Covers: Vulnerabilities & PatchingSupply Chain & AppSecAI SecurityEndpoint & Network SecurityZero-Days & ExploitsDetection & ResponseData BreachesIdentity & Access ManagementCloud SecurityOT / ICS & Critical Infrastructure
In October 2023, Ockam hired Trail of Bits to review the cryptographic design of its protocols for end-to-end encrypted, mutually authenticated channels, covering secure channels built on the Noise XX pattern, Ockam Identities, routing, transports, and...
Trail of Bits detailed two archived findings: a JWT denial-of-service in which an attacker sets the p2c header parameter to a very large iteration count, forcing the recipient to perform 2,147,483,647 PBKDF2 iterations to derive the Content Encryption Key...
Trail of Bits was selected as one of seven teams in the small business track of DARPA's AI Cyber Challenge, receiving a $1 million award to build a Cyber Reasoning System and compete in the AIxCC Semifinal Competition later in the summer. The firm said it...
Trail of Bits is rolling out an Early Stage Security Review service for blockchain projects, aimed at catching security issues at the design and development stages rather than after code is complete. The firm says systemic issues in blockchain projects...
Trail of Bits, working with the Ethereum Foundation, published Attacknet, a chaos-testing tool that injects network faults into blockchain devnets generated by Kurtosis and uses Chaos Mesh to reproduce real-world misconfigurations and boundary conditions....
Trail of Bits released weAudit, a VSCode extension it uses during its own security audits to bookmark, annotate, and track bugs directly in a codebase, installable through the VSCode marketplace with code in its vscode-weaudit repo. The extension supports...
Trail of Bits released SARIF Explorer, a VSCode extension that provides an in-editor UI for triaging static analysis results from tools such as Semgrep and CodeQL, and it is available through the VSCode marketplace with code in the vscode-sarif-explorer...
Trail of Bits compared fuzzing and formal verification, arguing that proving the absence of bugs is typically unattainable on complex codebases because code may need rewriting, custom summaries, manual loop constraints, or solvers that time out. The firm...
This is an index page of Trail of Bits blog posts by Gustavo Grieco, covering fuzzing and formal verification for blockchain audits, Cosmos SDK fuzz testing, the Echidna property-based smart contract fuzzer (used in about 35% of the firm's smart contract...
Trail of Bits released Ruzzy, a coverage-guided fuzzer for pure Ruby code and Ruby C extensions, built on libFuzzer like Google's Atheris for Python and Jazzer for Java. Ruzzy supports AddressSanitizer and UndefinedBehaviorSanitizer when fuzzing C...
Trail of Bits published five previously undisclosed vulnerabilities it reported over the past year, including unsafe Rust code in the borsh-rs serialization library that went unfixed for two years, DoS bugs in four Ethereum API-parsing libraries, a GCM...
Trail of Bits open-sourced pure Rust and Go implementations of Leighton-Micali Hash-Based Signatures (LMS), a NIST-standardized post-quantum signature algorithm standardized in RFC 8554 in 2019 and adopted into federal information processing standards in...
Trail of Bits ran a nine-week invariant development engagement with Curvance, writing and testing 216 invariants that uncovered 13 critical findings. The work pushed Echidna, Medusa, and CloudExec to their limits, and a contract rename from Lendtroller to...
Trail of Bits associate Ben Siraphob worked on optimizing the performance of Echidna, the firm's open-source smart contract fuzzer written in Haskell, using profilers and other tools to pinpoint and debug a large space leak in one of its components. The...
A Trail of Bits associate used GHC profiling tools to trace a memory leak in hevm, the Haskell EVM library that Echidna depends on, and found that repeatedly splicing and resplicing immutable bytearrays caused the bytearray memory type to grow without...
Trail of Bits, working with Alpha-Omega and OpenSSF, has put build provenance for Homebrew into public beta: homebrew-core now cryptographically attests to all bottles built in the official Homebrew CI, verifiable with an external brew verify command. Each...
Trail of Bits explains AddressSanitizer, a compiler plugin that inserts checks around memory accesses at compile time and crashes the program on improper access, detecting bugs that can lead to remote code execution such as WannaCry or a WebP...
Trail of Bits is offering a two-day AI/ML safety and security training for security engineers, ML engineers, and IT staff, built around instructional sessions and hands-on case studies. The firm says its client work revealed knowledge gaps at the...
Trail of Bits developed a technique called Sleepy Pickle that injects a malicious payload into the pickle file packaging an ML model, so that deserialization modifies the model in place rather than attacking the host system. The researchers demonstrated...
Trail of Bits introduced Sticky Pickle, a variant of its Sleepy Pickle attack that adds a self-replicating mechanism, so a malicious payload propagates into successive versions of a compromised ML model when a user fine-tunes and re-distributes it. The...
Trail of Bits published an analysis by Adelin Travers of Apple's Private Cloud Compute (PCC), announced that week, noting that some sensible design choices may seem surprising without deep context on AI and ML security, and that some risks are hidden in...
Trail of Bits added a Burp Suite Professional chapter to its Testing Handbook, a guide drawn from the firm's security auditing experience. The chapter covers where Burp's dynamic analysis can support testing, step-by-step setup for a specific application,...
Apple announced Private Cloud Compute (PCC), a design that moves compute-heavy ML workloads like large language models off battery-powered devices and into Apple's cloud, where data must be decrypted for processing because homomorphic encryption does not...
At WWDC, Apple released details of at least five foundation models: an approximately 3B parameter on-device model, a large Mixture-of-Experts server model estimated at 130B-180B parameters running on Apple Silicon, an on-device code model for Swift...
Trail of Bits built a fuzzing harness for Fuel Labs that executes scripts calling internal contracts, replacing libFuzzer with a LibAFL shim to raise throughput from roughly 50 to about 1,000 executions per second on an eight-core machine. The harness...
Trail of Bits engineers attended Real World Crypto 2024 in Toronto in March, a three-day event with hundreds of attendees, plus the RWPQC, FHE, and Open Source Cryptography workshops. Standards-body speakers described the post-quantum migration as the...
Trail of Bits released a Rust library called Decree that requires developers to specify a Fiat-Shamir transcript up front and flags errors when expected values are missing, unexpected values are added, values are duplicated, or challenges are requested out...
Trail of Bits argues that post-quantum cryptography's main benefit is not quantum resistance but safer, more resilient algorithms built on a diverse set of mathematical problems, developed with 40 years of hindsight about implementation failures. The post...
Trail of Bits audited Ask Astro, an open-source RAG chatbot built on A16Z's reference architecture, and found four issues including high-severity vector database poisoning via front-running, where an attacker posts a forum thread before ingestion and...
Trail of Bits was named a leader in The Forrester Wave: Cybersecurity Consulting Services, Q2 2024, where Forrester compared it against 14 other top vendors. Forrester scored vendors 1, 3, or 5 per criterion, and Trail of Bits said it scored a 1 in...