The Curious Engineer

All blogs / Security

The Trail of Bits Blog

blog.trailofbits.com

Since 2012, Trail of Bits has helped secure some of the world's most targeted organizations and products. We combine high-­end security research with a real­ world attacker mentality to reduce risk and fortify code.

SecurityTesting / QASoftware / engineering practice

’15’20’25
Posts
533 from 11 Jun 2012 to 27 Oct 2026
Posting
weekly (53 in the last year)
Kind
company blog
Feed
https://blog.trailofbits.com/index.xml

2026 42

  1. Backporting security fixes to stable releases
  2. Your AI agent fixed the bug, but what else did it change?
  3. Package managers have an integrity problem
  4. SequenceHash: multihashing for the rest of us
  5. Don't let TEEs break your MPC
  6. SAML: A fractal of bad design
  7. Auditing in the age of (good enough) AI
  8. 1Password's AI patching benchmark is misleading
  9. A “proof” of Fermat’s Last Theorem that fits the margin
  10. VMs won't contain cyber-capable agents
  11. State divergence enables unauthorized access
  12. How Trail of Bits helps verify the integrity of your Signal chats
  13. A few notes on AWS Nitro Enclaves: KMS integration
  14. Building secure Uniswap v4 hooks
  15. How we use /goal to find bugs in Patch the Planet
  16. Rust-proof your code with our new Testing Handbook chapter
  17. Mutation testing comes to DAML
  18. GPT-5.5-Cyber built a zlib fuzzing lab in a day
  19. Shipping post-quantum cryptography to Python
  20. Introducing Patch the Planet
  21. Factoring "short-sleeve" RSA keys with polynomials
  22. The sorry state of skill distribution
  23. Bringing full YAML anchor support to zizmor
  24. gosentry brings LibAFL-grade fuzzing to Go's native interface
  25. Escalating a Windows driver registry bug to a kernel write primitive
  26. Extending Ruzzy with LibAFL
  27. Trailmark turns code into graphs
  28. We beat Google’s zero-knowledge proof of quantum cryptanalysis
  29. Master C and C++ with our new Testing Handbook chapter
  30. What we learned about TEE security from auditing WhatsApp's Private Inference
  31. Simplifying MBA obfuscation with CoBRA
  32. Mutation testing for the agentic era
  33. How we made Trail of Bits AI-native (so far)
  34. Try our new dimensional analysis Claude plugin
  35. Spotting issues in DeFi with dimensional analysis
  36. Six mistakes in ERC-4337 smart accounts
  37. mquire: Linux memory forensics without external dependencies
  38. Using threat modeling and prompt injection to audit Comet
  39. Carelessness versus craftsmanship in cryptography
  40. Celebrating our 2025 open-source contributions
  41. Building cryptographic agility into Sigstore
  42. Lack of isolation in agentic browsers resurfaces old vulnerabilities

