Covers: Vulnerabilities & PatchingSupply Chain & AppSecAI SecurityEndpoint & Network SecurityZero-Days & ExploitsDetection & ResponseData BreachesIdentity & Access ManagementCloud SecurityOT / ICS & Critical Infrastructure
Trail of Bits explains control flow integrity (CFI), an exploit mitigation like stack cookies, DEP, and ASLR that enforces at run time the control flow graph the compiler determined at compile time. The post covers clang's CFI implementation, in mainline...
Trail of Bits announced it is sponsoring the O'Reilly Security Conference in New York, where it will be the only sponsor offering consulting and custom engineering rather than off-the-shelf products. The company will run a live instance of its Cyber...
Trail of Bits released GRR, a high-speed full-system emulator it built for DARPA's Cyber Grand Challenge to fuzz program binaries, as an open-source project under a permissive license. In a demonstration, GRR found a crash in the third of six binaries...
Trail of Bits introduced Algo, a free self-hosted personal IPSEC VPN server built from Ansible scripts that automates deployment on common cloud providers and requires no client software on most devices. The post argues that paid VPN services are insecure...
Trail of Bits published a second installment on control flow integrity covering Microsoft's Control Flow Guard (CFG), which requires Windows 8.1 Update 3 and Visual Studio 2015 as minimums and is enabled by adding /guard:cf to compiler and linker flags....
Trail of Bits recounts its 2016 work, including a Cyber Reasoning System built for DARPA's Cyber Grand Challenge that audited zlib and settled a $1,000 bet about libotr, plus open-sourced tools such as the GRR fuzzer, a Windows port of Facebook's osquery,...
Trail of Bits' Josh explains Binary Ninja's Low Level IL, an intermediate representation that lifts assembly into a tree-structured form so dataflow analysis can run architecture-agnostically across x86-64, ARM, and MSP430. He notes the translation is...
Trail of Bits published a Binary Ninja plugin, vtable-navigator.py, that resolves C++ virtual function calls by using Low Level IL to find a class's vtable in its constructor and then tracing register assignments back from the call instruction to compute...
A Trail of Bits keynote at BSidesLisbon argued that the last two years have seen greater advances in automated security testing than the ten before them, citing AFL, the DARPA Cyber Grand Challenge, and Microsoft's Project Springfield (SAGE). The talk...
Trail of Bits set out to apply control flow integrity to Facebook's osquery, enabling Visual Studio's Control Flow Guard on the Windows build in about 15 minutes with a two-line CMake change, while ClangCFI on the Linux build remained unfinished after...
Trail of Bits held a hackathon that overhauled McSema, its x86 machine code to LLVM bitcode translator, moving it from a custom-modified LLVM 3.5 to a stock LLVM 3.8 and dropping its Boost dependency. The update simplified the build system, replaced the...
Trail of Bits is attending and sponsoring Infiltrate, sending 18 people, and will give attendees early access to Manticore, its binary symbolic and concolic execution engine supporting x86, x86-64, and ARM, ahead of open-sourcing it. Sophia d'Antoine is...
Trail of Bits researcher Peter Goodman recounts building Granary, a binary translator that selectively instruments only Linux kernel modules while the rest of the kernel runs natively, and its Address Watchpoints technique, which embedded a taint-tracking...
Trail of Bits published a blog post by Mark Mossberg on April 27, 2017 describing Manticore, a tool for symbolic execution, taint analysis, and instrumentation of binaries. The post states Manticore helps the firm quickly apply these techniques to analyze...
Trail of Bits open-sourced Manticore, a tool for dynamic binary analysis that uses symbolic execution, taint analysis, and instrumentation, with parts of it underpinning the company's symbolic execution capabilities in the Cyber Grand Challenge. The...
Trail of Bits published a May 15, 2017 post by Douglas Gastonguay describing how he used Manticore, the firm's binary analysis tool with an API for symbolic execution, taint analysis, and instrumentation, to solve the Magic capture-the-flag challenge. The...
A Trail of Bits intern used Manticore, a binary analysis tool with an API for symbolic execution, taint analysis, and instrumentation, to solve Magic, a DEFCON CTF qualifying challenge made up of 200 unique binaries that each require a separate key. The...
This year's DEF CON CTF used a purpose-built hardware architecture called cLEMENCy, with only a specification and reference tooling released 24 hours before the four-day final event began. The architecture was designed to break existing tools and make...
A Trail of Bits researcher sandboxed Windows Defender as a proof of concept, releasing the code as Flying Sandbox Monster, built on a Rust framework called AppJailLauncher-rs that contains untrustworthy apps in AppContainers. The post notes that the core...
Trail of Bits describes how 2.27 million Windows computers were infected with malware signed using a stolen certificate from the creators of CCleaner and inserted into its software update mechanism. The post explains that a colleague's pull request added...
Trail of Bits released iVerify, an App Store-compatible iOS framework that checks for known jailbreaks such as Pangu and for anomalies that may indicate unknown or custom jailbreaks, returning either a simple pass/fail result or per-check results. The...
Trail of Bits added five employees in two months, bringing its total to 32, including hires with backgrounds as a CTO, a co-founder, and an editor. The new staff bring experience in embedded software exploitation, malware analysis, ARM TrustZone secure...
Trail of Bits announced it has joined the Enterprise Ethereum Alliance, which it describes as the world's largest open source blockchain initiative, as the first information security company to join. The firm says it will contribute its smart contract...
Trail of Bits walks through Zeppelin's Ethernaut Ethereum CTF, hosted on the ropsten blockchain, covering challenges on a misnamed constructor, an integer underflow, delegatecall, selfdestruct, and re-entrancy. The author was the first to finish the...
Trail of Bits interviewed osquery users at five major tech firms a year after porting the open-source endpoint monitoring agent to Windows, finding deployment maturity varied from testing infrastructure to plans for a 17,500-machine rollout. Three of the...
Trail of Bits is hosting a special Empire Hacking meetup on December 12th at 6pm at the DataDog offices in the New York Times building, focused entirely on Ethereum security. Four blockchain security experts, two from Trail of Bits, will present on writing...
Trail of Bits released a maintained repository of osquery extensions, with its first extension querying the Duo Labs EFIgy API to check whether EFI firmware on a Mac fleet is up to date. Duo Labs had analyzed all publicly released Apple updates from the...
Trail of Bits interviewed teams at five major tech firms and osquery developers, who cited pain points including false negatives in file integrity monitoring caused by audit backend bugs that went unchecked since FIM was enabled in 2015, and Windows...
On December 12, 2017, over 150 attendees gathered at Datadog's office for the final Empire Hacking meetup of the year, focused on writing and hacking secure smart contracts. Speakers included Jon Maurelian of Consensys Diligence on Ethereum security,...
Trail of Bits released McSema 2.0, an x86 to LLVM bitcode binary translator that now uses Remill for instruction semantics and adds AArch64 support. The release demonstrates disassembling an AArch64 binary, lifting it to bitcode, and recompiling that...