6 ms·

I am going to sound pessimistic here, but isn't there a real danger of having this technology available to bad actors and is there any value to keeping such thi

I am going to sound pessimistic here, but isn't there a real danger of having this technology available to bad actors and is there any value to keeping such things confidential if it plays a role in national security? If someone was releasing malicious software to hijack the power grid as an example, wouldn't they be first able to use this to try to improve the robustness and invisibility of their attack ? Or is the functionality here common place enough that it doesn't tilt the axis of power in an unfavorable way?

mparlane 8y ago
Bad actors have been using IDA this entire time. So no, not really.
- nyrulez 8y ago
  You mean there is nothing new here? Then why is this news? I am not wondering about the concept of reverse engineering but the specific (and hopefully novel) feature set that this may enable.
  - saagarjha 8y ago
    It's a competitor to IDA's monopoly, basically. It might be better in certain aspects.
    - tptacek 8y ago
      IDA has a bunch of competitors --- Hopper, Binja, and all the Capstone interfaces.
      - saagarjha 8y ago
        Yup, well aware of them (I think Hopper uses Capstone, FWIW). I'm sure you agree that they're not quite at the level of IDA, though ;)
        tptacek 8y ago
        I'm not especially a fan of IDA, but I don't do much of this work anymore and haven't had a reason to catch up. IDA definitely wouldn't be the first tool I'd reach for in 2019.
        saagarjha 8y ago
        I'm not really a fan either, but it's somewhat better and this makes people seem to like to pass around IDBs…
        tptacek 8y ago
        It's the de facto standard and the program you can assume everyone is already using, plus the fact that a lot of tooling relies on IDA (in part because, for a long time, it was the only game in town) for analysis and function recovery. I don't know if that really makes it "better". I got out of this stuff before decompilation became a mainstream feature, so it might be a big deal that Ghidra has a strong decompiler.
        saagarjha 8y ago
        Yeah, that's basically it. Most other tools either lack a decompiler or have a somewhat poorer one.
      - monocasa 8y ago
        So, albeit my use case is a little weird I guess, and I generally am using it for embedded systems, but: Hopper - is Capstone. BinaryNinja - The extension API isn't well documented last time I checked. Embedded systems sort of requires letting me fill in some of the gaps myself. Capstone - I got frustrated when the translation script behind it that autogens code from the LLVM definitions wasn't available (as source or otherwise) which meant that I couldn't add to the instruction set in a meaningful way like I needed to. Radare(2) - Feels like the barely glued together independent projects that it is. Somehow has a more inscrutable interface than IDA. One of the frontends I tried (can't remember if it was Hopper, Clipper, or something else) for some reason thought PowerPC had branch delay slots, which was totally screwing up the basic block determination.
  - jchw 8y ago
    Conceptually there's nothing new, but it doesn't hurt to have more options available, especially considering how pricey IDA is.
  - __jal 8y ago
    There are more options in the universe of reactions than "Eek! They're going to get us all killed!" and "Eh?"
- gpm 8y ago
  Bad actors have had access to this tool too... it was leaked previously. This is cool because: - It's legal and free - It's open source
  - willstrafach 8y ago
    The tool was never leaked previously.
    - gpm 8y ago
      Uh, you're sure about that? I can't say I have first hand experience with the leak (running second hand NSA software not meant for public release seems like a bad idea somehow) but I know I've heard that it was, and this seems pretty suggestive... https://wikileaks.org/ciav7p1/cms/page_51183656.html https://wikileaks.org/ciav7p1/cms/page_51183656.html
      - willstrafach 8y ago
        I am sure about that. Your linked informational page leaked out when someone sent WikiLeaks a dump from a classified Confluence used by CIA’s cyber folks. The tool itself, however, had not leaked.
saagarjha 8y ago
This is just another reverse engineering tool, similar to IDA. Bad actors have had access to stuff like this for a while.
MarcysVonEylau 8y ago
What can stop a bad guy with a toolkit? A good guy with a toolkit!
badrabbit 8y ago
Not at all,this helps analyze malware not create it. There is no security obtained by preventing reverse engineering of a binary. If anything this makes adversaries ability to hide their methodoligies harder,a strategic advantage for someone like the US government.
- nyrulez 8y ago
  I am not sure I completely agree. If I know how my adversary detects and studies stealth code, I may be able to design better stealth code that is better at evading their methods of detection. I mean the evolution of stealth tech in military has followed a similar path. As radar systems improve over decades, they keep on working on new ways to evade detection for aviation/missile tech. I understand the high level point of good tools being more widely available to the white hat crowd, but I am trying to understand the argument that this is 100% better in all cases and there are no downsides.
  - andrewflnr 8y ago
    Nothing is ever 100% better with no downsides, except maybe drinking water. That's a silly standard. The upsides of people getting it who aren't willing to break the law outweigh the downsides of bad people getting it more easily. Probably. That's the best you can expect with security tools.
  - tptacek 8y ago
    It's just another disassembler. There are a bunch of them already. It is, to the state of the art of reverse engineering, about as big a deal as the first release of Sublime Text was for programmers. It's hard to think of a "downside", or at least one that wouldn't be equivalent to "Sublime Text made it easier for people to code malware".
    - tedunangst 8y ago
      Should there be export restrictions on weapons grade text editors?
  - 8y ago
headcanon 8y ago
The general philosophy in computer security is that bad actors will be using the tools they need to use anyway, and the world is actually more secure if the best tools to use are widely available, since the security professionals in charge of defending systems are trained on their use, and can better anticipate an attacker's methods. Even better if they're open source, so that they're easily analyzable, and the barrier for training is lowered.
nickpsecurity 8y ago
Code is so vulnerable right now that only a small number of projects/products get high payments from companies wanting to buy exploits. If this affects the situation, it will be marginal with an increase in vulnerabilities whose number is a drop in the bucket compared to what's already being introduced with poor QA and found by bug hunters. Here's just one project as an example: https://events.linuxfoundation.org/wp-content/uploads/2017/11/Syzbot-and-the-Tale-of-Thousand-Kernel-Bugs-Dmitry-Vyukov-Google.pdf https://events.linuxfoundation.org/wp-content/uploads/2017/1...

