Covers: Vulnerabilities & PatchingSupply Chain & AppSecAI SecurityEndpoint & Network SecurityZero-Days & ExploitsDetection & ResponseData BreachesIdentity & Access ManagementCloud SecurityOT / ICS & Critical Infrastructure
Trail of Bits released an experimental coverage-guided fuzzer called Honeybee that records program control flow using Intel Processor Trace (IPT) technology. The work, by UC Berkeley's Allison Husain during a winter internship, focused on addressing IPT's...
Trail of Bits released an experimental coverage-guided fuzzer called Honeybee that records program control flow using Intel Processor Trace, a hardware feature that captures traces at 8-15% overhead. Honeybee uses static, ahead-of-time generated caches...
Trail of Bits reports that its fuzzing campaign against the Solidity compiler, begun in February 2020, has submitted 74 reports, of which 67 were confirmed as bugs and 66 fixed, with 21 of those submitted since the previous December. The team also fuzzed...
A Trail of Bits intern built Solar, a proof-of-concept static analysis framework for interactive, context-free analysis of Solidity smart contracts, with an IDE-like interface split into source and IR panels. Solar uses three strategies (concrete,...
Trail of Bits published a Semgrep rule for detecting goroutine leaks in Go, a bug class it says is common but seldom discussed and typically caused by incorrect use of unbuffered channels. The post cites a Kubernetes repository PR in which an API server...
A Trail of Bits intern implemented a proof-of-concept model inversion attack in PrivacyRaven, a Python tool for testing deep-learning frameworks against privacy attacks, based on the paper "Adversarial Neural Network Inversion via Auxiliary Knowledge...
Trail of Bits published a step-by-step guide to writing BPF tracing tools directly with LLVM and the bpf() system call, avoiding specialized libraries. The post walks through loading an empty BPF program, attaching it to a tracepoint via debugfs, printing...
Trail of Bits announced version 5.0.1 of osquery, a cross-platform, open-source endpoint visibility agent, with the release introducing an EndpointSecurity-based process events table for macOS. The post, by Sharvil Shah and dated November 10, 2021,...
Trail of Bits announced osquery 5.0.1, which adds an EndpointSecurity-based es_process_events table for macOS, replacing the kernel-mode kauth and OpenBSM frameworks with a user-mode API that requires Apple-granted entitlements. The release installs...
A Trail of Bits intern built the Manticore User Interface (MUI), a Binary Ninja plugin with custom Qt widgets that visualizes Manticore's symbolic execution state exploration inside the Binary Ninja UI. The plugin adds a State List widget, a Graph View...
On August 18, 2021, samczsun reported a critical vulnerability in SushiSwap's MISO smart contracts that put roughly 350 million USD (109 thousand ETH) at risk, an issue similar to an August 2020 attack on the Opyn codebase. Trail of Bits released two...
Trail of Bits disclosed two bugs in the Shamir's Secret Sharing implementation of Binance's threshold signature scheme library (tss-lib) and most of its active forks that let a malicious user steal other users' secret keys or crash their nodes by...
Trail of Bits reports that its employees submitted over 190 pull requests that were merged into repositories outside the company in 2021. The post highlights contributions to projects such as osquery and notes that reviewing, maintaining, and testing...
A Trail of Bits graduate student intern developed Dr. Disassembler, a Datalog-driven framework for binary disassembly built on Trail of Bits' in-house incremental and differential Datalog engine, Dr. Lojekyll. The prototype uses Dr. Lojekyll's Python API,...
Trail of Bits used CodeQL variant analysis to hunt unhandled error codes in a Windows/Visual Studio codebase, starting from a custom error type called CustomErrorType and building a query that flags call sites where the returned error never taints a...
Trail of Bits released rellic-headergen, a tool built during an internship that converts LLVM bitcode type definitions into equivalent C struct definitions, matching the memory layout of the original C++ types. The tool builds a directed acyclic graph of...
Trail of Bits tested how compiling constant-time Rust cryptographic code to WebAssembly with wasm-pack and running it in node affects timing-attack protections, since the code is optimized twice - first by LLVM, then by node's Turbofan JIT compiler. The...
Trail of Bits describes implementing an #[optimize(never)] attribute in rustc that emits LLVM's optnone and noinline attributes, preventing the optimizer from touching a function such as a branch-free conditional_select. The post shows this works at...
Trail of Bits released Maat, a cross-architecture symbolic execution framework built on Ghidra's p-code intermediate representation, with both C++ and Python APIs. The tool offers dynamic symbolic execution, taint analysis, binary instrumentation, and...
A Trail of Bits intern used GHC's Haskell profiler to find and fix two performance problems in the Echidna smart contract fuzzer, making it over six times faster. Memoizing the getBytecodeMetadata function, which was being recalculated on the same small...
A Trail of Bits post describes a Georgia Tech study that analyzed over 1,000 variants of 20 programs compiled with GCC and clang and found that compiler optimizations increased gadget set size, utility, or composability in approximately 85% of cases. The...
Trail of Bits publicly disclosed critical vulnerabilities, dubbed Frozen Heart, that break the soundness of multiple zero-knowledge proof implementations including PlonK and Bulletproofs by exploiting insecure Fiat-Shamir transformations that let malicious...
Trail of Bits detailed how a Frozen Heart vulnerability in ZenGo's implementation of Girault's proof of knowledge, before it was patched, let a malicious prover forge proofs for random h values because the Fiat-Shamir hash covered g, N, and u but omitted...
Trail of Bits disclosed a class of vulnerability it calls Frozen Heart, caused by insecure Fiat-Shamir implementations that let malicious users forge proofs for random statements, and in this post demonstrates an exploit against Bulletproofs. The flaw...
Trail of Bits disclosed a class of vulnerability it calls Frozen Heart, caused by insecure implementations of the Fiat-Shamir transformation that let malicious users forge proofs for random statements. This installment shows how the flaw works in PlonK,...
Trail of Bits has open-sourced Amarna, a static analyzer and linter for the Cairo programming language, which powers exchanges holding millions of dollars in assets such as dYdX and StarkNet contracts. The tool ships with 10 rules, exports results to SARIF...
During a winternship at Trail of Bits, Christian Presa Schnell used findings from recent Go audits to make several improvements to go-fuzz, a coverage-based fuzzer for projects written in Go. The work focused on three enhancements aimed at improving the...
A Trail of Bits winternship project made three improvements to go-fuzz, the coverage-based fuzzer for Go: fixing a crash tied to Go 1.16's change of os.FileMode into a type alias for fs.FileMode, adding AFL/libFuzzer-format dictionary support via a -dict...
At Real World Crypto 2022 in Amsterdam, over 500 cryptographers met in person for the first time in over two years, and presenters detailed two critical weaknesses in Samsung's TEEGRIS TrustZone OS: an IV reuse attack that extracts hardware-protected keys...
Trail of Bits released rellic-xref, a web interface for the Rellic decompiler that shows an uploaded LLVM module and its decompiled C source side by side, highlighting the instructions behind each piece of generated code when the user hovers over it. The...