Oceanit’s Software and Cybersecurity team recently found and fixed a security vulnerability in Ghidra, the National Security Agency’s (NSA) open-source reverse engineering and cybersecurity tool. Ghidra is an engineering framework that allows engineers to decompile software and understand a binary’s logic and structure. It was released as an open-source project by the NSA in 2019 to help advance the binary analysis capabilities of the global cybersecurity community.
The “Cyber” team at Oceanit works on a variety of highly advanced cybersecurity projects ranging from ransomware and malware detection to prevention of sensor spoofing and software supply chain attacks. Oceanit’s cyber experts partner with entities like the U.S. Department of Defense, Department of Homeland Security, Department of Transportation, and more on projects of national security importance.
The Cyber team is based at Oceanit’s headquarters in Hawai’i and positioned “at the edge” of the Indo-Pacific region, considered the front lines for many new and emerging cybersecurity challenges. The team uncovered the Ghidra security vulnerability while using the tool for an ongoing project. Subsequently, they worked with the NSA to provide details and a fix for the issue, in accordance with responsible disclosure practices.
The identification, disclosure, and fix of this vulnerability represents Oceanit’s commitment to supporting NSA’s mission of improving our national security, and also serves as an important piece of the long-term viability of the NSA’s Ghidra tool.
The NSA published a security advisory acknowledging the vulnerability and Oceanit’s fix in an update which can be read here: https://github.com/NationalSecurityAgency/ghidra/security/advisories/GHSA-4g43-2f29-xvp4
You can read more about Oceanit’s Software and Cybersecurity work by visiting: https://oceanit.com/science-technology/software-cybersecurity/. Oceanit’s Cyber projects, like SensorShield, are being developed to secure devices, critical systems, and infrastructure across the U.S.