mparlane 8y ago

Bad actors have been using IDA this entire time. So no, not really.

nyrulez 8y ago
You mean there is nothing new here? Then why is this news? I am not wondering about the concept of reverse engineering but the specific (and hopefully novel) feature set that this may enable.
- saagarjha 8y ago
  It's a competitor to IDA's monopoly, basically. It might be better in certain aspects.
  - tptacek 8y ago
    IDA has a bunch of competitors --- Hopper, Binja, and all the Capstone interfaces.
    - saagarjha 8y ago
      Yup, well aware of them (I think Hopper uses Capstone, FWIW). I'm sure you agree that they're not quite at the level of IDA, though ;)
      - tptacek 8y ago
        I'm not especially a fan of IDA, but I don't do much of this work anymore and haven't had a reason to catch up. IDA definitely wouldn't be the first tool I'd reach for in 2019.
        saagarjha 8y ago
        I'm not really a fan either, but it's somewhat better and this makes people seem to like to pass around IDBs…
        tptacek 8y ago
        It's the de facto standard and the program you can assume everyone is already using, plus the fact that a lot of tooling relies on IDA (in part because, for a long time, it was the only game in town) for analysis and function recovery. I don't know if that really makes it "better". I got out of this stuff before decompilation became a mainstream feature, so it might be a big deal that Ghidra has a strong decompiler.
        saagarjha 8y ago
        Yeah, that's basically it. Most other tools either lack a decompiler or have a somewhat poorer one.
    - monocasa 8y ago
      So, albeit my use case is a little weird I guess, and I generally am using it for embedded systems, but: Hopper - is Capstone. BinaryNinja - The extension API isn't well documented last time I checked. Embedded systems sort of requires letting me fill in some of the gaps myself. Capstone - I got frustrated when the translation script behind it that autogens code from the LLVM definitions wasn't available (as source or otherwise) which meant that I couldn't add to the instruction set in a meaningful way like I needed to. Radare(2) - Feels like the barely glued together independent projects that it is. Somehow has a more inscrutable interface than IDA. One of the frontends I tried (can't remember if it was Hopper, Clipper, or something else) for some reason thought PowerPC had branch delay slots, which was totally screwing up the basic block determination.
- jchw 8y ago
  Conceptually there's nothing new, but it doesn't hurt to have more options available, especially considering how pricey IDA is.
- __jal 8y ago
  There are more options in the universe of reactions than "Eek! They're going to get us all killed!" and "Eh?"
gpm 8y ago
Bad actors have had access to this tool too... it was leaked previously. This is cool because: - It's legal and free - It's open source
- willstrafach 8y ago
  The tool was never leaked previously.
  - gpm 8y ago
    Uh, you're sure about that? I can't say I have first hand experience with the leak (running second hand NSA software not meant for public release seems like a bad idea somehow) but I know I've heard that it was, and this seems pretty suggestive... https://wikileaks.org/ciav7p1/cms/page_51183656.html https://wikileaks.org/ciav7p1/cms/page_51183656.html
    - willstrafach 8y ago
      I am sure about that. Your linked informational page leaked out when someone sent WikiLeaks a dump from a classified Confluence used by CIA’s cyber folks. The tool itself, however, had not leaked.

