Covers: Vulnerabilities & PatchingSupply Chain & AppSecAI SecurityEndpoint & Network SecurityZero-Days & ExploitsDetection & ResponseData BreachesIdentity & Access ManagementCloud SecurityOT / ICS & Critical Infrastructure
Trail of Bits published a hardening guide for Google Apps for Work, aimed at small businesses without dedicated IT staff, recommending a separate domain admin account with 2FA, disabling mail forwarding and delegation, turning on SPF and DKIM, and enabling...
In DARPA's Cyber Grand Challenge qualifying event on June 3, 2015, Trail of Bits' Cyber Reasoning System was given 131 purposely built insecure programs and, over 24 hours, identified vulnerabilities in 65 and rewrote 94 to eliminate bugs. The system...
At REcon 2015, a researcher demonstrated a hardware side channel that targets co-located virtual machines in the cloud by exploiting the CPU's execution pipeline rather than cache tiers. The attack records out-of-order execution artifacts from shared...
FireEye's FLARE team hosted its second annual Flare-On Challenge this summer, an eleven-challenge reverse-engineering contest for reverse engineers, malware analysts, and security professionals, with challenges spanning password crack-mes, kernel drivers,...
A high school intern at Trail of Bits spent the summer fuzzing VLC, Wireshark, and ImageMagick with AFL and Microsoft MiniFuzz, and traced a VLC crash to a type confusion in QuickTime container box parsing that frees two user-controlled pointers. The bug...
Trail of Bits describes its long involvement with Cyber Security Awareness Week (CSAW), the nation's largest student-run cyber security event, where tens of thousands of students and professionals will watch six competitions in a couple of weeks. The post...
Trail of Bits released the source code for Tuber, a self-hosted video chat platform it has used internally for private calls with up to 15 team members over the last year or two. Tuber runs on WebRTC with a JavaScript client and server, requires no account...
Trail of Bits announced financial support for Let's Encrypt, the free, open, automated SSL certificate authority that entered public beta on December 3. The post argues that expensive certificates have held back HTTPS adoption, and notes that Let's Encrypt...
Trail of Bits' 2015 review reports that its Cyber Reasoning System, entered in DARPA's challenge to find and patch vulnerabilities in 131 purposely built insecure programs within 24 hours without human intervention, identified vulnerabilities in 65 of them...
Trail of Bits ran its DARPA Cyber Grand Challenge bug-finding system against libotr, a secure messaging library, after Thomas Ptacek bet Matthew Green on November 4, 2014 that it would have a high severity bug within 12 months. The system ran on 48 Xeon...
Trail of Bits highlights a guest post by Andrew Ruef, a Trail of Bits employee and UMD PhD student, for Michael Hicks's blog The Programming Language Enthusiast, on software security ideas that were ahead of their time. The post examines a 20-year-old...
Trail of Bits announced that Sophia D'Antoine will speak at Etsy's Code as Craft series on Wednesday, February 10th from 6:30-8pm at Etsy Labs in Brooklyn. Her talk covers the current state of iOS attacks, why available security APIs are insufficient...
Trail of Bits released Tidas, an SDK drop-in for iOS apps that replaces passwords with a fingerprint touch, generating a unique encryption key stored in the iOS Secure Enclave and protected by Touch ID. Signing in produces a digitally signed session token...
A federal judge ordered Apple to comply with the FBI's request for technical assistance in recovering the iPhone 5C of one of the San Bernardino gunmen, and Trail of Bits' Dan Guido assessed that all of the FBI's requests are technically feasible. Because...
Trail of Bits describes PointsTo, a whole-program static analysis tool it built that converts source code into LLVM bitcode and tracks how pointers to allocated objects flow through a program to find potential use-after-free bugs. The tool performs...
Trail of Bits is launching a bounty that asks hackers to retire their handles by rejecting them in the comments of its blog post, with an Italian dinner before the next Empire Hacking event as the prize. Participants earn points by posting old tweets that...
Trail of Bits argues that the 2016 Verizon DBIR's vulnerability section, contributed by Kenna Security, is built on correlations between vulnerability scanner output and IDS alerts rather than confirmed data breaches, and that its 'top 10' list wrongly...
Trail of Bits published a post by Yan Ivnitskiy on May 18, 2016 describing ProtoFuzz, a fuzzer for Google's Protocol Buffers, the serialization format commonly used in distributed applications. The post notes that protobufs let developers define data types...
Trail of Bits released ProtoFuzz, a Python3 library that takes a protobuf definition and generates streams of valid protobuf-encoded messages filled with malicious values drawn from the fuzzdb database, aiming at the code behind protobuf decoding rather...
Empire Hacking, a bi-monthly security research meetup started by Trail of Bits, marked its first year with a retrospective of presentations covering topics such as cellular baseband exploitation, Nintendo 3DS exploitation, OS X malware, and a...
A Trail of Bits researcher used Vector35's Binary Ninja, an interactive static analysis and reverse engineering platform, to write a Python script that generated crashing inputs for 2,000 unique binaries across the DEFCON CTF qualifying round's 334, 666,...
Trail of Bits is launching a "Hacker Anthology" repository of stock photos and video of real security professionals, starting with footage of its own employees and a hacker typer script it made last year. The post says the author will be in Las Vegas for...
Trail of Bits has open-sourced Tidas, a service that stores a per-user encryption key in Apple's Secure Enclave, protected by Touch ID, and verifies sign-in through a digitally signed session token passed to its web service. The company says that since...
Trail of Bits researchers found that the iOS Pokemon Go app requested a Google OAuth scope called OAuthLogin, which Chrome changelogs refer to as the "Uber" token and which could not be reproduced in Google's own OAuth Playground. Niantic said the iOS...
DARPA has released the source code for over 100 vulnerable challenge binaries from its Cyber Grand Challenge since 2014, originally written for DECREE, a custom Linux-derived operating system with only seven system calls and no signals, shared memory, or...
Trail of Bits built two bug-finding systems, GRR, a high-throughput full-system emulator fuzzer, and PySymEmu (PSE), a binary symbolic executor that stores expressions rather than raw bytes and uses a theorem prover to follow only satisfiable paths. During...
Trail of Bits is recruiting fall and winter interns to work remotely on security tooling projects, with in-person kick-off and debrief meetings at its Manhattan offices and a headcount noted at 32 employees after five recent hires. The post describes past...
Trail of Bits compiled a directory at nyc-infosec.com of infosec gatherings, companies, and university programs in New York City, and it also runs the semi-monthly Empire Hacking meetup for pragmatic security research. The post argues that investors...
Facebook announced the completion of osquery for Windows, a port that Trail of Bits worked on, bringing the open source endpoint security tool to Windows alongside Linux and Mac OS X. The port required adding Windows service functionality for the daemon,...
Trail of Bits reports that its Cyber Reasoning System, developed for DARPA's Cyber Grand Challenge, audited the open source zlib compression library for Mozilla's Secure Open Source Fund, which the firm describes as the first paid, automated security audit...