2025 69

  1. Detect Go’s silent arithmetic bugs with go-panikint
  2. Can chatbots craft correct code?
  3. Use GWP-ASan to detect exploits in production environments
  4. Catching malicious package releases using a transparency log
  5. Introducing mrva, a terminal-first approach to CodeQL multi-repo variant analysis
  6. Introducing constant-time support for LLVM to protect cryptographic code
  7. We found cryptography bugs in the elliptic library using Wycheproof
  8. Level up your Solidity LLM tooling with Slither-MCP
  9. How we avoided side-channels in our new post-quantum Go cryptography libraries
  10. Building checksec without boundaries with Checksec Anywhere
  11. Balancer hack analysis and guidance for the DeFi ecosystem
  12. The cryptography behind electronic passports
  13. Vulnerabilities in LUKS2 disk encryption for confidential VMs
  14. Prompt injection to RCE in AI agents
  15. Taming 2,500 compiler warnings with CodeQL, an OpenVPN2 case study
  16. Supply chain attacks are exploiting our assumptions
  17. Use mutation testing to find the bugs your tests don't catch
  18. Fickling’s new AI/ML pickle file scanner
  19. How Sui Move rethinks flash loan security
  20. Safer cold storage on Ethereum
  21. Subverting code integrity checks to locally backdoor Signal, 1Password, Slack, and more
  22. Intern projects that outlived the internship
  23. Implement EIP-7730 today
  24. Speedrunning the New York Subway
  25. Weaponizing image scaling against production AI systems
  26. Marshal madness: A brief history of Ruby deserialization exploits
  27. Trail of Bits' Buttercup wins 2nd place in AIxCC Challenge
  28. Buttercup is now open-source!
  29. AIxCC finals: Tale of the tape
  30. Prompt injection engineering for attackers: Exploiting GitHub Copilot
  31. Uncovering memory corruption in NVIDIA Triton (as a new hire)
  32. The Unconventional Innovator Scholarship
  33. Hijacking multi-agent systems in your PajaMAS
  34. We built the security layer MCP always needed
  35. Exploiting zero days in abandoned hardware
  36. Inside EthCC[8]: Becoming a smart contract auditor
  37. Detecting code copying at scale with Vendetect
  38. Building secure messaging is hard: A nuanced take on the Bitchat security debate
  39. Investigate your dependencies with Deptective
  40. Buckle up, Buttercup, AIxCC’s scored round is underway!
  41. Maturing your smart contracts beyond private key risk
  42. Unexpected security footguns in Go's parsers
  43. What we learned reviewing one of the first DKLs23 libraries from Silence Laboratories
  44. A deep dive into Axiom’s Halo2 circuits
  45. The Custodial Stablecoin Rekt Test
  46. The cryptography behind passkeys
  47. Datasig: Fingerprinting AI/ML datasets to stop data-borne attacks
  48. Making PyPI's test suite 81% faster
  49. Insecure credential storage plagues MCP
  50. Deceiving users with ANSI terminal codes in MCP
  51. How MCP servers can steal your conversation history
  52. Jumping the line: How MCP servers can attack you before you ever use them
  53. Kicking off AIxCC’s Finals with Buttercup
  54. Sneak peek: A new ASN.1 API for Python
  55. Mitigating ELUSIVE COMET Zoom remote control attacks
  56. Introducing a new section on snapshot fuzzing for kernel-level testing in the Testing Handbook
  57. Benchmarking OpenSearch and Elasticsearch
  58. Continuous TRAIL
  59. Threat modeling the TRAIL of Bits way
  60. How Threat Modeling Could Have Prevented the $1.5B Bybit Hack
  61. Don’t recurse on untrusted input
  62. The $1.5B Bybit Hack: The Era of Operational Security Failures Has Arrived
  63. Unleashing Medusa: Fast and scalable smart contract fuzzing
  64. We’re partnering to strengthen TON’s DeFi ecosystem
  65. The call for invariant-driven development
  66. Preventing account takeover on centralized cryptocurrency exchanges in 2025
  67. PyPI now supports archiving projects
  68. Best practices for key derivation
  69. Celebrating our 2024 open-source contributions

