publications
publications copied to clipboard
trailofbits
Publications from Trail of Bits
Publications from Trail of Bits
- Academic Papers
- Conference Presentations
- Automated bug finding and exploitation
- Blockchain
- Cryptography
- Engineering
- Education
- Mobile security
- Programming
- Side channels
- Threat analysis & malware
- Datasets
- Podcasts
- Security Reviews
- Technology Product Reviews
- Cloud-native Reviews
- Cryptography Reviews
- Blockchain Reviews
- Workshops
- Legend
Academic papers
| Paper Title | Venue | Publication Date |
|---|---|---|
| Evaluating Static Analysis Tools via Differential Mutation | QRS 2021 | Dec 2021 |
| echidna-parade: Diverse multicore smart contract fuzzing | ISSTA 2021 | July 2021 |
| Differential analysis of x86-64 instruction decoders | LangSec 2021 | May 2021 |
| Echidna: effective, usable, and fast fuzzing for smart contracts | ISSTA 2020 | July 2020 |
| Automated Grammar Extraction via Semantic Labeling of Parsers | LangSec 2020 | May 2020 |
| What are the Actual Flaws in Important Smart Contracts? | FC 2020 | Feb 2020 |
| Echidna: A Practical Smart Contract Fuzzer | FC 2020 | Feb 2020 |
| RSA GTFO | PoC||GTFO 0x20 | Jan 2020 |
| Manticore: Symbolic Execution for Binaries and Smart Contracts | ASE 2019 | Jun 2019 |
| Slither: A Static Analysis Framework For Smart Contracts | WETSEB 2019 | May 2019 |
| Toward Smarter Vulnerability Discovery Using Machine Learning | AISec 2018 | Oct 2018 |
| The Past, Present, and Future of Cyberdyne | IEEE S&P | Apr 2018 |
| DeepState - Symbolic Unit Testing for C and C++ | BAR 2018 | Feb 2018 |
| Cyber-Deception and Attribution in Capture-the-Flag Exercises | FOSINT-SI 2015 | Jul 2015 |
Conference presentations
Automated bug finding and exploitation
| Presentation Title | Author(s) | Year |
|---|---|---|
| Differential analysis of x86-64 instruction decoders | William Woodruff, Niki Carroll, Sebastiaan Peters | 2021 |
| How to find bugs when (ground) truth isn't real | William Woodruff | 2020 |
| The Treachery of Files and Two New Tools that Tame It | Evan Sultanik | 2019 |
| Symbolically Executing a Fuzzy Tyrant | Stefan Edwards | 2019 |
| Kernel space fault injection with KRF | William Woodruff | 2019 |
| Binary Symbolic Execution With KLEE-Native | Sai Vegasena | 2019 |
| Going sicko mode on the Linux Kernel | William Woodruff | 2019 |
| Vulnerability Modeling with Binary Ninja | Josh Watson | 2018 |
| File Polyglottery; or, This PoC is also a picture of cats | Evan Sultanik | 2017 |
| Be a binary rockstar | Sophia D'Antoine | 2017 |
| Symbolic Execution for Humans | Mark Mossberg | 2017 |
| The spirit of the 90s is still alive in Brooklyn | Ryan Stortz, Sophia D'Antoine | 2017 |
| The dream of a static and dynamic analysis shootout | Ryan Stortz | 2016 |
| Binary constraint solving for automatic exploit generation | Sophia D'Antoine | 2016 |
| The Smart Fuzzer Revolution | Dan Guido | 2016 |
| Making a scaleable automated hacking system | Artem Dinaburg | 2016 |
| Cyberdyne - Automatic bug-finding at scale | Peter Goodman | 2016 |
| McSema: Static translation of x86 to LLVM IR | Andrew Ruef, Artem Dinaburg | 2014 |
Blockchain
| Presentation Title | Author(s) | Year |
|---|---|---|
| How to fuzz like a pro | Josselin Feist, Nat Chin | 2022 |
| Building a Practical Static Analyzer for Smart Contracts | Josselin Feist | 2021 |
| Testing and Verifying Smart Contracts: From Theory to Practice | Josselin Feist | 2021 |
| Safely integrating with ERC20 tokens | Josselin Feist | 2021 |
| Detecting transaction replacement attacks with Manticore | Sam Moelius | 2020 |
