For the last year, a 9-person team from has deeply studied the security of blockchains for . Today, our analysis and tools are public:
blog.trailofbits.com/2022/06/21/are
Follow
Trail of Bits
@trailofbits
We help secure the world’s most targeted organizations and products. We combine security research with an attacker mentality to reduce risk and fortify code.
Trail of Bits’s posts
Today, we are releasing RPC Investigator, made for exploring RPC clients and servers on Windows. This .NET application builds on the NtApiDotNet platform, adding features that offer a new way to explore RPC
Your code might be vulnerable! Our cryptography team has discovered a number of Fiat-Shamir vulnerabilities affecting proof systems such as Bulletproofs and PlonK. Check out this blog series for details and contact us if you think your codebase might be… blog.trailofbits.com/2022/04/13/par
Microsoft didn’t sandbox Windows Defender, so I did blog.trailofbits.com/2017/08/02/mic
GIF
We’re thrilled to announce our new Testing Handbook, which gathers insights we gained over years of experience using static and dynamic analysis tools. It goes beyond standard documentation, focusing on giving the right answers rather than all the answers.
Check out our _accessible_ Meltdown and Spectre explainer, made for developers without a background in computer architecture. No awkward analogies, we stick to the real details. blog.trailofbits.com/2018/01/30/an-
Earlier this year, one of our interns found a vulnerability that affects applications using the SQLite library API. We are publicly disclosing that vuln today.
It's easy to find bugs when you know how to build the right tools. Check out our blog to learn how to model vulnerabilities with Binary Ninja's MLIL and SSA form. blog.trailofbits.com/2018/04/04/vul
How to instantly exploit 2000 binaries with Binary Ninja blog.trailofbits.com/2016/06/03/200
We fuzzed modern Linux distributions with 30 year old fuzzers and you won't believe what happened next!
We've just released DeepState, a Google Test-like framework that lets you symbolically execute your C/C++ unit tests. github.com/trailofbits/de #NDSS18 #BAR18
We've just released secure-contracts.com, a revamp of our guide to building secure contracts! It contains security guidelines, best practices, tool tutorials, and many other resources.
Breaking Aave Upgradeability
Over the years, we have accumulated advanced knowledge and guidance for writing better smart contracts. We are sharing this knowledge in the first release of building-secure-contracts:
github.com/crytic/buildin
Check out the repo to learn about best practices and tooling!
Today we released Echidna, our next generation EVM smart fuzzer at #EthCC. It's the first-ever fuzzer to target smart contracts! blog.trailofbits.com/2018/03/09/ech
Destroying x86_64 instruction decoders with differential fuzzing blog.trailofbits.com/2019/10/31/des
Meet Algo, the VPN that works
Our software engineer Boyan Milanov introduces Maat, a low-level symbolic execution framework based on Ghidra's IR language p-code.
Who knew that a joke about "curl AAAAAAAAAA..." could uncover memory corruption bugs in libcurl?!
As smart contract security evolves, property-based fuzzing has become a go-to technique for developers and security engineers. To help the community define properties, we are releasing a set of 168 pre-built properties that can be used to guide Echidna.
Reverse engineer 200 binaries with the mechanical efficiency of symbolic execution blog.trailofbits.com/2017/05/15/mag
We found critical flaws in common TSS libraries, a cryptographic protocol for distributed key generation and signing. We’ve released ZKDocs.com to help secure the rapidly advancing field of ZKPs, TSS, and similar schemes. blog.trailofbits.com/2021/12/21/dis
Process reparenting is a Windows technique used by malicious actors, but it can also be a benign, legitimate event. has insights on how to investigate this behavior
Understanding Docker container escapes
Devirtualizing C++ with Binary Ninja blog.trailofbits.com/2017/02/13/dev
A new release of Slither is available, which now uses OpenAI's Codex to auto-generate solidity documentation and leverages GPT-3 to find vulnerabilities.
During research that led to our discovery of a vuln in SQLite, we found something we call "divergent representations." Once we started looking for them, we found them everywhere
DEF CON CTF needed an extra _bit_ of work this year. Here's how we handled the cLEMENCy architecture:
We published a technical summary of the "AMD Flaws" so they can be of use to the security community without the distraction of the surrounding disclosure issues. blog.trailofbits.com/2018/03/15/amd
Protecting Software Against Exploitation with DARPA’s CFAR blog.trailofbits.com/2018/09/10/pro
Let’s build a high-performance fuzzer with GPUs!
