4 ms·

I don't think they would burn some 0-days for this, one container should be enough.

omeid2 8y ago
I think you're underestimating the value of intel on people who know how to get intel or at least interested in the topic.
- est31 8y ago
  Fortunately, a lot of people who are very knowledgeable about reverse engineering are downloading & opening it as we speak. They will point out any flaws/viruses found. Seems one has already been found [1]. All you need to do is to wait. [1]: https://news.ycombinator.com/item?id=19315515 https://news.ycombinator.com/item?id=19315515
- strictnein 8y ago
  It's part of the NSA's recruiting push. "If you are interested in projects like this ... consider applying" is even mentioned in the README. There's zero chance there's some secret trojan, because the people who are interested in this type of software are the exact people who would be able to find it.
  - whatshisface 8y ago
    An RCE vulnerability has already been found.
    - weej 8y ago
      Also know as debug mode.
    - souprock 8y ago
      If you specifically start GHIDRA in a debug mode, then yes there is a backdoor, but you asked for that.
    - crowbahr 8y ago
      Calling it a rce vuln is a bit of an exaggeration surely.
    - strictnein 8y ago
      Despite what @HackerFantastic is going on about, sloppy remote debugging capabilities enabled with a debug flag isn't an RCE.
      - Tepix 8y ago
        It enables remote code execution, that's what RCE stands for.
        JetSpiegel 8y ago
        It's a compile flag, it is not enabled by default.
        vonmoltke 8y ago
        The issue is with "vulnerability". By that loose definition, every modern IDE has an RCE "vulnerability".
  - omeid2 8y ago
    It doesn't have to be a secret trojan. Just a trojan is good enough.
  - janekm 8y ago
    Well... I suppose you could argue that it would make sense for them to add a secret trojan, encrypted alongside a message along the lines of "we'd like to talk to you about an interesting employment offer, give us a call on 00000" ;)
  - samirm 8y ago
    >"If you are interested in projects like this ... consider applying" is even mentioned in the README. * As long as you have citizenship... which is the minority.

I think you're underestimating the value of intel on people who know how to get intel or at least interested in the topic.

est31 8y ago
Fortunately, a lot of people who are very knowledgeable about reverse engineering are downloading & opening it as we speak. They will point out any flaws/viruses found. Seems one has already been found [1]. All you need to do is to wait. [1]: https://news.ycombinator.com/item?id=19315515 https://news.ycombinator.com/item?id=19315515
strictnein 8y ago
It's part of the NSA's recruiting push. "If you are interested in projects like this ... consider applying" is even mentioned in the README. There's zero chance there's some secret trojan, because the people who are interested in this type of software are the exact people who would be able to find it.
- whatshisface 8y ago
  An RCE vulnerability has already been found.
  - weej 8y ago
    Also know as debug mode.
  - souprock 8y ago
    If you specifically start GHIDRA in a debug mode, then yes there is a backdoor, but you asked for that.
  - crowbahr 8y ago
    Calling it a rce vuln is a bit of an exaggeration surely.
  - strictnein 8y ago
    Despite what @HackerFantastic is going on about, sloppy remote debugging capabilities enabled with a debug flag isn't an RCE.
    - Tepix 8y ago
      It enables remote code execution, that's what RCE stands for.
      - JetSpiegel 8y ago
        It's a compile flag, it is not enabled by default.
      - vonmoltke 8y ago
        The issue is with "vulnerability". By that loose definition, every modern IDE has an RCE "vulnerability".
- omeid2 8y ago
  It doesn't have to be a secret trojan. Just a trojan is good enough.
- janekm 8y ago
  Well... I suppose you could argue that it would make sense for them to add a secret trojan, encrypted alongside a message along the lines of "we'd like to talk to you about an interesting employment offer, give us a call on 00000" ;)
- samirm 8y ago
  >"If you are interested in projects like this ... consider applying" is even mentioned in the README. * As long as you have citizenship... which is the minority.