Research: NSA Releases GHIDRA - A Free Reverse Engineering Tool

The National Security Agency (NSA) released their home-grown software reverse engineering tool at RSA this week. The NSA claims this tool has been used internally for years to reverse engineer malware and find security bugs in software. Robert Joyce, the adviser who released this tool at RSA, said that GHIDRA contains “...all the features expected in high-end commercial tool”. Although Joyce claims GHIDRA contains no backdoors, there was a report by security researcher HackerFantastic of an exposed debugging port listening on all interfaces that allows arbitrary remote code execution.

Recommendations

• GHIDRA maintainers and other researchers claim that the exposed debugger port is intended for team access, a feature in GHIDRA. Be weary of using GHIDRA in environments where this exposed port can be exploited by attackers

Details

In a tweet by HackerFantastic, the researcher points out JDWP in debug mode is listening on port 18001 via all interfaces when GHIDRA is opened. The Java Debug Wire Protocol (JDWP) is useful for debugging Java applications and has been historically written about by pentesters as a useful way to obtain remote code execution on a machine running the service. The associated Github issue contains a reference to HackerFantastic’s tweet with some proposed fixes on launching GHIDRA on a local interface.