There's a dark side to compiler optimizations that can inadvertently cause information leaks or remove code critical to security. Read about the research being done to mitigate this risk and reduce the exposure to code-reuse attacks in software. blog.trailofbits.com/2022/03/25/tow
Amarna, our new static analyzer for the Cairo programming language and StarkNet contracts, is here! Try it out and let us know what you think
Data from and proves that bug bounties only benefit a small elite group. Is this model meeting researchers' interests? Read our review of "New Solutions for Cybersecurity" by .
Today's release of our Echidna smart contract fuzzer is more than 20x faster, thanks to multicore support and optimized coverage collection.
github.com/crytic/echidna
The #RektTest is a simple way for blockchain teams to assess their security posture. Created by top security experts, it includes 12 key questions.
Can you pass the Rekt Test?
Why should you care about the security of VSCode extensions? How does compromising a local machine, stealing all local files from that machine, or even swiping your SSH keys sound?
Trail of Bits has launched a podcast! The first five-episode season is now available on all major podcast outlets.
Is your centralized exchange, bridge, or L2 client using block delays to determine transaction finality? If so, it may be vulnerable to re-orgs, double-spend attacks, and stolen funds. Our new guide to blockchain finality helps you avoid these attacks.
We have a working proof-of-concept exploit for ‘Whose Curve is it Anyway?’ — NSA’s bug in Microsoft’s Crypto API.
Read on for our explainer:
blog.trailofbits.com/2020/01/16/exp
Reinventing Vulnerability Disclosure using Zero-knowledge Proofs
Our Full Report on the Voatz Mobile Voting Platform
Codex (and GPT-4) can’t beat humans on smart contract audits
Upgrading smart contracts can introduce new bugs, risking millions of dollars. We've developed Diffusc, a differential fuzzer that compares two smart contracts to uncover unexpected differences in behavior before an upgrade is deployed.
We’ve built many high-impact tools that we use for security reviews. But mastering them can take time. So we're bringing the mastery to you: we're going to be livestreaming tool workshops on our Twitch and YouTube channels!
Manticore now has a GUI that works with Binary Ninja! Our intern, , explains how his summer project made symbolic execution easier to use and more intuitive.
Trail of Bits donates $100,000 to support young researchers through blog.trailofbits.com/2018/06/29/tra
Our stellar winter intern built our newest open-source tool named Honeybee. It speeds up the Intel Processor Trace and uses it for fast coverage-guided fuzzing.
Reverse Taint Analysis Using Binary Ninja blog.trailofbits.com/2019/08/29/rev
Magnifier is a UI that helps reverse engineers explore decompiled programs interactively without all the manual note-taking. Read about this excellent work from our intern, !
Breaking Down Binary Ninja’s Low Level IL blog.trailofbits.com/2017/01/31/bre
An accessible overview of Meltdown and Spectre, Part 2 blog.trailofbits.com/2018/03/22/an-
Rewriting Functions in Compiled Binaries blog.trailofbits.com/2019/09/02/rew
Manticore will soon integrate Symbolic Execution into Binary Ninja! Follow along on the BinjaIL branch here: github.com/trailofbits/ma
Let’s talk about CFI: Microsoft Edition blog.trailofbits.com/2016/12/27/let
We are now accepting applicants for our summer internship program! We will be hiring approximately 10-15 interns across our research, engineering, and assurance practices
Verifying Windows binaries, without Windows
Clang isn't a toolsmith's compiler. PASTA tries to fix this by providing safe-to-use C++ and Python wrappers to the Clang AST. PASTA also answers questions that Clang can't, like how parsed tokens relate back to macro expansions and files. Learn more:
Tracking a stolen code-signing certificate with osquery blog.trailofbits.com/2017/10/10/tra
Intern Francesco Bertolaccini developed rellic-headergen, a utility that creates C declarations from debug information in LLVM bitcode produced by Clang from C, C++, or Objective-C. Now you can easily “C” your data structures! blog.trailofbits.com/2022/01/19/c-y
Today we're releasing Caracal, our new static analysis tool for Starknet smart contracts. It has 10 detectors that detect reentrancies and other vulnerabilities, two printers, and more!
