Covers: Vulnerabilities & PatchingSupply Chain & AppSecAI SecurityEndpoint & Network SecurityZero-Days & ExploitsDetection & ResponseData BreachesIdentity & Access ManagementCloud SecurityOT / ICS & Critical Infrastructure
Trail of Bits has proposed a new block cipher mode called Galois Extended Mode (GEM), presented at a NIST workshop on accordion mode cipher requirements, which modifies AES-GCM with a longer nonce, CBC-MAC-based subkey derivation, a 64-bit internal...
Trail of Bits published a Q&A with its cryptography experts answering 10 key questions, noting that cryptography underpins credit cards, cell phones, web browsing via TLS, and top-secret military data. The post states that blockchains such as Ethereum...
Trail of Bits cryptography experts answer ten questions covering polynomial commitment schemes (KZG, FRI, Pedersen/IPA), Merkle-Damgard versus sponge hash constructions, theoretical ECC attacks like Weil descent and the MOV attack, lattice- and...
Trail of Bits performed an audit of Homebrew's brew CLI and three adjacent security-relevant repositories, finding issues that, while not critical, could allow an attacker to load executable code at unexpected points and undermine the integrity guarantees...
Trail of Bits published a guide to Google Cloud Platform's cryptography offerings, covering Cloud KMS (including Cloud HSM and Cloud EKM), Secret Manager, Confidential Computing, and the Tink client-side library. The post notes GCP's cryptography offerings...
Trail of Bits submitted Buttercup, a Cyber Reasoning System combining fuzzing and static analysis with AI and machine learning to find and fix vulnerabilities, to DARPA's AI Cyber Challenge semifinals at DEF CON 2024. DARPA awarded the firm and six other...
Trail of Bits' Cyber Reasoning System, Buttercup, placed in the top 7 of 39 teams in the AIxCC semifinal at DEF CON 2024, where CRSs had to automatically find and patch vulnerabilities in codebases including nginx, Jenkins, Apache Tika, SQLite, and the...
NIST officially announced three standards specifying FIPS-approved algorithms for post-quantum cryptography, including SLH-DSA, formerly known as SPHINCS+. Trail of Bits built an open-source pure-Rust implementation of SLH-DSA that has been merged into...
Trail of Bits describes three ad-hoc hash constructions it commonly finds in client products: a multi-value hash that concatenates messages with a separator string, a MAC built as H(K ‖ M), and a password KDF built as H(S ‖ P). The separator approach...
Trail of Bits tested ChatGPT 4o and Claude Sonnet on generating Terraform code for a Windows VM on Azure and found both produced hard-coded admin passwords, with Claude at least prompting the user to change them. When asked for password-generation code,...
Trail of Bits notes that with GPU product cycles of roughly 18-24 months and each cycle doubling GPU power under Huang's Law, older server GPUs get removed from Google Cloud and Microsoft Azure but not AWS, and are considered useless for machine learning....
A Trail of Bits intern extended Pwndbg, the GDB plugin maintained by Dominik Czarnota, with an integration that runs an XML-RPC server inside Binary Ninja so Pwndbg can query its analysis database to sync symbols, function signatures, and stack variable...
Trail of Bits added AddressSanitizer annotations to libc++'s std::string and std::deque containers, enabled custom allocators for container annotations, and fixed bugs in libc++ along the way. The work extended the compiler-rt ASan API in LLVM16 with the...
Trail of Bits describes a bug it found in a client's threshold signature scheme using ChaCha20-Poly1305: every party initialized a global nonce counter at 0, incremented it at the same rate, and sent messages in the same order, so two different senders...
At DEF CON, Trail of Bits Principal Security Engineer Michael Brown told ISMG's Michael Novinson that AI/ML techniques can surpass traditional software analysis as Moore's law slows and conventional bug-finding yields diminishing returns. Brown described...
Trail of Bits announced a partnership with Semgrep, initiated by CEO Dan Guido after observing that many clients do not use Semgrep to its fullest potential or at all. Trail of Bits said it uses Semgrep as one of the first tools its application security...
Trail of Bits analyzed the attack surface of AWS Nitro Enclaves and found that the parent EC2 instance, whose kernel and nitro_enclaves drivers should be assumed attacker-controlled, is the only component with direct access to an enclave through the local...
The SLSA framework, whose version 1.0 was released in April 2023, uses a signed provenance file to attest how a binary, container image, or other artifact was built from source, with Build Levels 1 through 3 adding signing, dedicated infrastructure, and...
Hugging Face hired Trail of Bits to audit Gradio 5, a machine learning web interface library with more than 6.1 million monthly PyPI downloads, and the review uncovered eight high-severity issues before the October 9, 2024 release. The findings included...
The mseal syscall landed in Linux kernel 6.10, letting developers seal virtual memory address ranges so an attacker with a code execution primitive cannot change their permissions or layout at runtime. Chrome's security team introduced it to support their...
Trail of Bits fuzzed the open-source ZBar barcode scanning library, which had no public record of prior fuzzing, and found an out-of-bounds stack buffer write enabling arbitrary code execution via a malicious barcode, plus a memory leak usable for...
Trail of Bits researchers identified and reported a vulnerability in the Lotus and Venus clients of the Filecoin network that let an attacker remotely crash a node and trigger a denial of service, caused by incorrect validation of an index that produced an...
Trail of Bits identified and reported a vulnerability in the Lotus and Venus clients of the Filecoin network that let an attacker remotely crash a node and trigger a denial of service. The flaw came from an incorrect validation of an index: a...
Trail of Bits worked with PyPI on index-hosted digital attestations specified in PEP 740, which replace the disabled PGP signatures by binding a package's filename and digest to its publishing identity through Sigstore's keyless signing and the in-toto...
Trail of Bits evaluated popular code models on Solidity completion as of August 2024 and found Anthropic's Claude 3 Opus the best commercial model and the largest DeepSeek Coder model you can comfortably run the best local one, with local models...
Trail of Bits published an additional set of custom Semgrep rules, bringing its total number of public rules to 115, and the post covers regex mode versus generic mode and HCL language support. The same page also references a September 18, 2023 audit in...
Trail of Bits published 35 new custom Semgrep rules, bringing its public total to 115, focused on supply chain issues such as missing short-lived OIDC tokens in GitHub Actions, infrastructure concerns in Terraform and Nomad, and Ruby application security....
Ruby Central hired Trail of Bits to complete a security assessment and a competitive analysis of RubyGems.org, the official package management system for Ruby applications. The blog post states RubyGems.org has over 184 billion downloads to date and...
Ruby Central hired Trail of Bits to audit RubyGems.org, the Ruby ecosystem's package repository with over 184 billion downloads, and the review over five engineer-weeks in August and September 2024 found 33 issues. These included one high-severity finding...
Trail of Bits engineers submitted over 750 merged pull requests in 2024, a 67% increase over 2023, with improvements across more than 80 open-source projects spanning cryptography libraries, package managers, and software indexes. The contributions...