Covers: Vulnerabilities & PatchingSupply Chain & AppSecAI SecurityEndpoint & Network SecurityZero-Days & ExploitsDetection & ResponseData BreachesIdentity & Access ManagementCloud SecurityOT / ICS & Critical Infrastructure
At PyCon US 2022 in Salt Lake City, PyPI maintainers including Dustin Ingram detailed new security measures covering package maintainer authentication and user-side verification and trust techniques, and Ashish Bijlani presented Packj, a tool that tests...
Trail of Bits launched a podcast, with its first five-episode season released in June 2022 and available at trailofbits.audio and on major podcast outlets including Apple iTunes, Spotify, Gaana, Google Podcasts, and Amazon Music. Producers Dan Guido and...
Trail of Bits was engaged by DARPA to examine the fundamental properties of blockchains and their cybersecurity risks, and to determine to what degree blockchains are actually decentralized. The resulting report aggregates prior academic and real-world...
Trail of Bits released an operational risk assessment report on blockchain and distributed ledger technology, covering wallet and encryption key management, reliance on external API providers, and the common pitfalls, failures, and vulnerabilities its...
Trail of Bits reimplemented libmagic, the C library behind the file command, in pure Python as PolyFile and documented undocumented DSL features and bugs found along the way. Among them: an ambiguous MSDOS indirect-offset expression, an undocumented...
Trail of Bits released slither-read-storage in Slither version 0.8.3, a tool that retrieves smart contract storage slots from source code using Slither's type analysis to inform slot calculations. The tool can pull the slot of a single variable or an...
Trail of Bits created an intensive blockchain security apprenticeship that compresses roughly two years of experience into three months, pairing each apprentice with a senior mentor from the blockchain team. Over the past year the program has had eight...
Trail of Bits researchers used mutation testing to improve Slither, its static analysis tool for smart contracts, generating nearly 50,000 mutants across 100 contracts and comparing Slither's detections against SmartCheck and Securify. Slither detected the...
Trail of Bits released Magnifier, an experimental reverse engineering interface built during an internship that lets researchers interactively reshape decompiled programs instead of taking handwritten notes. Magnifier transforms Anvill's LLVM IR and shows...
In October 2019, a security researcher found a vulnerability in Tornado.cash, an Ethereum mixer that uses zero-knowledge proofs, that let anyone forge a proof of deposit and withdraw funds; the team drained the mixer itself to save user funds, then patched...
Trail of Bits added 11 Semgrep rules to its public ruleset targeting misuse of machine learning libraries, after analyzing the source code of many ML libraries for common problematic patterns. The rules cover issues including implicit pickling in PyTorch...
A computer science student at RGUKT Nuzvid in India describes completing a paid winter internship at Trail of Bits and receiving a full-time offer as a Blockchain Security Analyst. He worked on Tealer, a static analyzer for Algorand smart contracts written...
A Trail of Bits summer intern ported Solana's RBPF JIT compiler, which executes smart contracts on validator nodes by default, to ARM64 by updating the register map, calling convention, and instruction translations; RBPF previously supported JIT mode only...
Trail of Bits publicly disclosed CVE-2022-35737, a flaw introduced in SQLite 1.0.12 on October 17, 2000 and fixed in release 3.39.2 on July 21, 2022, that is triggered when large string inputs reach SQLite's printf functions with the %Q, %q, or %w format...
Sigstore, a Linux Foundation project, announced general availability of its free, ecosystem-agnostic software signing service two weeks before this post. Its two core services, Fulcio and Rekor, issue short-lived signing certificates tied to an OpenID...
Trail of Bits publicly disclosed CVE-2022-35737, a vulnerability in the SQLite library API that was introduced in SQLite version 1.0.12 (released October 17, 2000) and fixed in release 3.39.2 (released July 21, 2022). The flaw is exploitable on 64-bit...
Trail of Bits found that compiler optimizations can represent a single C source variable with different semantics in different parts of a compiled program, a phenomenon it calls "divergent representations," and that these are common in compiled C code. The...
Trail of Bits is moving its tool workshops to live streams on Twitch and YouTube, where its engineers will walk through tools including Slither, Echidna, Amarna, Tealer, and test-fuzz. The first six workshops cover fuzzing smart contracts, from fuzzer...
Trail of Bits released abi3audit, a tool that checks Python packages for CPython ABI violations, and used it to find hundreds of inconsistently or incorrectly tagged distributions. Auditing 357 packages that had abi3 wheels downloaded from PyPI in the...
Trail of Bits found two bugs in special-purpose zero-knowledge proof code: in Binance's tss-lib, a Proof structure lacking checks on h1, h2, and p.Alpha lets an attacker set alpha_i = 0 so the verification check reduces to 0 = 0 and an invalid proof is...
Trail of Bits built Hybrid Echidna, which couples its smart contract fuzzer Echidna with its symbolic execution framework Maat, running Echidna repeatedly and interweaving those runs with symbolic analysis to generate new fuzzing inputs. On a test contract...
Trail of Bits built a Ghidra plugin for its Manticore symbolic execution engine, following an earlier Binary Ninja plugin, and then developed a centralized gRPC server binary so future MUI plugins can call Manticore's Python API through protocol...
A Trail of Bits intern added features to ManticoreUI, the Binary Ninja plug-in for the Manticore symbolic execution engine, including an emulate_until option that uses the Unicorn emulator to speed execution, shared library support, and a GDB plugin for...
Trail of Bits explains Windows process reparenting, a technique where a process creator sets the PROC_THREAD_ATTRIBUTE_PARENT_PROCESS attribute to assign a different parent than the calling process, which Windows uses legitimately for packaged apps but...
A Trail of Bits intern prototyped an internal tool called Syntex that searches C and C++ source code by matching patterns against actual Clang ASTs rather than parsing text with custom parsers or regular expressions. Syntex builds a context-free grammar...
Trail of Bits completed a security review of cURL, and cURL founder Daniel Stenberg published a blog post covering the project's growth since its 2016 audit, the engagement, and the final report, including a point where he disagrees with a finding and...
Trail of Bits reports that more than 400 of its pull requests were merged into non-Trail of Bits repositories in 2022, up from more than 190 in 2021. The page also indexes earlier posts by Samuel Moelius on global stabilization and on Dylint, a tool for...
Trail of Bits publicly disclosed four wolfSSL vulnerabilities (CVE-2022-38152, CVE-2022-38153, CVE-2022-39173, CVE-2022-42905), all resulting in denial of service and ranging from medium to critical CVSS scores, found automatically by its protocol fuzzer...
Trail of Bits announced the first stable release of sigstore-python, a Sigstore client it developed over nearly a year with funding from Google's Open Source Security Team. The release stabilizes a public Python API and CLI for signing and verifying...
Trail of Bits released RPC Investigator, a .NET application built on the NtApiDotNet platform for enumerating, decompiling/parsing, and communicating with arbitrary RPC servers on Windows. The tool adds visualization and additional features for exploring...