| Fantastic Bugs and How to Squash Them; or, the Crimes of Solidity | Evan Sultanik | 2019 |
| SlithIR: High-Precision Security Analysis with an IR for Solidity | Josselin Feist | 2019 |
| Slither: A Static Analysis Framework for Smart Contracts | Josselin Feist | 2019 |
| What blockchain got right | Dan Guido | 2019 |
| Property-testing of smart contracts | JP Smith | 2018 |
| Anatomy of an unsafe programming language | Evan Sultanik | 2018 |
| Contract upgrade risks and recommendations | Josselin Feist | 2018 |
| Blackhat Ethereum | Ryan Stortz, Jay Little | 2018 |
| Blockchain Autopsies - Analyzing Smart Contract Deaths | Jay Little | 2018 |
| Rattle - an Ethereum EVM binary analysis framework | Ryan Stortz | 2018 |
| Securing value on the Ethereum blockchain | Dan Guido | 2018 |
| Binary analysis, meet the blockchain | Mark Mossberg | 2018 |
| Automatic bug finding for the blockchain | Felipe Manzano, Josselin Feist | 2017 |
Cryptography
| Presentation Title | Author(s) | Year |
|---|---|---|
| die, PGP, die | William Woodruff | 2022 |
| Seriously, stop using RSA | Ben Perez | 2019 |
| Best Practices for Cryptography in Python | Paul Kehrer | 2019 |
| Analyzing the MD5 collision in Flame | Alex Sotirov | 2012 |
Engineering
| Presentation Title | Author(s) | Year |
|---|---|---|
| Improving PyPI's security with Two Factor Authentication | William Woodruff | 2019 |
| Linux Security Event Monitoring with osquery | Alessandro Gario | 2019 |
| osql: The community oriented osquery fork | Stefano Bonicatti, Mark Mossberg | 2019 |
| Getting started with osquery | Lauren Pearl, Andy Ying | 2018 |
| osquery Super Features | Lauren Pearl | 2018 |
| osquery Extension Skunkworks | Mike Myers | 2018 |
| Build it Break it Fix it | Andrew Ruef | 2014 |
Education
| Presentation Title | Author(s) | Year |
|---|---|---|
| A mostly gentle introduction to LLVM | William Woodruff | 2022 |
| JWTs, and why they suck | Rory M | 2021 |
| The Joy of Pwning | Sophia D'Antoine | 2017 |
| How to CTF - Getting and using Other People's Computers (OPC) | Jay Little | 2014 |
| Low-level Security | Andrew Ruef | 2014 |
| Security and Your Business | Andrew Ruef | 2014 |
| Bringing nothing to the party | Vincenzo Iozzo | 2013 |
| From One Ivory Tower to Another | Vincenzo Iozzo | 2012 |
Infrastructure
| Presentation Title | Author(s) | Year |
|---|---|---|
| Return to the 100 Acre Woods | Stefan Edwards | 2019 |
| Swimming with the kubectl fish | Stefan Edwards | 2019 |
Machine Learning
| Presentation Title | Author(s) | Year |
|---|---|---|
| Exploiting Machine Learning Pickle Files | Carson Harmon, Evan Sultanik, Jim Miller, Suha Hussain | 2021 |
| PrivacyRaven: Comprehensive Privacy Testing for Deep Learning | Suha Hussain | 2020 |
Mobile security
| Presentation Title | Author(s) | Year |
|---|---|---|
| Swift Reversing | Ryan Stortz | 2016 |
| Modern iOS Application Security | Sophia D'Antoine, Dan Guido | 2016 |
| The Mobile Exploit Intelligence Project | Dan Guido | 2012 |
| A Tale of Mobile Threats | Vincenzo Iozzo | 2012 |
Programming
| Presentation Title | Author(s) | Year |
|---|---|---|
| Python internals - let's talk about dicts | Dominik Czarnota | 2019 |
| Low-level debugging with Pwndbg | Dominik Czarnota | 2018 |
| Insecure Things to Avoid in Python | Dominik Czarnota | 2018 |
Side channels
| Presentation Title | Author(s) | Year |
|---|---|---|
| Hardware side channels in virtualized environments | Sophia D'Antoine | 2015 |
| Exploiting Out-of-Order Execution | Sophia D'Antoine | 2015 |
Threat analysis & malware
| Presentation Title | Author(s) | Year |
|---|---|---|
| Peeling back the 'Shlayers' of macOS Malware | Josh Watson, Erika Noerenberg | 2019 |
| The Exploit Intelligence Project Revisited | Dan Guido | 2013 |
Datasets
| Dataset | Date |
|---|---|
| Smart Contract Audit Findings | Aug 2019 |
Podcasts
| Podcast | Guest | Date | Topic(s) |
|---|---|---|---|
| Risky Business 672 | Dan Guido | Jul 2022 | Blockchain security |
| Cloud Security Reinvented | Nick Selby | Jun 2022 | Cloud security |
| Skiff Office Hours | Dan Guido | Mar 2022 | Privacy technology |
| Risky Business 652 | Dan Guido | Jan 2022 | Zero-knowledge proofs |
| Secureum Safecast #3 | Josselin Feist | Nov 2021 | Blockchain security |
| Secureum Safecast #2 | Dan Guido | Oct 2021 | Blockchain security |
| Press Freedom Foundation | Dan Guido | Jul 2021 | Mobile security and iVerify |
| Employee Cycle | Hannah Hanks | Mar 2021 | First PeopleOps hire |
| Risky Business 614 | Dan Guido | Feb 2021 | iVerify |
| Building Better Systems #6 | Dan Guido | Jan 2021 | What blockchain got right |
| WCBS 880 | Dan Guido | Sep 2020 | Gap years and intern hiring |
| Risky Business 594 | Dan Guido | Aug 2020 | Apple security |
| Epicenter 346 | Dan Guido | Jun 2020 | Smart contract security |
| Absolute AppSec 97 | Stefan Edwards | May 2020 | Threat modeling |
| Unchained 170 | Dan Guido | May 2020 | DeFi security |
| Risky Business 580 | Dan Guido | Apr 2020 | Mobile voting |
| Absolute AppSec 91 | Stefan Edwards | Apr 2020 | Mobile voting |
| Zero Knowledge 122 | Ben Perez | Mar 2020 | Cryptography reviews, ZKPs |
| Changelog | Dan Guido | Jan 2020 | AlgoVPN |
| Risky Business 559 | Stefan Edwards | Oct 2019 | Kubernetes |
| FOSS Weekly 545 | William Woodruff | Sep 2019 | PyPI security improvements |
Podcast.__init__ 225 |
William Woodruff | Aug 2019 | PyPI security, UX, and sustainability |
| Absolute AppSec 68 | Stefan Edwards, Bobby Tonic | Aug 2019 | Kubernetes |
| Hashing it Out 53 | Dan Guido | Jul 2019 | Smart contract testing |
| Absolute AppSec 60 | Stefan Edwards | May 2019 | Android, programming languages |
| Absolute AppSec 55 | Stefan Edwards | Apr 2019 | Security testing |
| Hashing it Out 35 | Dan Guido, Josselin Feist | Jan 2019 | Ethereum's failed EIP-1283 |
| Risky Business | JP Smith | Jan 2019 | Post-quantum crypto in CTFs |
| Absolute AppSec 37 | Stefan Edwards | Nov 2018 | Programming languages, symbex |
| Risky Business 510 | Lauren Pearl | Aug 2018 | Open source security engineering |
| Absolute AppSec 34 | Stefan Edwards | Oct 2018 | Security testing, blockchain |
| Zero Knowledge 16 | JP Smith | Mar 2018 | Smart contract security |
| Risky Business 488 | JP Smith | Feb 2018 | Smart contract testing w/ Manticore |
| Risky Business 474 | Dan Guido | Oct 2017 | How to engineer secure software |
| Georgian Partners 47 | Dan Guido | May 2017 | AlgoVPN and Tor |
| VUC 643 | Dan Guido | Apr 2017 | AlgoVPN |
| Risky Business 449 | Dan Guido | Mar 2017 | Control Flow Integrity |
| Risky Business 425 | Dan Guido | Sep 2016 | Recap the week's news |
| Risky Business 421 | Dan Guido | Aug 2016 | Car hacking and the week's news |
| Risky Business 416 | Dan Guido | Jul 2016 | DARPA Cyber Grand Challenge |
| Risky Business 399 | Dan Guido | Feb 2016 | Apple vs the FBI |
| Risky Business 370 | Dan Guido | Feb 2015 | DARPA Cyber Grand Challenge |
| Risky Business 348 | Dan Guido | Jun 2015 | DARPA Cyber Grand Challenge |
Security reviews
Companies that have allowed us to speak about our work can be found here. Many more remain confidential.
Technology product reviews
Cloud-Native reviews
| Product | Date | Level of Effort | Announcement | Report |
|---|---|---|---|---|
| Tekton | Mar 2022 | 4 | ||
| Linkerd | Feb 2022 | 4 | ||
| CoreDNS | Jan 2022 | 4 | 📄 | |
| Terrform Enterprise | Nov 2021 | 6 | ||
| Nomad Enterpprise | Nov 2021 | 6 | ||
| Consul Enterprise | Oct 2021 | 6 | ||
| Vault Enterprise | Oct 2021 | 6 | ||
| HashiCorp Cloud | Jun 2021 | 8 | ||
| Argo | Mar 2021 | 4 | 📛 📄 | |
| Terrform Cloud | Jan 2021 | 6 | ||
| Consul | Oct 2020 | 10 | ||
| Nomad | Aug 2020 | 6 | ||
| Helm | Aug 2020 | 4 | Helm 2nd Security Audit | 📄 |
| Terraform | Mar 2020 | 6 | ||
| OPA | Mar 2020 | 2 | Open Policy Agent (OPA) Graduation Proposal | 📄 |
| etcd | Jan 2020 | 4 | CNCF | 📄 |
| Rook | Dec 2019 | 2 | CNCF | 📄 |
| Kubernetes | May 2019 | 12 | Google, CNCF | 📛 📄 📰 |
Blockchain reviews
Algorand
| Product | Date | Level of Effort | Announcement | Report |
|---|---|---|---|---|
| wXTZ | Nov 2020 | 4 | 📄 | |
| wALGO | Nov 2020 | 4 | 📄 | |
| Meld Gold | Jul 2020 | 2 | ||
| Algorand | Mar 2019 | 14 | Success and momentum of Algorand | |
| Pixel | Dec 2019 | 4 |
Avalanche
| Product | Date | Level of Effort | Announcement | Report |
|---|---|---|---|---|
| Alkimiya Silica V2 | June 2022 | 6 | ||
| Ava Labs | Apr 2022 | 8 | ||
| Flare Network | Mar 2021 | 8 |
Bitcoin & derivatives
| Product | Date | Level of Effort | Announcement | Report |
|---|---|---|---|---|
| STAS SDK | Oct 2021 | 4 | ||
| STAS-JS SDK | Sept 2021 | 4 | ||
| Bitcoin SV | Jan 2021 | 6 | ||
| Zcoin | Jul 2020 | 2 | Lelantus Cryptographic Library Audit Results | 📄 |
| Zcash | Apr 2020 | 3 | Heartwood security assessment results | 📄 |
| Zcash | Nov 2019 | 6 | NU3, Blossom, and Sapling security reviews | 📄 |
| Zcash | Nov 2019 | 6 | 📄 | |
| Paymail Protocol | Nov 2019 | 7 | ||
| Bitcoin SV | Nov 2018 | 12 | ||
| Simple Ledger | Oct 2019 | 3 | ||
| ZecWallet | Apr 2019 | 2 | 📄 | |
| RSKj | Nov 2017 | 6 | RSK security audit results | 📄 |
Ethereum/EVM
NervOS
| Product | Date | Level of Effort | Announcement | Report |
|---|---|---|---|---|
| xUDT | Jun 2021 | 2 | ||
| Nervos -RSA | Mar 2021 | 4 | ||
| Nervos SUDT | Oct 2020 | 6 | 📄 | |
| Cheque Cell & ORU | Feb 2021 | 8 | ||
| Force Bridge - Solidity | Feb 2021 | 4 | ||
| Force Bridge - Rust | Feb 2021 | 3 |
StarkWare
