Trail of Bits Blog

While likely expensive, when I looked around awhile back, Trail of Bits [1] to me seemed to produce the best audits for cryptographic systems, though possible there are better/cheaper options. [1] https://www.trailofbits.com/

Sure. Best auditor is https://openzeppelin.com/security-audits/. Second might be https://www.trailofbits.com. Here's the audit that just finished: https://github.com/OriginProtocol/security/blob/master/audits/OpenZepp…

I would highly recommend anyone interested in pentesting smart contracts look at the work Trail of Bits has been putting out: https://blog.trailofbits.com/?s=smart+contract&submit=Search Start with "246 Findings From our Smart Contract Audits: An Executive Summary" [1] [1] https://blog.trailofbits.com/2019/08/08/246-findings-from-our-smart-co…

"Cybersecurity research" is a very large domain, so it's hard to offer a wholly encompassing answer here! The company I work for[1] does a great deal of program analysis research, primarily in and around the LLVM ecosystem. Other companies/groups in our domain(s) include Galois, Inria, and GrammaTech. In terms of working in our domain: we frequently find it difficult to hire for pre-existing compilers or program analysis skills (it's a small community!), so we generally long for strong engineers with security/low-level fundamentals who don't mind making a pivot. As for how the job is: I personally find it very fulfilling, but it definitely contains a degree of uncertainty (particularly when doing government-funded research) that ordinary SWEs/SREs may not be used to. I've noticed that it takes new hires a decent amount of time to acclimate and become comfortable with the idea of research engineering, meaning engineering where we expect less than 100% of all exploratory avenues to have productive outcomes. This can be a large culture shock compared to typical engineering, where tasking is defined primarily by business requirements that don't contain a large degree of uncertainty or ambiguity in terms of implementation approach. [1]: https://www.trailofbits.com/

This is an interesting approach to problem solving that I'm surprised an LLM would help with. There is also a followup [0] releasing this tool as a Claude plugin (I haven't tried it myself). I'm much less interested in the application (DeFi) than in the possibility that we could use tools like this to eliminate common classes of bugs like dimensionality errors. [0] - https://blog.trailofbits.com/2026/03/25/try-our-new-dimensional-analys…

> If the agent works on the user's data on the user's behalf (ex: vibe coding), then I don't consider jailbreaking to be a big problem. It could help write malware or things like that, but then again, it is not as if script kiddies couldn't work without AI. Tricking it into writing malware isn't the big problem that I see. It's things like prompt injections from fetching external URLs, it's going to be a major route for RCE attacks. https://blog.trailofbits.com/2025/10/22/prompt-injection-to-rce-in-ai-… There's plenty of things we should be doing to help mitigate these threats, but not all companies follow best practices when it comes to technology and security...

Trail of Bits does this kind of work (https://www.trailofbits.com)! Tbh there is a much larger market for application of existing technology (e.g., pentests) than development of new technology (e.g., DARPA programs and the 1% of tech firms that need something new). There are a handful of others, but the market doesn't support dozens of other firms like Trail of Bits. There is some innovation that happens in Series A and B security startups but IMHO that quickly gives way to pressures of building an enterprise sales team.

It solves the scalability issues of current generation key distribution algorithms. In my opinion the best article about it is: https://blog.trailofbits.com/2019/08/06/better-encrypted-group-chat

Kind of off-topic, but why doesn't their site https://trailofbits.com/ have their certificate configured correctly? I know that their main site is https://www.trailofbits.com but I didn't expect their other record to be configured incorrectly.

Cutter is "A Qt and C++ GUI for radare2". There are more alternatives to IDA Pro. Hopper Disassembler is one. Binary Ninja (binja) is another. Here is an independent review of Binary Ninja: https://www.trailofbits.com/research-and-development/binja/ Here is the project itself: https://binary.ninja/ I happen to know most of the people involved in Binary Ninja. They do great work. They really understand security and the need to operate off-line. BTW, if disassembly is a career interest for you, see https://news.ycombinator.com/item?id=17208556 for my "Ask HN: Who is hiring? (June 2018)" comment.

