Wherever you are in the world, a typical day as a Trail of Bits Engineer-Consultant means easing into your work. Here’s a short video showing some of our European colleagues describing a typical day as a Trail of Bits Engineer-Consultant: You generally set your own hours, to provide at least a coupl...
ZuoRAT used in operation focused on SOHO routers
Scheme allegedly targeted over 10,000 victims
When engineers apply to Trail of Bits, they’re often surprised by how straightforward and streamlined our hiring process is. After years of experience, we’ve cut the process to its bedrock, so that it’s candidate focused, quick, and effective. Here’s a short video showing some of our European collea...
Thousands scammed by spoofed EU portals
The defensive tool is designed to scan suspicious files against a large repository of YARA rules
Pluggable Authentication Modules (PAM) on Unix based systems are useful to change logon behavior and enforce authentication via various means.
In “Red Team Strategies” the chapter “Protecting the Pentester” walks the reader through the configuration of a PAM module to get notified in real-time via a...
Successful exploitation would give an attacker access to all emails on a compromised server
The vulnerability derived from a misconfiguration of one of the Photos app’s components
Do you need a blockchain? And if so, what kind? Trail of Bits has released an operational risk assessment report on blockchain technology. As more businesses consider the innovative advantages of blockchains and, more generally, distributed ledger technologies (DLT), executives must decide whether a...
Micro-targeting of local users a first for Beijing
Feds warn of fraudulent attempts to land work
A new Trail of Bits research report examines unintended centralities in distributed ledgers Blockchains can help push the boundaries of current technology in useful ways. However, to make good risk decisions involving exciting and innovative technologies, people need demonstrable facts that are arri...
Food manufacturer reveals system outage
Misconfiguration practices might make companies lucrative targets for threat actors
Trail of Bits has launched a podcast. The first five-episode season is now available for download. The podcast and its RSS feed are available at trailofbits.audio, and you may subscribe on all major podcast outlets, including Apple iTunes, Spotify, Gaana, Google Podcasts, Amazon Music, and many othe...
Telecommunications companies in Pakistan and Afghanistan and a port in Malaysia targeted
Dubbed ‘Revive’ because of its ability to automatically restart in case it stops working, the tool seems to be designed for persistent campaigns.
Recently we have disclosed new advisories related to the remote exploitation of Huawei smartphones.
The research that led to these findings was motivated by analyzing new interfaces for remote code execution on a mobile platform. After our work on exploiting Huawei’s Kirin via its baseband interface...
NCSC chief executive Lindy Cameron explains that clear rules are needed to govern the use of cyber capabilities