13
Do you trust Open Source software entirely?! (lemmy.ml)
submitted 12 hours ago by to c/opensource@lemmy.ml
19 comments fedilink hide all child comments
 

I've some questions about Ghidra released by NSA on Github. And research about it then saw a ycombinator thread for it. That answer was clever and funny.

As title marked, you really okay for just "open source" to trust it?

you are viewing a single comment's thread
view the rest of the comments
[–] 4 points 6 hours ago (3 children)

Ghidra is used by the best and brightest malware inspectors.

Can you prove your claim?

If it was backdoored, it would have been discovered almost immediately.

That's the hope. Reality is, these things still happen. Remember that even the extremely secure Linux Kernel was almost, if it was not discovered accidentally and looked into it, hit bey huge backdoor. What makes you so sure that Ghidra developers and inspectors is on the same level?

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [–] 4 points 5 hours ago* (last edited 5 hours ago) (2 children)

    Go to any cyber security conference. Check out the CTF teams, Ghidra is used everywhere.

    Can you prove that there is a backdoor? Remember that it is freely available, and if China, Russia, NK or any other nation state could find a backdoor, they would be shouting it from the rooftops to shame the US.

    I dont doubt that the NSA could have seeded a backdoor in an open source project, but I very much doubt they would sign their name to it...

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 0 points 5 hours ago (1 child)

    Can you prove that there is a backdoor?

    I didn't say there is, I only ask for proofing your point. Remember: Not able to find anything is not the proof of absence. You can only proof something you can find. All I am saying is, if even Linux Kernel ALMOST got hid by a backdoor that was extremely sophisticated, it could happen to Ghidra as well. I'm not saying Ghidra is unsecure or anything like that.

    if China, Russia, NK or any other nation state could find a backdoor

    Then they would most likely use it to their advantage without telling anyone. Shaming a nation is not as lucrative like abusing a backdoor.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 1 point 20 minutes ago

    Only true if they can abuse the backdoor, if its tied to NSA infrastructure (which a competent backdoor would be), they couldn't use it. There is also precedence, the Germans didnt hesitate to publicise that Angela Merkel's phone was hacked, they could have used the malware to feed false information instead. Stuxnet was exposed to embarrass the US/Israel.

    Cyber security companies would also have no qualms about publicising it. Finding a NSA backdoor would put them on the map, and they have no use for a backdoor.

  • permalink
  • fedilink
  • source
  • parent