Excellent reading about why you should consider Algo, the ideas behind it, and why commercial VPNs don't do what you hope: https://blog.trailofbits.com/2016/12/12/meet-algo-the-vpn-that-works/ Note that Algo is designed by security professionals, is recommended by some you may have heard of FWIW (grugq, Kenn White, more), and is careful about what it claims to do: * "Does not claim to provide anonymity or censorship avoidance" * "Does not claim to protect you from the FSB, MSS, DGSE, or FSM"

A few requests/suggestions for similar guides and comparisons: * As mentioned by codelitt, a guide for securing Android phones and recommended Android devices, especially at lower price points. * Thoughts on Windows vs Linux vs MacOS from a security perspective. * For people who are only comfortable using Windows, recommendations to lock down devices. * (Already existing) Don't use commercial VPNs. Use Algo https://blog.trailofbits.com/2016/12/12/meet-algo-the-vpn-that-works/ * Explain the Tor browser situation and why it's a bad idea to use the Tor browser bundle. * Recommendations for anonymity from an opsec POV. * Recommendations on how to cross borders with minimal privacy intrusions. There's lots of bs advice floating around. If there are existing posts about any of the above, please link them in a comment below.

It depends on what you are looking to achieve. If you take a look to e.g. McSema https://github.com/trailofbits/mcsema, these guys have been able to use LLVM to transform assembly back to LLVM intermediate representation (IR). The IR is an abstract language used by LLVM during compilation to optimize the generated code. Being abstract basically allows to use optimizers across all LLVM supported architectures. In these terms, I think LLVM has a clear advantage over competitors. The following blog post give a nice overview of the McSema achievements: http://blog.trailofbits.com/2014/06/23/a-preview-of-mcsema/

The attack that the FBI is trying to facilitate by getting Apple to make a custom OS would only work up to the iPhone 5C and earlier models. Any iPhone with the TouchID and Secure Enclave would not be susceptible to this attack (it may be to other attacks). The Secure Enclave has a hardware enforced back-off delay that would stop the brute force attack. The older iPhone 5C does not have the Secure Enclave so the brute-force protection is implemented in the operating system. As such, Apple can load a new OS on the phone that does not have those protections. Here is a great technical rundown: https://blog.trailofbits.com/2016/02/17/apple-can-comply-with-the-fbi-…

This article answers most technical questions and goes into great details http://blog.trailofbits.com/2016/02/17/apple-can-comply-with-the-fbi-c…

Sorry, but no. Compensation is highly relevant. Do you work for free? Or do you just not consider security research to be worth anything? Although there are various opinions on the best way to disclose bugs, your view of what it means to be "whitehat/legitimate" is not actually consistent with the infosec industry, so please do not misuse the terms to throw judgments at others. We can easily spin it the other way too after all - one could say that the largest, most profitable company in the world has a moral obligation to compensate those that are protecting their users where they failed to. For reference: http://www.digitalbond.com/about-us/vulnerability-disclosure-policy/ http://erratasec.blogspot.com/2011/09/finally-responsible-disclosure-p… http://www.securityfocus.com/brief/933 http://trailofbits.com/2009/03/22/no-more-free-bugs/

This is an anonymous blog, and the author conceals their identity, which is already an issue for me. Let's look at the alternatives to PGP that the blog recommends, I will paraphrase: 1) Sign software with sigstore.dev The issue here is that you delegate trust to places like GitHub or other OIDC providers. You also have to trust Fulcio and their CAs. <https://docs.sigstore.dev/about/security/> for details. Maybe you don't want to do that, in part because you're not guaranteed that the service will remain free, or perhaps you're more serious about security than GitHub. 1-alt) Sign software with minisign. Maybe I don't want to use Ed25519. Maybe I want to revoke the signatures. There's many issues one may have with minisign. 2) Signing git tags/commits Advises to use SSH, no explanation why. Advises Ed25519, why not Ed448? The explanation to not use RSA is by linking to <https://blog.trailofbits.com/2019/07/08/fuck-rsa/>. I will only quote one thing from this article: >RSA was an important milestone in the development of secure communications, but the last two decades of cryptographic research have rendered it obsolete. You can't say it is obsolete when it is still in use. I'm not sure what the author(s) mean by "obsolete", but it is not true that RSA is obsolete. (If Ed25519 breaks but RSA doesn't, who will be obsolete?) 3) Sending files between computers Here it recommends Magic Wormhole. That's shocking to me, I don't understand why it is recommended. Why not…

