Covers: Vulnerabilities & PatchingSupply Chain & AppSecAI SecurityEndpoint & Network SecurityZero-Days & ExploitsDetection & ResponseData BreachesIdentity & Access ManagementCloud SecurityOT / ICS & Critical Infrastructure
Trail of Bits published a June 11, 2012 analysis by Alex Sotirov of the MD5 collision attack used by the Flame malware to infect new machines through Windows Update. The post notes that while MD5 collisions are not new, this was the first such attack...
The Flame malware used an MD5 collision attack to infect new machines through Windows Update, marking the first such attack discovered in the wild. Trail of Bits, whose co-founder Alex Sotirov was part of the 2008 academic collaboration that first...
Trail of Bits analyzed ExploitShield's Browser edition and found it works by hooking functions commonly used by shellcode to drop and execute programs, checking the return address on the stack against a module list populated only once at startup. The...
The Department of Labor and several other websites were compromised to host a zero-day exploit for Internet Explorer 8 (CVE-2013-1347), and researchers noted similarities to earlier attacks attributed to the Elderwood kit. Trail of Bits said it found no...
Trail of Bits analyzed the Elderwood exploit kit's tooling for developing browser exploits, finding it ships reusable components that bypass DEP via Flash-based heap spraying and ROP chains, and bypass ASLR by loading modules without the Dynamic Base flag,...
Trail of Bits analyzed the Elderwood kit's exploit for CVE-2012-4792, in which the kit user overwrote a freed CButton object by targeting the 21st allocation from the Low Fragmentation Heap after 3000 string allocations and 500 button elements were used to...
Trail of Bits is hosting a free Ruby Security Workshop in NYC on Thursday, June 6th, timed to SummerCon, with signups first-come, first-serve and space for 30 people. Led by Hal Brodigan, the workshop covers recent Ruby on Rails vulnerability classes,...
Trail of Bits released an open-source version of iVerify, a tool that validates the integrity of supported iOS devices and detects modifications that malware or jailbreaking would make without using signatures. It runs at boot time, inspects the device for...
Trail of Bits introduced CodeReason, a machine code analysis framework built for DARPA Cyber Fast Track that provides semantic understanding of native x86 and ARM instructions so analysts can query the effects of code on program state. The team used it to...
Trail of Bits introduced Javelin, a tool that simulates real-time, real-world attack techniques to show how attackers would approach and exploit an enterprise. Javelin identifies employees most likely to be targeted by spearphishing campaigns, uncovers...
A Trail of Bits researcher wrote an out-of-tree Clang analyzer plugin over a 24-hour period that taints values returned from ntohl/ntohs calls and alerts when those tainted values reach memcpy as a size argument without being constrained by program logic....
Trail of Bits released the CTF Field Guide on May 20, 2014, a free self-guided online course to help high school and university students build skills for Capture the Flag competitions, which test exploit creation, vulnerability discovery, and forensics....
Trail of Bits says it holds one of seven accepted funded-track proposals in DARPA's Cyber Grand Challenge, a tournament designed to speed development of automated security systems that can defend against cyberattacks as fast as they are launched. DARPA...
Trail of Bits announced that Artem Dinaburg and Andrew Ruef will present McSema at REcon 2014 on June 28th, a framework that translates x86 binaries into LLVM bitcode, the reverse of what a compiler does. The post walks through translating a simple...
Trail of Bits hired veteran mobile security researcher Nicholas DePetrillo as Principal Security Researcher, bringing the firm founded by three people in 2012 to 13 employees. DePetrillo, who has more than ten years of security research experience and...
Trail of Bits sponsored the CSAW Summer Program for High School Women at NYU-Poly, a two-week program led by Industry Professor Linda Sellie in which teenage women from the New York City area learn cryptography, databases, computation, and networking...
The University of Maryland ran Build it Break it, described as a first-of-its-kind security challenge in which contestants both implement secure software and identify vulnerabilities in the creations of others, with points awarded for both secure...
Trail of Bits announced the call for papers for THREADS 2014, a research and development conference held as part of NYU-Poly's Cyber Security Awareness Week (CSAW), with a final submission deadline of October 6th and the event scheduled for November 13-14,...
Trail of Bits announced that McSema, its framework for analyzing and transforming machine-code programs to LLVM bitcode, is now open source. McSema supports translation of x86 machine code including integer, floating point, and SSE instructions, is...
Trail of Bits built MAST, an LLVM compiler-level obfuscation toolkit that combines opaque predicate insertion, code diffusion modeled on return-oriented programming, and Objective-C symbol mangling to defeat static analysis. The company cites Gauss malware...
Trail of Bits published a step-by-step guide by Nick DePetrillo on September 02, 2014, for enabling SMS-based two-factor authentication on Apple ID and Dropbox accounts. The guide is framed as a way to protect those accounts against password-based...
Trail of Bits published a walkthrough for enabling two-factor authentication on Apple ID and Dropbox, noting that unverified reports attributed recent compromises to Apple service flaws that allowed password brute forcing without rate limiting or account...
Trail of Bits is sponsoring the NYU-Poly Career Discovery in Cyber Security symposium, an annual two-day event on October 17-18 in Brooklyn, New York, aimed at guiding women into cybersecurity careers. The event includes keynote talks, interactive learning...
Trail of Bits announced the speaker lineup for THREADS '14, a conference focused exclusively on automating security, with early-bird tickets expiring 10/13. The program includes NSA TAO chief Robert Joyce, White Ops CEO Michael Tiffany, and a DARPA ICAS...
At THREADS 2014, Trail of Bits demonstrated a new capability of mcsema that enables KLEE, a symbolic execution framework, to run on software available only in binary form, using it to learn an unknown protocol and the steps through a maze. The post...
Trail of Bits published the second part of a two-part post showing how to use KLEE with mcsema to symbolically execute Linux binaries, building KLEE for LLVM 3.2 on 32-bit Ubuntu 14.04 and converting a 32-bit maze-oracle ELF binary to LLVM bitcode. A...
Trail of Bits' 2014 review cites Apple, Target, and JPMorgan Chase among the year's front-page security incidents and describes its own work, including McSema, a framework for translating machine-code programs to LLVM bitcode that supports x86 semantics...
Trail of Bits is launching Empire Hacking, a bi-monthly, invitation-only security meetup held from 6-9pm at its headquarters on the second Tuesday of even months under Chatham House Rule. The inaugural June 9th session features talks by Chris Rohlf of...
Trail of Bits is releasing AppJailLauncher, a framework that uses Windows AppContainers to isolate exploitable Windows TCP services for CTF challenges, along with the source code to greenhornd, a 2014 CSAW Windows exploitation challenge. The post argues...
Trail of Bits published the RubySec Field Guide, which covers recent Ruby vulnerability classes and their root causes, including flaws that exploit serialization and deserialization of data in the YAML format. The guide states that nearly all large, tested...