Trail of Bits
@trailofbits
Followers
34K
Following
335
Media
418
Statuses
4K
We help secure the world’s most targeted organizations and products. We combine security research with an attacker mentality to reduce risk and fortify code.
New York, NY
Joined March 2010
We won second place in @DARPA's AI Cyber Challenge. Plus, GitHub Copilot prompt injections, NVIDIA Triton vulnerability disclosure, and multi-agent system hijacking demos. Read our AI-packed Tribune:
1
9
73
When these systems auto-downscale images, the hidden prompts emerge from previously invisible pixel patterns.
blog.trailofbits.com
In this blog post, we’ll detail how attackers can exploit image scaling on Gemini CLI, Vertex AI Studio, Gemini’s web and API interfaces, Google Assistant, Genspark, and other production AI systems....
1
5
34
We hacked Gemini CLI, Vertex AI, Assistant, and other AI systems by embedding prompts into images that are not visible to users.
5
45
200
We traced 11 years of exploit evolution: from Hailey Somerville's 2013 bug report to Luke Jahnke's latest 2024 Ruby 3.4 gadget chains. Each researcher builds on the last, but the fundamental flaw remains unfixed.
blog.trailofbits.com
This post traces the decade-long evolution of Ruby Marshal deserialization exploits, demonstrating how security researchers have repeatedly bypassed patches and why fundamental changes to the Ruby...
0
4
9
Ruby's Marshal deserialization exploits: a fundamental issue dating back over a decade. Learn the history and where we go from here 🧵
1
10
36
@dguido @ClickHereShow Use our open-source scripts to block Zoom's remote access feature system-wide and prevent ELUSIVE COMET attacks:.
blog.trailofbits.com
This post describes a sophisticated social engineering campaign using Zoom’s remote control feature and provides technical solutions to protect organizations against this attack vector.
0
1
2
Hackers use Zoom calls to target professionals, hunting for crypto wallets. @dguido breaks down ELUSIVE COMET's social engineering on @ClickHereShow.
2
3
9
RT @helpnetsecurity: Buttercup: Open-source AI-driven system detects and patches vulnerabilities - - @trailofbits @….
0
2
0
RT @exploitsclub: We hope everyone is recovering from there 4 day hangover. Here is a new EC to get you through the week 👇. Blind OOB Read….
blog.exploits.club
We hope everyone enjoyed drinking and partying as a business expense Hacker Summer Camp. Annnnnyways 👇 In Case You Missed It... * Black Hat Slides Out! - Most of the links now have the associated...
0
5
0
@Gemini Building secure wallet infrastructure? We've reviewed systems for Kraken, Uniswap, Phantom, WalletConnect, and others with unique expertise across blockchain protocols, cryptographic implementations, and application security.
trailofbits.com
Trail of Bits helps secure some of the world's most targeted organizations and products.
0
0
4
@Gemini Key recommendations for wallet teams: implement comprehensive integration testing beyond unit tests, eliminate single points of failure in access controls, and ensure complete transaction transparency in user interfaces.
1
0
1
@Gemini We identified 3 high-severity wallet vulnerabilities, plus 6 additional lower-severity issues.
github.com
Publications from Trail of Bits. Contribute to trailofbits/publications development by creating an account on GitHub.
1
0
1
As part of the @Gemini Wallet ecosystem, we conducted a security review of the newly launched Gemini Wallet 🧵
1
1
12
RT @IceSolst: Starting to think that implementing your own cyber reasoning system should be a mandatory final year project for CS/security….
0
12
0
RT @richinseattle: I’ve looked through the AIxCC repos. If you are going to get started and try to adapt for your use, I suggest looking at….
0
21
0
@SecWeekly He proved this approach by finding remote code execution in the ZBar barcode library. Read our technical breakdown:
blog.trailofbits.com
Fuzzing—one of the most successful techniques for finding security bugs, consistently featured in articles and industry conferences—has become so popular that you may think most important software...
0
1
2
@SecWeekly His methodology: systematically check repos, issues, and oss-fuzz to identify software with no public fuzzing traces. "If there's no traces on the internet of it being fuzzed, there's probably bugs.".
1
0
2
Principal AppSec engineer, Artur Cygan, explains why fuzzing has become one of the most successful automated security tools on @SecWeekly #336.
1
1
13
RT @IceSolst: There are so many interesting ideas in this (severely underrated) blog post by the genius @suhackerr.Covers different techniq….
0
3
0