Trail of Bits
@trailofbits
Followers
35K
Following
404
Media
459
Statuses
4K
We help secure the world’s most targeted organizations and products. We combine security research with an attacker mentality to reduce risk and fortify code.
New York, NY
Joined March 2010
November Tribune: Security behind passports, RCE in AI agents, and post-quantum cryptography https://t.co/hHpNYeRMfb
1
5
16
Funded by @OpenSSF, we've made rekor-monitor production-ready with Rekor v2 support, certificate validation, and a GitHub Actions workflow that lowers the barrier to catching compromises. https://t.co/Ll3YjGI1PJ
blog.trailofbits.com
We’re getting Sigstore’s rekor-monitor ready for production use, making it easier for developers to detect tampering and unauthorized uses of their identities in the Rekor transparency log.
0
1
2
Monitor unauthorized uses of your identity in transparency logs with Sigstore's rekor-monitor🧵
2
4
7
Webinar starting in 2 hours: Building end-to-end encrypted systems with our cryptographers. Join us: https://t.co/auw1F8cp1I
0
2
19
Building a system with E2EE? Join our cryptographers tomorrow, December 9, at 11:00 a.m. ET for a webinar on implementation patterns and formal modeling approaches, followed by a Q&A session. https://t.co/auw1F8cp1I
0
2
12
@ekzhang1 The @trailofbits audit led by @tjade273 for Whatsapp Private Processing (which uses NVIDIA CC) is also an excellent read:
github.com
Publications from Trail of Bits. Contribute to trailofbits/publications development by creating an account on GitHub.
0
3
11
@BlackHatEvents @kiki_morozova Paul (@paulbottinelli) breaks down how to exploit QUIC hash functions and why existing mitigations fail. You'll learn concrete techniques to identify, test for, and defend against Hash DoS in QUIC and other performance-critical protocols. https://t.co/o4M627hACd
0
0
3
Can it really be a coincidence? Smart Investors Hold Gold. Find out more at Goldhub
59
158
2K
@BlackHatEvents Kikimora (@kiki_morozova) show attacks beyond AI image downscaling: sharpening transformations, dithering algorithms, and other preprocessing steps that leak malicious prompts. Walk away with how to use Anamorpher for testing your own AI systems. https://t.co/lOk7QS8F3A
1
0
3
Interesting short blog post on how electronic passports cryptography works https://t.co/W35PS40yW1 Credits Joop van de Pol (@trailofbits) #infosec #embedded
1
31
145
We’re thrilled to see Slither being used by Anthropic to augment their agentic smart contract research. If you’re interested in adding Slither to your LLM-based agents or workflows, check out our newly released slither-mcp: https://t.co/SEK4mJPHs9
New on our Frontier Red Team blog: We tested whether AIs can exploit blockchain smart contracts. In simulated testing, AI agents found $4.6M in exploits. The research (with @MATSprogram and the Anthropic Fellows program) also developed a new benchmark:
9
25
298
Trail of Bits cryptographers Marc Ilunga and Fredrik Dahlgren cover unique challenges of building E2EE systems. Dec 9 @ 11am ET. 45 mins + Q&A.
watch.getcontrast.io
Join cryptography analysts Marc Ilunga and Fredrik Dahlgren from Trail of Bits to understand the unique challenges of building systems with end-to-end encr...
0
1
1
Continuous group key agreement. Device enrollment and unenrollment. Message backup. Contact discovery. Abuse reporting. E2EE problems you need to solve. 🧵
1
2
17
The compiler translates __builtin_ct_select across multiple architectures (x86-64, i386, ARM, AArch64) to appropriate constant-time implementations using native instructions, such as cmov or CSEL, where available, or masked arithmetic patterns elsewhere.
blog.trailofbits.com
Trail of Bits developed constant-time coding support for LLVM that prevents compilers from breaking cryptographic implementations vulnerable to timing attacks, introducing the __builtin_ct_select...
0
3
7
LLVM will soon protect cryptographic code from timing attacks at the compiler level 🧵
2
9
73
Stuck on holiday gifts? Skip the stress. USDA Prime steaks delivered to their door = instant win. Get 8 FREE steak burgers + free shipping ($145 value) with your order. Watch →
3
10
81
We’re thrilled to see Slither being used by Anthropic to augment their agentic smart contract research. If you’re interested in adding Slither to your LLM-based agents or workflows, check out our newly released slither-mcp: https://t.co/SEK4mJPHs9
New on our Frontier Red Team blog: We tested whether AIs can exploit blockchain smart contracts. In simulated testing, AI agents found $4.6M in exploits. The research (with @MATSprogram and the Anthropic Fellows program) also developed a new benchmark:
9
25
298
The Trail of Bits Cryptography Team has released open-source pure Go implementations of ML-DSA (FIPS-204) and SLH-DSA (FIPS-205), 2 NIST-standardized Post-Quantum Signature Algorithms #PQC #Cryptography #Go
blog.trailofbits.com
We’ve released open-source Go implementations of ML-DSA and SLH-DSA.
0
5
15
Finally bit the bullet and spent some time refactoring Remill's build system. It got merged and you can now use Remill with LLVM 15-21 on Windows, Linux and macos 🔥 Using Remill in your projects has always been challenging in the past and I also published a small template you
2
13
83
🔐 We Found Cryptography Bugs in the Elliptic Library Using Wycheproof A blog post showing how “just” leveraging Wycheproof test vectors can lead directly to CVEs:
blog.trailofbits.com
Trail of Bits discovered and disclosed two vulnerabilities in the widely used elliptic JavaScript library that could allow signature forgery or prevent valid signature verification, with one vulner...
1
2
14
Trail of Bits Finds Vulnerabilities in Widely Used Cryptographic Library, One of Which Still Not Fixed Over a Year Later #News
privacyguides.org
Today, Trail of Bits, a well-respected security research and auditing firm, has released a blog post outlining two vulnerabilities in elliptic, a widely used JavaScript cryptographic library.
1
3
17