2024 79

  1. Auditing the Ruby ecosystem's central package repository
  2. 35 more Semgrep rules: infrastructure, supply chain, and Ruby
  3. Evaluating Solidity support in AI coding assistants
  4. Attestations: A new generation of signatures on PyPI
  5. Killing Filecoin nodes
  6. Fuzzing between the lines in popular barcode software
  7. A deep dive into Linux’s new mseal syscall
  8. Auditing Gradio 5, Hugging Face's ML GUI framework
  9. Securing the software supply chain with the SLSA framework
  10. A few notes on AWS Nitro Enclaves: Attack surface
  11. Announcing the Trail of Bits and Semgrep partnership
  12. Inside DEF CON: Michael Brown on how AI/ML is revolutionizing cybersecurity
  13. Friends don’t let friends reuse IVs
  14. Sanitize your C++ containers: ASan annotations step-by-step
  15. “Unstripping” binaries: Restoring debugging information in GDB with Pwndbg
  16. What would you do with that old GPU?
  17. Provisioning cloud infrastructure the wrong way, but faster
  18. “YOLO” is not a valid hash construction
  19. We wrote the code, and the code won
  20. Trail of Bits Advances to AIxCC Finals
  21. Trail of Bits’ Buttercup heads to DARPA’s AIxCC
  22. Cloud cryptography demystified: Google Cloud Platform
  23. Our audit of Homebrew
  24. Our crypto experts answer 10 key questions
  25. Announcing AES-GEM (AES with Galois Extended Mode)
  26. Trail of Bits named a leader in cybersecurity consulting services
  27. Auditing the Ask Astro LLM Q&A app
  28. Quantum is unimportant to post-quantum
  29. Disarming Fiat-Shamir footguns
  30. EuroLLVM 2024 trip report
  31. Themes from Real World Crypto 2024
  32. Finding mispriced opcodes with fuzzing
  33. Announcing the Burp Suite Professional chapter in the Testing Handbook
  34. PCC: Bold step forward, not without flaws
  35. Understanding Apple’s On-Device and Server Foundation Models release
  36. Exploiting ML models with pickle file attacks: Part 1
  37. Exploiting ML models with pickle file attacks: Part 2
  38. Announcing AI/ML safety and security trainings
  39. Understanding AddressSanitizer: Better memory safety for your code
  40. A peek into build provenance for Homebrew
  41. Using benchmarks to speed up Echidna
  42. The life and times of an Abstract Syntax Tree
  43. Curvance: Invariants unleashed
  44. Announcing two new LMS libraries
  45. 5 reasons to strive for better disclosure processes
  46. Introducing Ruzzy, a coverage-guided Ruby fuzzer
  47. Why fuzzing over formal verification?
  48. Streamline your static analysis triage with SARIF Explorer
  49. Read code like a pro with our weAudit VSCode extension
  50. Releasing the Attacknet: A new tool for finding bugs in blockchain nodes using chaos testing
  51. Secure your blockchain project from the start
  52. DARPA awards $1 million to Trail of Bits for AI Cyber Challenge
  53. Out of the kernel, into the tokens
  54. Cryptographic design review of Ockam
  55. Relishing new Fickling features for securing ML systems
  56. How we applied advanced fuzzing techniques to cURL
  57. When try, try, try again leads to out-of-order execution bugs
  58. Our response to the US Army’s RFI on developing AIBOM tools
  59. Circomspect has been integrated into the Sindri CLI
  60. Continuously fuzzing Python C extensions
  61. Breaking the shared key in threshold signature schemes
  62. A few notes on AWS Nitro Enclaves: Images and attestation
  63. Cloud cryptography demystified: Amazon Web Services
  64. Why Windows can’t follow WSL symlinks
  65. Master fuzzing with our new Testing Handbook chapter
  66. Binary type inference in Ghidra
  67. Improving the state of Cosmos fuzzing
  68. Chaos Communication Congress (37C3) recap
  69. Introducing DIFFER, a new tool for testing and validating transformed programs
  70. Enhancing trust for SGX enclaves
  71. We build X.509 chains so you don’t have to
  72. Celebrating our 2023 open-source contributions
  73. Our thoughts on AIxCC’s competition format
  74. 30 new Semgrep rules: Ansible, Java, Kotlin, shell scripts, and more
  75. LeftoverLocals: Listening to LLM responses through leaked GPU local memory
  76. Internet freedom with the Open Technology Fund
  77. How to introduce Semgrep to your organization
  78. Securing open-source infrastructure with OSTIF
  79. Tag, you’re it: Signal tagging in Circom