With Echidna 2.1.0 and later, you can retrieve on-chain data to fuzz deployed contracts and test how new code integrates with existing contracts. You can also use it to recreate real-world hacks!
Trail of Bits is announcing a new practice focused on machine learning and artificial intelligence! We’re bringing together safety and security to create a new risk assessment and assurance program
Effortless security feature detection with Winchecksec blog.trailofbits.com/2018/09/26/eff
What does your code use, and is it vulnerable? It-depends! Our new tool, It-Depends, can automatically build a dependency graph and software bill of materials (SBOM) for arbitrary code, even C and C++, and alert you to any upstream vulnerabilities.
Hello, world! We now have a team solely dedicated to Windows.
Binary symbolic execution with KLEE-Native blog.trailofbits.com/2019/08/30/bin
The naive approach to searching for patterns in source code is to use regular expressions, but that has limitations. Our intern prototyped an internal tool that does searching on Clang ASTs to avoid these limitations blog.trailofbits.com/2022/12/22/syn
McSema now has an open-source Dyninst frontend that compares competitively with IDA Pro. Check out this amazing thesis by Lukáš Korenčik to see how all the parts fit together. is.muni.cz/th/pxe1j?lang=
Real-time file monitoring on Windows with osquery blog.trailofbits.com/2020/03/16/rea
Mozilla paid us to audit zlib with the 400lb hacking robot in our basement. What it found will shock you!
How to Spot Good Fuzzing Research
The Problem with Dynamic Program Analysis blog.trailofbits.com/2016/03/09/the
Harnessing the eBPF Verifier
What we learned when we reverse-engineered libmagic and its domain-specific language. Things got a little weird!
A Guide to Post-Quantum Cryptography blog.trailofbits.com/2018/10/22/a-g
We fuzzed the Solidity compiler for an entire year! Read about the lessons we learned along the way. We'll highlight 5 interesting bugs that were uncovered in this thread.
While Echidna is a great smart contract fuzzer, we are always improving our tools. With Hybrid Echidna, we can find even more bugs
Ian Beer is about to make iOS security research much easier
Replying to
Our report is dense and technical, so we summarized its key findings in a 20-minute podcast in plain language.
We believe it's crucial that a wider audience understand the risks of blockchain technology. Listen now:
We ate our own dogfood and tried control flow integrity on osquery + strongSwan blog.trailofbits.com/2017/02/20/the
We completed a security review of ’s Safetensors, a new format for storing tensors, on behalf of , , and . We identified 3 issues of medium severity and provided mitigation recommendations.
github.com/trailofbits/pu
Performing Concolic Execution on Cryptographic Primitives blog.trailofbits.com/2019/04/01/per
Collect NTFS forensic information with osquery blog.trailofbits.com/2018/05/28/col
Thanks to a generous grant from , we are working to bring full support for #Vyper to Slither and Echidna. Follow along on the PRs here:
github.com/crytic/slither
github.com/crytic/echidna
Quote
But we don't want the echidna to be jealous:
github.com/crytic/echidna
Excited to have several of our engineers this week! Among them will be , who gives us an intro to Windows Notification Facility's (WNF) Code Integrity features in our latest blog post.
blog.trailofbits.com/2023/05/16/int
The RBPF JIT compiler plays a critical role on the Solana blockchain. But the mode only works on x86 hosts. Our intern Andrew Haberlandt added support for ARM64 during his internship
Attacking Go: VR TTPs
Due to overwhelming demand, we made a tutorial to explore paths in binary programs using the Maat symbolic execution framework. Learn more by solving a new reverse-engineering challenge with Maat's snapshot and serialization features. maat.re/tutorials/expl
Introducing iVerify, the security toolkit for iPhone users blog.trailofbits.com/2019/11/14/int
Echidna 2.0.5 is out - we can prank now! (spoof message senders)
Replying to
Studying these risks required the development of new tools. Two of these are now open-source:
- It-Depends maps supply chain risks of C++ codebases: github.com/trailofbits/it
- Fluxture maps geographic and topological information of blockchains:
