Covers: Vulnerabilities & PatchingSupply Chain & AppSecAI SecurityEndpoint & Network SecurityZero-Days & ExploitsDetection & ResponseData BreachesIdentity & Access ManagementCloud SecurityOT / ICS & Critical Infrastructure
Trail of Bits released RPC Investigator, a .NET/C# Windows Forms application built on the NtApiDotNet platform that enumerates, decompiles, and communicates with arbitrary RPC servers on Windows. The tool adds a library of discovered servers and...
During an internship at Trail of Bits, Laura Bauman prototyped a harness that improves the testability of the eBPF verifier and simplifies testing of eBPF programs. The harness runs in user space, independently of any locally running kernel, which opens...
A Trail of Bits intern prototyped a user-space harness that runs the Linux kernel's eBPF verifier outside any running kernel, so eBPF programs can be tested across kernel versions without matching the local kernel. The harness works with kernel version...
Trail of Bits audited cURL in fall 2022 and, after a team member jokingly asked whether anyone had tried "curl AAAAAAAAAA…", fuzzed the tool's command-line interface with AFL++ over a month on a 32-core machine, finding use-after-free bugs, double-free...
A researcher found a logic bug in the readline library that partially discloses file contents when parsing the file named in the INPUTRC environment variable, and used it to leak lines from /etc/shadow through the SUID binary chfn. The bug was introduced...
Trail of Bits researchers found three vulnerabilities in VSCode extensions, including two in Microsoft's SARIF Viewer and Live Preview extensions that allowed arbitrary local file exfiltration, plus a VSCode mitigation bypass assigned CVE-2022-41042 with a...
Trail of Bits found that a Webview's localResourceRoots restriction in VSCode could be bypassed by using %2f.. instead of /.. in a path, because VSCode decodes the %2f with decodeURIComponent but checks roots with resourceFsPath.startsWith(rootPath)...
Trail of Bits released 168 pre-built properties for property-based fuzzing, usable to guide its Echidna smart contract fuzzing tool or directly through unit tests. The properties cover compliance with common ERC token interfaces, generically testable...
Trail of Bits has launched a machine learning and AI security practice that combines safety and security methodologies into a risk assessment and assurance program for AI-based systems. The firm's ML assurance team released a paper proposing an end-to-end...
Trail of Bits released version 0.8.0 of Circomspect, its static analyzer and linter for Circom, adding five new analysis passes to the tool's initial nine, along with support for tags, tuples, and anonymous components. The new passes flag uses of...
Trail of Bits ran a four-month pilot called Toucan that integrated OpenAI's Codex into its Solidity auditing workflow, and concluded the technology is not yet ready for security audits. The team found Codex could not reason about higher-level concepts like...
Trail of Bits researcher Henrik Brodin wrote that CVE-2023-21036, nicknamed the "aCropalypse," spread across Twitter and other media last week, and that the underlying flaw could be detected by the firm's tool PolyTracker without specific file format...
Trail of Bits researchers used their PolyTracker tool to detect CVE-2023-21036, the "aCropalypse" flaw in which Google Pixel's Markup screenshot editor overwrites a cropped image only up to the new image's end offset, leaving original data intact in the...
Trail of Bits winter associate Matheus Branco Borella, of the University of São Paulo, worked on two improvements to the GNU Project Debugger (GDB): making it run faster and improving its Python API to support tools that rely on it, such as Pwndbg. The...
During a security audit, a Trail of Bits researcher found a typo that failed to enable _FORTIFY_SOURCE, the macro-based mitigation that swaps C functions like strcpy for checked wrappers such as __strcpy_chk. Searching with grep.app, sourcegraph.com, and...
Trail of Bits Principal Security Engineer Dr. Evan Sultanik joined a nine-person government, academia, and industry panel hosted by the Naval Postgraduate School's Distributed Consensus: Blockchain & Beyond program to discuss how blockchains, digital...
Windows Notification Facility, an undocumented notification mechanism for communication within and between processes and kernel drivers, now carries state names generated by the kernel Code Integrity Manager (CI.dll) starting in Windows 10. The Windows...
At the Real World Crypto 2023 conference in Tokyo, researchers presented work on the EDHOC lightweight key exchange protocol, which verified multiple security properties and identified theoretical issues that led to updates in the EDHOC standard. Other...
Trail of Bits worked with the Python Package Index over the past year to add trusted publishing, an authentication method built on OpenID Connect that removes long-lived API tokens and passwords from release workflows. The design binds a PyPI project to a...
Trail of Bits developed a tool called VAST that uses MLIR to build a "tower of IRs," letting a program analysis start at whichever abstraction level best fits the task and move up or down as needed. The post walks through a checker for a variant of the...
Trail of Bits submitted a response to the NTIA's Artificial Intelligence Accountability Policy Request for Comment, arguing that AI accountability depends on the claims and context in which a system is deployed. The firm recommends defining operational...
On March 28, 2023, SafeMoon, a self-styled community-focused DeFi token on Binance Smart Chain, lost the equivalent of $8.9 million in Binance Coin BNB to an exploit in a liquidity pool. The exploit leveraged a simple error introduced in an upgrade to...
Trail of Bits released Diffusc, a tool that combines Slither-based static analysis with Echidna differential fuzz testing to compare two implementations of an upgradeable smart contract before an upgrade goes on-chain. The tool was motivated by the March...
In March, a Trail of Bits representative joined the Commodity Futures Trading Commission's Technology Advisory Committee to advise the agency on cybersecurity risks in emerging technologies including AI and blockchain. At the committee's first meeting, the...
Trail of Bits published a set of codebase maturity criteria for blockchain projects, drawn from hundreds of security audits over more than a decade, that rank control families as weak, moderate, satisfactory, or strong. The firm says most teams will need...
Trail of Bits responded to an OSTP request for information on AI policy, arguing that developers should be held accountable to verifiable, falsifiable claims that independent regulators can assess through a documented safety case, as the FDA requires in...
Trail of Bits released version 2.1.0 of Echidna, its fuzzing tool for Ethereum smart contracts, adding features for direct retrieval of on-chain data such as contract code and storage slot values. The post, by Elvis Skozdopolj and Guillermo Larregay on...
Trail of Bits released Echidna 2.1.0, adding direct retrieval of on-chain data such as contract code and storage slot values so deployed contracts can be fuzzed in their on-chain state. Using the tool's optimization mode, the team reproduced the 2022 Stax...
Trail of Bits announced the Testing Handbook, a guide for developers and security professionals to get value from the static and dynamic analysis tools the firm uses in its own work. The first chapter covers Semgrep, a static analysis tool for finding...
At the Commodity Futures Trading Commission's Technology Advisory Committee meeting on July 18, Trail of Bits CEO Dan Guido said AI could fundamentally change the balance between cyber offense and defense and argued for security-focused benchmarks and...