2023 57

  1. Billion times emptiness
  2. AI In Windows: Investigating Windows Copilot
  3. We’ve added more content to ZKDocs
  4. Catching OpenSSL misuse using CodeQL
  5. Summer interns 2023 recap
  6. A trail of flipping bits
  7. DARPA’s AI Cyber Challenge: We’re In!
  8. Say hello to the next chapter of the Testing Handbook!
  9. Publishing Trail of Bits’ CodeQL queries
  10. ETW internals for security research and forensics
  11. How CISA can improve OSS security
  12. Assessing the security posture of a widely used vision model: YOLOv7
  13. Our audit of PyPI
  14. Adding build provenance to Homebrew
  15. The issue with ATS in Apple’s macOS and iOS
  16. Numbers turned weapons: DoS in Osmosis’ math library
  17. Introducing invariant development as a service
  18. Pitfalls of relying on eBPF for security monitoring (and some solutions)
  19. Don’t overextend your Oblivious Transfer
  20. Security flaws in an SSO plugin for Caddy
  21. Holy Macroni! A recipe for progressive language enhancement
  22. Secure your Apollo GraphQL server with Semgrep
  23. iVerify is now an independent company!
  24. The Engineer’s Guide to Blockchain Finality
  25. Can you pass the Rekt test?
  26. Use our suite of eBPF libraries
  27. A mistake in the bulletproofs paper could have led to the theft of millions of dollars
  28. How AI will affect cybersecurity: What we told the CFTC
  29. The future of Clang-based tooling
  30. Announcing the Trail of Bits Testing Handbook
  31. Fuzzing on-chain contracts with Echidna
  32. Trail of Bits’s Response to OSTP National Priorities for AI RFI
  33. Evaluating blockchain security maturity
  34. What we told the CFTC about blockchain threats
  35. Differential fuzz testing upgradeable smart contracts with Diffusc
  36. Trail of Bits’s Response to NTIA AI Accountability RFC
  37. Finding bugs in C code with Multi-Level IR and VAST
  38. Trusted publishing: a new benchmark for packaging security
  39. Real World Crypto 2023 Recap
  40. Introducing Windows Notification Facility’s (WNF) Code Integrity
  41. What should governments consider when getting involved with blockchain?
  42. Typos that omit security features and how to test for them
  43. A Winter’s Tale: Improving messages and types in GDB’s Python API
  44. How to avoid the aCropalypse
  45. Codex (and GPT-4) can’t beat humans on smart contract audits
  46. Circomspect has more passes!
  47. We need a new way to measure AI security
  48. Reusable properties for Ethereum contracts
  49. Escaping well-configured VSCode extensions (for profit)
  50. Escaping misconfigured VSCode extensions
  51. Readline crime: exploiting a SUID logic bug
  52. cURL audit: How a joke led to significant findings
  53. Harnessing the eBPF Verifier
  54. Introducing RPC Investigator
  55. Announcing a stable release of sigstore-python
  56. Keeping the wolves out of wolfSSL
  57. Another prolific year of open-source contributions

2022 43

  1. Fast and accurate syntax searching for C and C++
  2. How to share what you’ve learned from our audits
  3. What child is this?
  4. How I gave ManticoreUI a makeover
  5. Manticore GUIs made easy
  6. Hybrid fuzzing: Sharpening the spikes of Echidna
  7. Specialized Zero-Knowledge Proof failures
  8. ABI compatibility in Python: How hard could it be?
  9. We’re streamers now
  10. Look out! Divergent representations are everywhere!
  11. We sign code now
  12. Stranger Strings: An exploitable flaw in SQLite
  13. Porting the Solana eBPF JIT compiler to ARM64
  14. Working on blockchains as a Trail of Bits intern
  15. Secure your machine learning with Semgrep
  16. It pays to be Circomspect
  17. Magnifier: An Experiment with Interactive Decompilation
  18. Using mutants to improve Slither
  19. The road to the apprenticeship
  20. Shedding smart contract storage with Slither
  21. libmagic: The Blathering
  22. A Typical Day as a Trail of Bits Engineer-Consultant
  23. The Trail of Bits Hiring Process
  24. Managing risk in blockchain deployments
  25. Are blockchains decentralized?
  26. Announcing the new Trail of Bits podcast
  27. Themes from PyCon US 2022
  28. Interactive decompilation with rellic-xref
  29. Themes from Real World Crypto 2022
  30. Improving the state of go-fuzz
  31. Amarna: Static analysis for Cairo programs
  32. The Frozen Heart vulnerability in PlonK
  33. The Frozen Heart vulnerability in Bulletproofs
  34. The Frozen Heart vulnerability in Girault’s proof of knowledge
  35. Coordinated disclosure of vulnerabilities affecting Girault, Bulletproofs, and PlonK
  36. Towards Practical Security Optimizations for Binaries
  37. Optimizing a smart contract fuzzer
  38. Maat: Symbolic execution made easy
  39. Part 2: Improving crypto code in Rust using LLVM’s optnone
  40. Part 1: The life of an optimization barrier
  41. C your data structures with rellic-headergen
  42. Finding unhandled errors using CodeQL
  43. Toward a Best-of-Both-Worlds Binary Disassembler