saagarjha 8y ago

This is just another reverse engineering tool, similar to IDA. Bad actors have had access to stuff like this for a while.

MarcysVonEylau 8y ago

What can stop a bad guy with a toolkit? A good guy with a toolkit!

badrabbit 8y ago

Not at all,this helps analyze malware not create it. There is no security obtained by preventing reverse engineering of a binary. If anything this makes adversaries ability to hide their methodoligies harder,a strategic advantage for someone like the US government.

nyrulez 8y ago
I am not sure I completely agree. If I know how my adversary detects and studies stealth code, I may be able to design better stealth code that is better at evading their methods of detection. I mean the evolution of stealth tech in military has followed a similar path. As radar systems improve over decades, they keep on working on new ways to evade detection for aviation/missile tech. I understand the high level point of good tools being more widely available to the white hat crowd, but I am trying to understand the argument that this is 100% better in all cases and there are no downsides.
- andrewflnr 8y ago
  Nothing is ever 100% better with no downsides, except maybe drinking water. That's a silly standard. The upsides of people getting it who aren't willing to break the law outweigh the downsides of bad people getting it more easily. Probably. That's the best you can expect with security tools.
- tptacek 8y ago
  It's just another disassembler. There are a bunch of them already. It is, to the state of the art of reverse engineering, about as big a deal as the first release of Sublime Text was for programmers. It's hard to think of a "downside", or at least one that wouldn't be equivalent to "Sublime Text made it easier for people to code malware".
  - tedunangst 8y ago
    Should there be export restrictions on weapons grade text editors?
- 8y ago

headcanon 8y ago

The general philosophy in computer security is that bad actors will be using the tools they need to use anyway, and the world is actually more secure if the best tools to use are widely available, since the security professionals in charge of defending systems are trained on their use, and can better anticipate an attacker's methods. Even better if they're open source, so that they're easily analyzable, and the barrier for training is lowered.

nickpsecurity 8y ago

Code is so vulnerable right now that only a small number of projects/products get high payments from companies wanting to buy exploits. If this affects the situation, it will be marginal with an increase in vulnerabilities whose number is a drop in the bucket compared to what's already being introduced with poor QA and found by bug hunters. Here's just one project as an example: https://events.linuxfoundation.org/wp-content/uploads/2017/11/Syzbot-and-the-Tale-of-Thousand-Kernel-Bugs-Dmitry-Vyukov-Google.pdf https://events.linuxfoundation.org/wp-content/uploads/2017/1...