NSA? Software? Cybersecurity? Just combining those three words sends a chill down your spine, but things appear to have changed… at least on the surface. At this year’s RSA Conference in San Francisco, the U.S. National Security Agency unveiled Ghidra, its reverse engineering software. Want to download a copy? You can do more than that: get access to its source code via GitHub.
Long story short: Rob Joyce, cybersecurity advisor at the NSA, took part in the RSA Conference 2019 in early March to publicly announce the launch of Ghidra, a reverse engineering tool. Despite previous conflicts and its rather questionable practices, the relationship between the NSA and the cybersecurity community never completely broke, and Ghidra is a small proof of that, being updated to this day.
What is reverse engineering?
What does “reverse engineering” mean here? If you think Ghidra will let you hack phones in a couple of clicks like in a Bourne movie, you’ll be disappointed. In fact, Ghidra is not a hacking tool.
Its main role (though not the only one) is as a decompiler, that is, it “undoes” a compiled piece of software and returns it to its original state. In other words, it obtains the source code of a proprietary program.
Ghidra: Reverse Engineering Software
This is especially useful when analyzing malware. Modules, commands, structure, real capabilities. In essence, how it’s made, who wrote it, how much damage it can do.
At the same time, Ghidra serves as a defense tool. Have you written a program and want to check how robust it is? A session with Ghidra could reveal details you completely ignored, making your creation stronger.
Joyce admitted that Ghidra “does not replace” other similar tools on the market. Most likely he is referring to IDA (Interactive Disassembler), a professional disassembler that can acquire decompilation functions through a plugin.
However, Ghidra “helped them in their workflow”, and the advantage of being free + open source is not easily ignored.
Now, what’s the fine print? Joyce indicated that Ghidra is part of the recruitment strategy that the agency maintains. If you are a U.S. citizen and you get good with the tool, you could enter higher levels of the NSA thanks to your knowledge, or alternatively, simplify the participation process for external contractors.
If Ghidra looks familiar to you, it’s because it’s no secret at this point. Its name began circulating with the exposure (by WikiLeaks) of the famous Vault 7, with some highlighted elements like Athena (remote connectivity implant), Brutal Kangaroo (breaks air gaps with infected pendrives), and Weeping Angel (designed to intercept Samsung Smart TVs).
Ghidra is available for Windows, Linux, and MacOS, and Joyce swears on his Scout honor that it has no backdoors....
Ghidra on GitHub: Click here
Download Ghidra: Click here