2021 20

  1. Celebrating our 2021 Open Source Contributions
  2. Disclosing Shamir’s Secret Sharing vulnerabilities and announcing ZKDocs
  3. Detecting MISO and Opyn’s msg.value reuse vulnerability with Slither
  4. What does your code use, and is it vulnerable? It-depends!
  5. MUI: Visualizing symbolic execution with Manticore and Binary Ninja
  6. How to choose an interesting project
  7. Motivating global stabilization
  8. Announcing osquery 5: Now with EndpointSecurity on macOS
  9. All your tracing are belong to BPF
  10. PrivacyRaven: Implementing a proof of concept for model inversion
  11. Write Rust lints without forking Clippy
  12. Discovering goroutine leaks with Semgrep
  13. Solar: Context-free, interactive analysis for Solidity
  14. A Year in the Life of a Compiler Fuzzing Campaign
  15. Un-bee-lievable Performance: Fast Coverage-guided Fuzzing with Honeybee and Intel Processor Trace
  16. Never a dill moment: Exploiting machine learning pickle files
  17. The Tao of Continuous Integration
  18. Serving up zero-knowledge proofs
  19. Confessions of a smart contract paper reviewer
  20. PDF is Broken: a justCTF Challenge

2020 37

  1. Breaking Aave Upgradeability
  2. Reverie: An optimized zero-knowledge proof system
  3. High-fidelity build instrumentation with blight
  4. Smart (and simple) ways to prevent symlink attacks in Go
  5. Good idea, bad design: How the Diamond standard falls short
  6. Efficient audits with machine learning and Slither-simil
  7. Let’s build a high-performance fuzzer with GPUs!
  8. Osquery: Using D-Bus to query systemd data
  9. Detecting Iterator Invalidation with CodeQL
  10. PrivacyRaven Has Left the Nest
  11. Graphtage: A New Semantic Diffing Tool
  12. Using Echidna to test a smart contract library
  13. Sinter: New user-mode security enforcement for macOS
  14. Accidentally stepping on a DeFi lego
  15. Contract verification made easier
  16. Advocating for change
  17. Upgradeable contracts made safer with Crytic
  18. ECDSA: Handle with Care
  19. How to check if a mutex is locked in Go
  20. Breaking the Solidity Compiler with a Fuzzer
  21. Detecting Bad OpenSSL Usage
  22. Verifying Windows binaries, without Windows
  23. Emerging Talent: Winternship 2020 Highlights
  24. Reinventing Vulnerability Disclosure using Zero-knowledge Proofs
  25. Bug Hunting with Crytic
  26. Announcing the 1st International Workshop on Smart Contract Analysis
  27. Revisiting 2000 cuts using Binary Ninja’s new decompiler
  28. Announcing our first virtual Empire Hacking
  29. An Echidna for all Seasons
  30. Announcing the Zeek Agent
  31. Financial Cryptography 2020 Recap
  32. Real-time file monitoring on Windows with osquery
  33. Our Full Report on the Voatz Mobile Voting Platform
  34. Manticore discovers the ENS bug
  35. Symbolically Executing WebAssembly in Manticore
  36. Themes from Real World Crypto 2020
  37. Exploiting the Windows CryptoAPI Vulnerability

