Covers: Vulnerabilities & PatchingSupply Chain & AppSecAI SecurityEndpoint & Network SecurityZero-Days & ExploitsDetection & ResponseData BreachesIdentity & Access ManagementCloud SecurityOT / ICS & Critical Infrastructure
Trail of Bits' 2020 Winternship placed 10-15 students with mentors over winter break on information security tooling projects, including an Anvill decompiler JSON specification tool, DeepState fuzzing bug fixes, a Manticore cloud provisioner called...
Trail of Bits has open-sourced μthenticode, a cross-platform C++ library for verifying Authenticode signatures on Windows PE binaries without a Windows machine, and integrated it into recent builds of Winchecksec. The library replaces the CryptoAPI...
Trail of Bits published a post by William Wang of UCLA on May 29, 2020, describing work on detecting bad OpenSSL usage through program analysis. The post notes that OpenSSL is one of the most popular cryptographic libraries, used even by other languages...
A Trail of Bits intern prototyped Anselm, an LLVM pass that searches code for bad sequences of API calls, starting with OpenSSL usage such as calling EVP_EncryptUpdate and EVP_EncryptFinal_ex out of order or reusing initialization vectors. The tool...
Trail of Bits fuzzed solc, the standard Solidity smart contract compiler, and found almost 20 new bugs, most of them previously unreported and now mostly fixed. The campaign used a modified AFL with source-code-like mutations, a corpus drawn from...
A Trail of Bits post explains that ECDSA private keys can be recovered if a nonce is ever revealed or repeated, and that lattice attacks have recovered keys from partial nonce leakage since Howgrave-Graham and Smart's 1999 work. The post cites Nguyen and...
Trail of Bits added a suite of 17 upgradeability checks to Crytic, its GitHub app for finding smart contract flaws, which already detects 90+ vulnerabilities. In a demo token, Crytic flagged that removing the init() function and its was_init state variable...
Trail of Bits released manticore-verifier, a tool that lets smart contract authors write security properties as Solidity methods and have them checked automatically by symbolic execution, using the same property format as the Echidna fuzzer. In its example...
The initial release of yVault, launched by yEarn on July 25th 2020, contained price-computation logic for yUSDC that an attacker could manipulate to drain most or all of the pool's assets. Developer Andre disabled the faulty code quickly, securing the...
Trail of Bits released Sinter, an open-source macOS endpoint protection agent written entirely in Swift that uses Apple's EndpointSecurity API to receive authorization callbacks from the kernel and allow or deny process execution events via rules. The...
Trail of Bits demonstrates using the Echidna fuzzer to test AddressArrayUtils.sol, a library of 19 functions for managing arrays of addresses, by writing property-based tests rather than manual unit tests. The approach surfaces a bug in hasDuplicate where...
Trail of Bits released PrivacyRaven, a Python library that simulates privacy attacks on deep learning systems, covering model extraction, membership inference, and model inversion. The tool operates under a label-only black-box threat model, where the...
A Trail of Bits intern developed Itergator, a set of CodeQL classes and queries that detect iterator invalidation in C++ by building a graph of potentially invalidating function calls and relating them to iterator acquisition through data flow. Itergator...
This page is an author archive for Rachel Cipkins on the Trail of Bits Blog, listing two posts: an October 14, 2020 entry on using D-Bus to query systemd data in osquery, and an October 29, 2019 recap of the Grace Hopper Celebration. The osquery post...
A Trail of Bits summer intern ported osquery's startup_items table to Linux and added systemd support through the D-Bus API, since systemd unit files could not be parsed directly like other startup item locations. The work also produced a new systemd_units...
Trail of Bits published a blog post by Ryan Eberhardt of Stanford University on October 22, 2020, describing preliminary work on using GPUs to fuzz embedded software in the cloud. The post states that fuzzing supplies programs with many randomized inputs...
Trail of Bits built a GPU-based fuzzer that translates embedded binaries to PTX via its Remill tool and runs them across thousands of GPU threads, reaching 361K executions/second/dollar in an early benchmark against libFuzzer's 5.2M. After profiling showed...
Trail of Bits described using its archive of years of manually curated security assessment reports to make smart contract auditing more efficient with a tool called Slither-simil, which detects similar vulnerable code snippets based on knowledge embedded...
Trail of Bits built Slither-simil, a machine learning addition to its Slither static analyzer that encodes Solidity functions as SlithIR tokens and scores structural similarity against a database of vulnerabilities pulled from prior client audits. The...
Trail of Bits audited an implementation of the Diamond standard (EIP 2535), a draft proposal for contract upgradeability built on delegatecall, and said it cannot recommend it in its current form because the code is over-engineered and hard to review. The...
Trail of Bits published a blog post by Johanna Ratliff on November 24, 2020, describing smart and simple ways to prevent symlink attacks in Go. The post notes that Go developers' habitual error-checking pattern can sometimes prevent critical thinking about...
Trail of Bits describes how Go's os.Create returns a nil error even when it truncates an existing file, so a symlink placed at the target path causes the program to wipe the linked file's contents without any error. The fix is an os.IsNotExist check before...
Trail of Bits has open-sourced blight, a framework for wrapping and instrumenting C and C++ build tools, with a set of stock actions already in use on its research projects. The framework models compiler command-line behavior across GCC, Clang, ICC and...
During an internship at Trail of Bits, an engineer implemented Reverie, a zero-knowledge proof system that optimizes for prover efficiency and requires no trusted setup, trading off larger proof size. Reverie is a Rust implementation of the MPC-in-the-head...
Trail of Bits reviewed Aave's version 2 codebase the day after its December 3rd deployment and found a vulnerability affecting versions 1 and 2 of the live contracts, which Aave mitigated within an hour of the report. The flaw let anyone call initialize...
Trail of Bits engineers designed a justCTF challenge, 'PDF is broken, and so is this file,' in which a PDF is also a working Ruby script and a valid ZIP file. The challenge's bundled mutool binary was modified to accept ACK (0x06) as a seventh whitespace...
A Trail of Bits reviewer who has reviewed over 25 smart contract analysis papers across seven venues in the past year lists six requirements for a good paper, and says he would reject work whose method is unclear, whose authors did no homework beyond...
Trail of Bits describes how the Fiat-Shamir transformation converts interactive zero-knowledge proofs into non-interactive ones by hashing the prover's inputs to generate the challenge, and how implementation errors in that hashing break the proof's...
Trail of Bits outlines why CI systems become brittle: tests are least useful when first written, flaky tests erode developer trust, and long cycle times push developers to balloon pull requests rather than wait. The post recommends a latency budget for CI,...
Trail of Bits researchers detail how Python pickle files, the format behind many machine learning models, contain GLOBAL and REDUCE opcodes that can execute arbitrary Python code during deserialization, and none of the ML libraries they inspected define a...