Covers: Vulnerabilities & PatchingSupply Chain & AppSecAI SecurityEndpoint & Network SecurityZero-Days & ExploitsDetection & ResponseData BreachesIdentity & Access ManagementCloud SecurityOT / ICS & Critical Infrastructure
Trail of Bits built a Linux kernel module called tsc_freq_khz that exports the kernel's internal x86 Time Stamp Counter frequency, tsc_khz, to userspace via /sys/devices/system/cpu/cpu0/tsc_freq_khz. The module addresses two profiling failures: LLVM's...
A Trail of Bits intern built a three-party multi-party computation tool implementing perceptron and support vector machine training across private datasets, using secret sharing over integers modulo a prime and Beaver Triples for secure multiplication. One...
Trail of Bits audited Vyper contracts with Computable and found a compiler bug, concluding the Python-like language is too young to recommend for production. The review also found that function IDs derived from the first four bytes of the signature can...
A Trail of Bits summer intern specified Ethereum's CBC Casper consensus protocol in TLA+ and PlusCal and model-checked it with TLC, finding that finality could not be determined unless the Byzantine fault threshold stayed below one-third of total validator...
The Grace Hopper Celebration 2019 in Orlando drew over 25,000 attendees from 83+ countries across four days, with a career fair of more than 450 vendors and at least 15 cybersecurity talks on a conference not dedicated to security. The author notes that...
Researchers found Apple was sending safe browsing data to Tencent for all Chinese users, prompting scrutiny of the protocol's privacy claims. The post argues that safe browsing's k-anonymity guarantee is weak: a 2015 Gerbet et al. study found each 32-bit...
Trail of Bits has open-sourced mishegos, a differential fuzzer that feeds the same instruction candidates to multiple x86_64 decoders and compares their outputs, using a sliding strategy that generates up to 26-byte candidates to yield 12 windows per...
Trail of Bits released two open-source tools, PolyFile and PolyTracker, from work tied to DARPA's SafeDocs program, aimed at the parsing weaknesses that make file formats vulnerable to polyglots and schizophrenic files. PolyFile identifies over 10,000 file...
Trail of Bits wrote that its Assurance practice received an influx of Go projects after completing a Kubernetes assessment in summer 2019, and that it has been adapting security assessment techniques and tactics used with other compiled languages for Go....
Trail of Bits adapted its security assessment techniques to Go after an influx of Go projects, focusing on commonly misunderstood language semantics including scoping, coroutines, error handling, and dependency management. The firm recommends gosec,...
Trail of Bits explains test-case reduction, the process of turning a large failing input into a smaller one that triggers the same behavior, and walks through DeepState's reducer shrinking a file-system corruption test from 16 steps to a reset at the...
Trail of Bits created the Crytic Research Prize to reward published academic papers built on its blockchain tools, with submissions closing November 1st, 2020. The firm says it will evaluate all entries and award cash prizes to the best papers, citing a...
Trail of Bits launched iVerify, an iPhone security toolkit available in the iOS App Store that provides instructional guides for adjusting device and iCloud settings and periodically scans for anomalies that may indicate compromise. The app is built on...
A Trail of Bits experiment measured how long it takes to brute-force a 64-bit value, starting from 133 years with a naive loop and 39 years with hand-vectorized AVX-512 code on a single core. Using 4x NVIDIA Tesla V100 GPUs cut the estimate to about 22...
Trail of Bits announced Mainnet360, a joint offering with Prysm Group unveiled on October 28th at the Crypto Economics Security Conference, that reviews both the economic framework and the deployed code of blockchain systems. The two firms connected after...
The NSA announced a critical vulnerability in certificate validation on Windows 10 and Windows Server 2016/2019, where Crypt32.dll fails to check that elliptic curve parameters in a supplied root certificate match those Microsoft knows. For cached root...
At Real World Crypto 2020, researchers presented a Bleichenbacher attack on TLS that exploits reused certificates to parallelize the attack within the 30-second session timeout, and noted the insecure PKCS#1 v1.5 padding is still supported by roughly 6% of...
Trail of Bits released Manticore 0.3.3, adding support for symbolically executing WebAssembly binaries so the engine can explore all reachable states in a WASM program and derive the concrete inputs that trigger them. Earlier releases included Manticore...
Trail of Bits released Manticore 0.3.3, which it describes as the first actively-maintained symbolic execution engine to support WebAssembly binaries, able to explore all reachable states in a WASM program and derive the concrete inputs that produce a...
The Ethereum Name Service contract carried a critical bug, tracked as CVE-2020-5232, that let a person who transferred a name in a specific way later claim it back from the new owner; normal transfers were not affected. Trail of Bits ran its Manticore...
Trail of Bits conducted the first white-box security assessment of the Voatz mobile voting platform, reviewing over 168,000 lines of source code across roughly 2,100 files and producing 79 findings, a third of them high severity. As of the report, Voatz...
Trail of Bits has released ntfs_journal_events, a new event-based osquery table for Windows that reads the NTFS change journal ($Extend\$UsnJrnl) to monitor changes to specific files, directories, and patterns on Windows endpoints. The approach reads...
Trail of Bits attended the 24th Financial Cryptography conference and the Workshop on Trusted Smart Contracts, where it presented work on smart contract bug categorization and a poster on Echidna. The recap highlights papers including two safety attacks on...
Trail of Bits and Corelight released the Zeek Agent, an open-source BSD-licensed tool that feeds endpoint events such as new processes, opened sockets, and user logins into Zeek's standard processing pipeline alongside network-derived events. The agent...
Trail of Bits reports that Echidna, its open-source property-based smart contract fuzzer released two years ago, was used in about 35% of its smart contract audits over that period, including audits of MakerDAO, 0x, and Balancer. Since the first release,...
Trail of Bits is holding its next Empire Hacking meetup virtually on April 14th at 6PM because of COVID-19 remote work. Red Hat security engineers Lily Sturmann and Mark Bestavros will present on the open-source Enarx project, which deploys confidential...
Vector35 released a decompiler to Binary Ninja's development branch, built on a High Level IL that abstracts the existing Low Level and Medium Level ILs with dead code elimination, constant folding, and switch recovery. Revisiting a 2000 cuts challenge,...
Trail of Bits and Northern Arizona University are co-organizing the 1st International Workshop on Smart Contract Analysis (WoSCA 2020), co-located with ISSTA 2020, to discuss static and dynamic approaches for analyzing smart contracts. The workshop is...
Trail of Bits' Crytic GitHub app, which runs 90+ detectors on every commit, found twelve issues across major projects including a critical flaw in E&Y's Nightfall where FTokenShield.mint does not check the return value of transferFrom, allowing anyone to...
Trail of Bits and Johns Hopkins University partner Matthew Green are using zero-knowledge proofs to let vulnerability researchers prove they possess a valid exploit without disclosing it, as part of a four-year DARPA SIEVE program effort. The work aims to...