2019 60

  1. Mainnet360: joint economic and security reviews with Prysm Group
  2. 64 Bits ought to be enough for anybody!
  3. Introducing iVerify, the security toolkit for iPhone users
  4. Announcing the Crytic $10k Research Prize
  5. Everything You Ever Wanted To Know About Test-Case Reduction, But Didn’t Know to Ask
  6. Security assessment techniques for Go projects
  7. Two New Tools that Tame the Treachery of Files
  8. Destroying x86_64 instruction decoders with differential fuzzing
  9. How safe browsing fails to protect user privacy
  10. Grace Hopper Celebration (GHC) 2019 Recap
  11. Formal Analysis of the CBC Casper Consensus Algorithm with TLA+
  12. Watch Your Language: Our First Vyper Audit
  13. Multi-Party Computation on Machine Learning
  14. TSC Frequency For All: Better Profiling and Benchmarking
  15. Tethered jailbreaks are back
  16. QueryCon 2019: A Turning Point for osquery
  17. Crypto 2019 Takeaways
  18. DeepState Now Supports Ensemble Fuzzing
  19. Rewriting Functions in Compiled Binaries
  20. Binary symbolic execution with KLEE-Native
  21. Reverse Taint Analysis Using Binary Ninja
  22. Wrapper's Delight
  23. A Day in the Life of Alessandro Gario, Senior Security Engineer
  24. 246 Findings From our Smart Contract Audits: An Executive Summary
  25. From The Depths Of Counterfeit Smartphones
  26. Better Encrypted Group Chat
  27. Crytic: Continuous Assurance for Smart Contracts
  28. Understanding Docker container escapes
  29. Trail of Bits Named in Forrester Wave as a Leader in Midsize Cybersecurity Consulting Services
  30. On LibraBFT’s use of broadcasts
  31. Seriously, stop using RSA
  32. Avoiding Smart Contract “Gridlock” with Slither
  33. State of the Art Proof-of-Work: RandomX
  34. Siderophile: Expose your Crate’s Unsafety
  35. Use constexpr for faster, smaller, and safer code
  36. Panicking the right way in Go
  37. Creating an LLVM Sanitizer from Hopes and Dreams
  38. Getting 2FA Right in 2019
  39. Trail of Bits @ ICSE 2019 – Recap
  40. Why you should go to QueryCon this week
  41. Leaves of Hash
  42. Announcing Manticore 0.3.0
  43. Fuzzing Unit Tests with DeepState and Eclipser
  44. Using osquery for remote forensics
  45. Announcing Automated Reverse Engineering Trainings
  46. Slither: The Leading Static Analyzer for Smart Contracts
  47. Announcing the community-oriented osquery fork, osql
  48. Announcing QueryCon 2019
  49. User-Friendly Fuzzing with Sienna Locomotive
  50. Performing Concolic Execution on Cryptographic Primitives
  51. Fuzzing In The Year 2000
  52. What Application Developers Need To Know About TLS Early Data (0RTT)
  53. Symbolic Path Merging in Manticore
  54. Fuzzing an API with DeepState (Part 2)
  55. Fuzzing an API with DeepState (Part 1)
  56. How McSema Handles C++ Exceptions
  57. Empire Hacking: Ethereum Edition 2
  58. How to write a rootkit without really trying
  59. On Bounties and Boffins
  60. What do La Croix, octonions, and Second Life have in common?

2018 41

  1. Fuzzing Like It’s 1989
  2. $10,000 research fellowships for underrepresented talent
  3. CSAW CTF Crypto Challenge: Breaking DSA
  4. 10 Rules for the Secure Use of Cryptocurrency Hardware Wallets
  5. Return of the Blockchain Security Empire Hacking
  6. Trail of Bits @ Devcon IV Recap
  7. We crypto now
  8. How contract migration works
  9. The Good, the Bad, and the Weird
  10. A Guide to Post-Quantum Cryptography
  11. Slither – a Solidity static analysis framework
  12. Introduction to Verifiable Delay Functions (VDFs)
  13. How to Spot Good Fuzzing Research
  14. Ethereum security guidance for all
  15. Effortless security feature detection with Winchecksec
  16. Protecting Software Against Exploitation with DARPA’s CFAR
  17. Rattle – an Ethereum EVM binary analysis framework
  18. Contract upgrade anti-patterns
  19. Introducing windows-acl: working with ACLs in Rust
  20. Get an open-source security multiplier
  21. Fault Analysis on RSA Signing
  22. You could have invented that Bluetooth attack
  23. Optimizing Lifted Bitcode with Dead Store Elimination
  24. Trail of Bits donates $100,000 to support young researchers through SummerCon
  25. Announcing the Trail of Bits osquery support group
  26. QueryCon 2018: our talks and takeaways
  27. Manage your fleet’s firewalls with osquery
  28. Manage Santa within osquery
  29. Collect NTFS forensic information with osquery
  30. State Machine Testing with Echidna
  31. What do you wish osquery could do?
  32. How to prepare for a security review
  33. Vulnerability Modeling with Binary Ninja
  34. Use our suite of Ethereum security tools
  35. An accessible overview of Meltdown and Spectre, Part 2
  36. "AMD Flaws" Technical Summary
  37. Echidna, a smart fuzzer for Ethereum
  38. 2017 in review
  39. Parity Technologies engages Trail of Bits
  40. An accessible overview of Meltdown and Spectre, Part 1
  41. Heavy lifting with McSema 2.0