Usually good consulting companies would hire former SWE that wants to switch to security. During interviews, basic security questions are asked, most are covered under security+ certification. But companies might skip asking them and instead ask SWE code related security questions instead. Such as how to prevent OWASP top 10 vulnerabilities. Most of the major ones are covered here https://cheatsheetseries.owasp.org/Glossary.html Code review job would involve running commercial tool such as checkmarx or fortify and then reporting on issues that tool finds. For web application testing these two sites are a good start. https://portswigger.net/training and https://www.pentesterlab.com/pro Most web app testing is performed using this guide https://owasp.org/www-project-web-security-testing-guide/ Hands on is the best way to learn web app testing. Companies give you 24-48 hours to test vulnerable web app. After you send them report with findings if they like they have final interview round. Some of the better companies are ncc group, bishop fox, nettitude, google certified security companies and others. You can find them as sponsors on security meetups like bsides. Some of the more technical ones are https://cure53.de/#publications. You can read their reports. Also https://www.trailofbits.com/ As for pay it’s decent but the ceiling is lower than SWE. Entry level positions usually make below 100, senior low 100, manager mid 100 and more senior positions are around 200. After…

Guaranteed termination isn't the only analysis worth having, especially since if your aim is termination (as opposed to leveraging that simplicity for other analysis) it's much easier to simply impose termination and be done with it. So, WASM isn't entirely unconstrained, and those constraints do allow some interesting analyses that true native code cannot support, e.g. symbolic execution: https://blog.trailofbits.com/2020/01/31/symbolically-executing-webasse… By it's very design it's aimed at running untrusted, even malicious code without exposing the host to security risks, while allowing the imposition of resource constraints. It doesn't sound completely absurd to me (not an expert in this) that some project might seek to use those safety guarantees as a way to avoid paying for the more heavyweight guarantees provided by the kernelspace/userspace split. A quick google find lots of people trying to get this to work; who knows - it might pay off.

I was talking about commercial, third party services. Roll your own can work better. Tor might be the best option, depending on your adversary: As I understand these things, it works well against corporate tracking and against getting swept up in government mass surveillance; but if you have something in particular to hide from an oppressive government, it may attract attention. Using commercial VPN services, all you do is shift your Internet gateway from your ISP to your VPN service provider; it's not clear which one is better. They also are honeypots: All someone needs to do is compromise the VPN provider and they have everyone's confidential data. Many VPN providers (almost all of whom, I'd guess) have poor security practices - security is expensive; consider how much security your monthly fee buys. It's just a juicy, high-ROI target. The creator of Algo, an automated roll-your-own VPN, knows much more more than I do; this is worth reading IMHO: https://blog.trailofbits.com/2016/12/12/meet-algo-the-vpn-that-works/ All that said, I think you do have a point. I'd try Tor, though.

I don't know what "(at best) research level stuff" means. Here's a well-regarded LLVM lifter by a very well-regarded vuln research team that's open source: https://blog.trailofbits.com/2014/08/07/mcsema-is-officially-open-sour… There are a bunch of other lifters, not all of them to LLVM. Already, with the idea of IR lifting, we're at a point where we're no longer talking about reading assembly but rather a higher-level language. But this leaves out tooling that can analyze IR (or, for that matter, assembly control flow blocks). Someone upthread stridently declared that analyzing one version of a binary in isolation was hard enough, but that the work of looking at every version was "staggering", "capital-h Hard". But that problem is in some ways easier than basic reverse engineering, which is why security product companies and malware research teams have teams of people using BinDiff-like tools to do it. "BinDiff" is a deceptive name; "Bin" refers to compiled binaries, because the tools work based on graph comparisons of program CFGs. Part of the problem I have talking about this stuff is that this isn't really my area of expertise --- not in the sense that I can't reverse a binary or use a BinDiffing tool, because most software security people can, myself included, but in the sense that I'm describing the state of the art as of, like, 6 years ago. I'm sure the tooling I'm describing is embarrassing compared to what our field has now. Open vs. closed source is an…

That's a good point that I was assuming it would be difficult. I've since done a little bit of reading up on what we know about how difficult it would be. This is the best writeup I found: http://blog.trailofbits.com/2016/02/17/apple-can-comply-with-the-fbi-c… So, you'd need an update to iOS/the phone firmware, and for newer devices you'd also need an update to the secure enclave firmware. You can't do anything about the 80ms delay, because that's baked into the hashing function (and changing the hashing function would generate invalid results). The FBI is also asking for the ability to enter passcodes electronically rather than via the touchscreen, which would be new code. If iOS and the SE firmware are really nicely factored to disable security, and it's not hard to add the new functionality, then this might not be too much work. However I doubt that that is going to be the case. The whole point of the security system is to make it difficult to crack, so there might be other countermeasures involved, tricky dependencies, and low-level hardware hackery. If it were simple to do, why wouldn't it have already been done by others reverse-engineering the compiled code? There is certainly financial motivation to do so.

