and find functions. Researchers can write scripts in Java or Python, which was added after Ghidra was open sourced. If someone else wanted to add Ruby, he noted, they'd be able to do that.

Developers chose Java for the tool because of its popularity in the early 2000s, said Knighton. They tried C++ but the language didn't give a platform-independent GUI from the start. If they were building today, they'd still use Java, he said, but would likely do things differently.

Government policies pushed Ghidra over the finish line. Delikat pointed to Executive Order 13691, "Promoting Private Sector Cybersecurity Information Sharing," which was issued on February 13, 2015, and recognizes that organizations engaged in sharing information related to security risks and incidents have an "invaluable role" in national cybersecurity. The EO encourages the development of organizations to share data, establishes mechanisms to improve their capabilities, and aims to make it easier for them to voluntarily partner with the government.

"Using the same tool across different groups is really going to improve the ability to share," Delikat said. Open sourcing Ghidra was a slow process: The NSA did a prepublication review in which two people reviewed each line of code. "Think about any internal software project you've got in-house for a decade or more," he added. "Now all of a sudden, you want to make it open source so everyone can download it. … This was a moonshot for us."

The next version of Ghidra, 9.1, will be coming out soon and bring additional processor modules, support for data type bit fields, and support for SysCalls and a Sleigh editor. In the future, they hope to bring Android OAT/ART support, a debugger, and external engagement.

"Part of what we're trying to leverage by getting the tool into the open source community is the creativity," said Knighton.

Related Content:

Check out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Today's top story: 5 Things to Know About Cyber Insurance.

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Threaded  |  Newest First  |  Oldest First
Stop Defending Everything
Kevin Kurzawa, Senior Information Security Auditor,  2/12/2020
Small Business Security: 5 Tips on How and Where to Start
Mike Puglia, Chief Strategy Officer at Kaseya,  2/13/2020
5 Common Errors That Allow Attackers to Go Undetected
Matt Middleton-Leal, General Manager and Chief Security Strategist, Netwrix,  2/12/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
6 Emerging Cyber Threats That Enterprises Face in 2020
This Tech Digest gives an in-depth look at six emerging cyber threats that enterprises could face in 2020. Download your copy today!
Flash Poll
How Enterprises Are Developing and Maintaining Secure Applications
How Enterprises Are Developing and Maintaining Secure Applications
The concept of application security is well known, but application security testing and remediation processes remain unbalanced. Most organizations are confident in their approach to AppSec, although others seem to have no approach at all. Read this report to find out more.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-20477
PUBLISHED: 2020-02-19
PyYAML 5.1 through 5.1.2 has insufficient restrictions on the load and load_all functions because of a class deserialization issue, e.g., Popen is a class in the subprocess module. NOTE: this issue exists because of an incomplete fix for CVE-2017-18342.
CVE-2019-20478
PUBLISHED: 2020-02-19
In ruamel.yaml through 0.16.7, the load method allows remote code execution if the application calls this method with an untrusted argument. In other words, this issue affects developers who are unaware of the need to use methods such as safe_load in these use cases.
CVE-2011-2054
PUBLISHED: 2020-02-19
A vulnerability in the Cisco ASA that could allow a remote attacker to successfully authenticate using the Cisco AnyConnect VPN client if the Secondary Authentication type is LDAP and the password is left blank, providing the primary credentials are correct. The vulnerabilities is due to improper in...
CVE-2015-0749
PUBLISHED: 2020-02-19
A vulnerability in Cisco Unified Communications Manager could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack on the affected software. The vulnerabilities is due to improper input validation of certain parameters passed to the affected software. An attacker ...
CVE-2015-9543
PUBLISHED: 2020-02-19
An issue was discovered in OpenStack Nova before 18.2.4, 19.x before 19.1.0, and 20.x before 20.1.0. It can leak consoleauth tokens into log files. An attacker with read access to the service's logs may obtain tokens used for console access. All Nova setups using novncproxy are affected. This is rel...