2017 22

  1. Videos from Ethereum-focused Empire Hacking
  2. What are the current pain points of osquery?
  3. Announcing the Trail of Bits osquery extension repository
  4. Securing Ethereum at Empire Hacking
  5. How are teams currently using osquery?
  6. Hands on the Ethernaut CTF
  7. Trail of Bits joins the Enterprise Ethereum Alliance
  8. Our team is growing
  9. iOS jailbreak detection toolkit now available
  10. Tracking a stolen code-signing certificate with osquery
  11. Microsoft didn’t sandbox Windows Defender, so I did
  12. An extra bit of analysis for Clemency
  13. Magic with Manticore
  14. Manticore: Symbolic execution for humans
  15. A walk down memory lane
  16. April means Infiltrate
  17. McSema: I’m liftin’ it
  18. The Challenges of Deploying Security Mitigations
  19. The Smart Fuzzer Revolution
  20. Devirtualizing C++ with Binary Ninja
  21. Breaking Down Binary Ninja’s Low Level IL
  22. 2016 Year in Review

2016 27

  1. Let’s talk about CFI: Microsoft Edition
  2. Meet Algo, the VPN that works
  3. Shin GRR: Make Fuzzing Fast Again
  4. Come Find Us at O’Reilly Security
  5. Let’s talk about CFI: clang edition
  6. Automated Code Audit’s First Customer
  7. Windows network security now easier with osquery
  8. Plug into New York’s Infosec Community
  9. Work For Us: Fall and Winter Internship Opportunities
  10. A fuzzer and a symbolic executor walk into a cloud
  11. Your tool works better than mine? Prove it.
  12. Why I didn’t catch any Pokemon today
  13. Start using the Secure Enclave Crypto API
  14. It’s time to take ownership of our image
  15. 2000 cuts with Binary Ninja
  16. Empire Hacking Turns One
  17. ProtoFuzz: A Protobuf Fuzzer
  18. The DBIR’s ‘Forest’ of Exploit Signatures
  19. Hacker Handle Bounty
  20. The Problem with Dynamic Program Analysis
  21. Apple can comply with the FBI court order
  22. Tidas: a new service for building password-less apps
  23. Join us at Etsy’s Code as Craft
  24. Software Security Ideas Ahead of Their Time
  25. Hacking for Charity: Automated Bug-finding in LibOTR
  26. 2015 In Review
  27. Let’s Encrypt the Internet

2015 11

  1. Self-Hosted Video Chat with Tuber
  2. Why we give so much to CSAW
  3. Summer @ Trail of Bits
  4. Flare-On Reversing Challenges 2015
  5. Hardware Side Channels in the Cloud
  6. How We Fared in the Cyber Grand Challenge
  7. How to Harden Your Google Apps
  8. Introducing the RubySec Field Guide
  9. Closing the Windows Gap
  10. Empire Hacking, a New Meetup in NYC
  11. The Foundation of 2015: 2014 in Review

2014 18

  1. Close Encounters with Symbolic Execution (Part 2)
  2. Close Encounters with Symbolic Execution
  3. Speaker Lineup for THREADS ’14: Scaling Security
  4. We’re Sponsoring the NYU-Poly Women’s Cybersecurity Symposium
  5. Enabling Two-Factor Authentication (2FA) for Apple ID and DropBox
  6. ReMASTering Applications by Obfuscating during Compilation
  7. McSema is Officially Open Source!
  8. Education Initiative Spotlight: THREADS Call for Papers
  9. Education Initiative Spotlight: Build it Break it
  10. Education Initiative Spotlight: CSAW Summer Program for Women
  11. Trail of Bits Adds Mobile Security Researcher Nicholas DePetrillo to Growing Team
  12. A Preview of McSema
  13. We've Moved!
  14. Dear DARPA: Challenge Accepted.
  15. Trail of Bits Releases Capture the Flag Field Guide
  16. Using Static Analysis and Clang To Find Heartbleed
  17. Introducing Javelin
  18. Semantic Analysis of Native Programs with CodeReason

2013 5

  1. iVerify is now available on Github
  2. Free Ruby Security Workshop
  3. Writing Exploits with the Elderwood Kit (Part 2)
  4. Writing Exploits with the Elderwood Kit (Part 1)
  5. Elderwood and the Department of Labor Hack

2012 2

  1. Ending the Love Affair with ExploitShield
  2. Analyzing the MD5 collision in Flame