| Product | Date | Level of Effort | Announcement | Report |
|---|---|---|---|---|
| StarkPerpetual | Jan 2022 | 8 | ||
| StarkEx | Nov 2021 | 8 |
Solana
| Product | Date | Level of Effort | Announcement | Report |
|---|---|---|---|---|
| Solana | Apr 2022 | 12 |
Substrate
| Product | Date | Level of Effort | Announcement | Report |
|---|---|---|---|---|
| Parallel Finance | Mar 2022 | 6 | 📄 | |
| Polkadex | Feb 2022 | 10 | ||
| Polkadex | Dec 2021 | 4 | ||
| PINT | Sept 2021 | 4 | ||
| Polkaswap | Jul 2021 | 6 | ||
| AlephBFT | Jun 2021 | 4 | ||
| Acala Network | Jun 2021 | 4 | ||
| Compound Chain | May 2021 | 6 | ||
| Acala Network | Jan 2021 | 6 | 📄 | |
| Parity Fether | Aug 2019 | 4 | ||
| Parity | Jul 2018 | 12 | Parity completes Trail of Bits security review | 📄 |
Tendermint/Cosmos
| Product | Date | Level of Effort | Announcement | Report |
|---|---|---|---|---|
| Umee | Feb 2022 | 8 | 📄 | |
| Columbus-5 | Jan 2022 | 2 | ||
| IBC Protocol | Dec 2021 | 4 | ||
| THORChain | Aug 2021 | 12 | ||
| Tendermint | Mar 2019 | 12 | ||
| ndau | Nov 2018 | 8 | ndau Holders Elect Inaugural Policy Council |
Tezos
| Product | Date | Level of Effort | Announcement | Report |
|---|---|---|---|---|
| Kolibri | Apr 2022 | 4 | ||
| Tezori (T2) | Dec 2020 | 4 | 📄 | |
| Tezori | Jul 2018 | 2 | Thanks to @trailofbits for their security review | |
| Magma | Jun 2020 | 1 | 📄 | |
| Dexter | Jun 2020 | 4 | 📄 |
Other/Multi-Chain
Workshops
| Workshop Title | Venue | Date |
|---|---|---|
| Smart Contract Security Automation Workshop | TruffleCon 2019 | Oct 2019 |
| Manticore EVM Workshop | Devcon4 2018 | Nov 2018 |
| Introduction to Smart Contract Exploitation | GreHack 2018 | Nov 2018 |
| DeepState: Bringing Vulnerability Detection Tools into the Dev Cycle | SecDev 2018 | Oct 2018 |
| Smart Contract Security Automation Workshop | TruffleCon 2018 | Oct 2018 |
| Smart Contract Security Automation Workshop | ETH Berlin 2018 | Sep 2018 |
| Manticore EVM Workshop | EthCC 2018 | Mar 2018 |
| Manticore Workshop | GreHack 2017 | Oct 2017 |
Legend
| Icon | Definition |
|---|---|
| 💬 | Blog post or other social media |
| 📄 | Security Assessment report |
| 📛 | Threat Model report |
| 📰 | Whitepaper |
| Header | Definition |
|---|---|
| Level of Effort | Defined in person-weeks for the project |
trailofbits