Hacker News Reader

Comment by WrtCdEvrydy | Hacker News Reader

Download from the NSA without open source software...

anyone else virtualizing three layers deep to get to this?

I don't think they would burn some 0-days for this, one container should be enough.

I think you're underestimating the value of intel on people who know how to get intel or at least interested in the topic.

Fortunately, a lot of people who are very knowledgeable about reverse engineering are downloading & opening it as we speak. They will point out any flaws/viruses found. Seems one has already been found [1]. All you need to do is to wait.

[1]: https://news.ycombinator.com/item?id=19315515

It's part of the NSA's recruiting push. "If you are interested in projects like this ... consider applying" is even mentioned in the README.

There's zero chance there's some secret trojan, because the people who are interested in this type of software are the exact people who would be able to find it.

An RCE vulnerability has already been found.

Also know as debug mode.

If you specifically start GHIDRA in a debug mode, then yes there is a backdoor, but you asked for that.

Calling it a rce vuln is a bit of an exaggeration surely.

Despite what @HackerFantastic is going on about, sloppy remote debugging capabilities enabled with a debug flag isn't an RCE.

It enables remote code execution, that's what RCE stands for.

It's a compile flag, it is not enabled by default.

The issue is with "vulnerability". By that loose definition, every modern IDE has an RCE "vulnerability".

It doesn't have to be a secret trojan. Just a trojan is good enough.

Well... I suppose you could argue that it would make sense for them to add a secret trojan, encrypted alongside a message along the lines of "we'd like to talk to you about an interesting employment offer, give us a call on 00000" ;)

>"If you are interested in projects like this ... consider applying" is even mentioned in the README.

* As long as you have citizenship... which is the minority.

AFAICT all the source is there, beside every `.jar` there is a `.zip` with the corresponding source. The source in a more usable form should be posted here soon: https://github.com/NationalSecurityAgency/ghidra/

(And if not I'm sure the community will reconstitute it)

One person’s jar is another’s zip.

Well sure, but the .zip files I'm referring to are "decompiled" for you with nice naming conventions and all that ;)

After further investigation my above comment is not true.

The decompiler for instance is a precompiled binary (elf64 file on linux) wrapper in some java code. The C/C++/? code is not provided.

I'd expect most people who use software like this to be using things like Qubes OS anyway?

Honestly, not really.

I wonder if it will make it's way to FLARE.

Reply on news.ycombinator.com