Maybe you just enjoy hyperbole but while part of what you say is correct (finding security vulns in software is unavoidably a bit of a crapshoot) your conclusions are wrong. Finding deep, serious vulns like this in software can currently only be done by human beings. Tools are better at being authoritative but can only find vulns of a given type. For example static analysis is a great fit for any vuln that boils down to a dataflow problem, user controlled source -> ... -> dangerous sink. XSS, sql injection, etc fit this model. Fuzzers are great at finding bugs in parsers (and there are a surprising amount of parsers in the world, 90% of which should never have been written). Instrumented dynamic analysis can do awesome work for memory issues. I explain all this to show there are areas where tools are fantastic for their area. But there are many areas for which tools cannot help at all, heartbleed was one of these areas. The best security tools available were (presumably) run across openssl before and (certainly) with increased scrutiny after heartbleed. None of them found it. Simple limitations in static analysis lead me to believe they would never have found it on their own (most static analysis tools stop at 5 levels of indirection) Some background: 1. http://blog.trailofbits.com/2014/04/27/using-static-analysis-and-clang… 2. http://security.coverity.com/blog/2014/Apr/on-detecting-heartbleed-wit… 3.…

I wrote one of the referenced posts describing the history here: https://blog.trailofbits.com/2025/08/20/marshal-madness-a-brief-histor… I was also part of the team that audited RubyGems.org: https://github.com/trailofbits/publications/blob/master/reviews/2024-1… Look at TOB-RGM-9 (an informational, largely out-of-scope finding) if you want to understand what could be done to mitigate some of these concerns. Nearly all of these gadget chains rely on Gem library functionality, which has this wonky .gemspec.rz metadata file that sits alongside the actual gem file. I understand that it'd be a challenging, backwards-incompatible change, but moving this file from Marshal to JSON would break a lot of these gadget chains. Perhaps there would be others, but it would raise the bar.

neat, i'm a big fan of trail of bits but apparently missed this announcement. here's their post: https://blog.trailofbits.com/2026/06/22/introducing-patch-the-planet/ and a summary of week 1: https://gist.github.com/patch-the-planet/69fd1aa925c8e73edea9e6e967043…

After writing doing my experiments and writing the blog post I discovered that a proposal to introduce constant time primitives in Rust already exist[1]. However, if you wnat to understand why this is necessary, I reccomend to read it anyway! [1] https://blog.trailofbits.com/2025/12/02/introducing-constant-time-supp…

Top comment on LWN is a very interesting read (although neither the commenter nor myself claim any such trickery was involved in this case). > Trail of Bits were able to craft an input that beats Google's circuit and prove it... by virtue of a bug in the verifier: https://blog.trailofbits.com/2026/04/17/we-beat-googles-zero-knowledge… Google patched the vuln and the original proof still stands, but this is a pretty strange path we seem to be walking down [...]

> That doesn't mean there's a problem with the code, only with the documentation. I disagree. If the obvious way to use an API is the incorrect way, there is a problem with the code. If you must call A each time before calling B, drop A and have B do both things. If you must call A once before calling B, make A return a token that you then must pass to B to show you called A. As another example, look at https://blog.trailofbits.com/2026/02/18/carelessness-versus-craftsmans… (HN discussion: https://news.ycombinator.com/item?id=47060334): “Two popular AES libraries, aes-js and pyaes, “helpfully” provide a default IV in their AES-CTR API, leading to a large number of key/IV reuse bugs. These bugs potentially affect thousands of downstream projects.” Would you call that “poor code style that could theoretically lead to a bug in the future”, too?

Link to the blog for anyone else looking https://blog.trailofbits.com/2025/10/31/the-cryptography-behind-electr… https://news.ycombinator.com/item?id=45770875

Buttercup, from the Trail of Bits team has a nice writeup + FOSS : https://blog.trailofbits.com/2025/08/08/buttercup-is-now-open-source/