PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Hacking for Charity: Automated Bug-finding in LibOTR

blog.trailofbits.com | blog | #vulnerability-research | #open-source | #fuzzing | #privacy | #encryption | #vulnerability-discovery | #automated-testing | #darpa | #secure-messaging | #charity | #cyber-grand-challenge | #automated-bug-finding | #decree | #cgc | #libotr
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Trail of Bits aimed its Cyber Grand Challenge bug-finding system at libotr, the OTR messaging library, porting it to DECREE and finding no critical bugs in tested paths, settling a charity bet.
Published
Collected

Related coverage

research · blog.quarkslab.com
State of Post-Quantum Cryptography implementations
In this blogpost, we first review the landscape of Post-Quantum Cryptography implementations across some of the most popular cryptographic libraries. Following that, we present the results of a differential fuzzing campaign on few of the presented implementations.
tool · github.com
Peach: Single-user, Local-first Personal Media Library and Management System
Offers a privacy-respecting, local-first alternative for media library indexing and playback, combining cloud-drive integration with automated scraping while keeping sensitive viewing data strictly local.
research · slcyber.io
How practical is 100k requests per second? Introducing h3fuzz
Can HTTP/3 really give you 100k requests per second for content discovery? We tested it in a fork of ffuf and are releasing h3fuzz, a web UI for fuzzing.
blog · blog.trailofbits.com
SequenceHash: multihashing for the rest of us
We're releasing SequenceHash and its sister function SequenceMAC, a pair of related hash constructions that bring secure multihashing to developers using hash functions other than Keccak.
blog · blog.trailofbits.com
1Password's AI patching benchmark is misleading
Trail of Bits says 1Password's FLAWED benchmark misstates AI patch quality, mixing wrong-fix prompts and no-test trials into a 26% clean-fix headline, and ships two agent skills for better fixes.
blog · blog.trailofbits.com
How Trail of Bits helps verify the integrity of your Signal chats
Trail of Bits explains Signal's Automatic Key Verification key-transparency system and describes the independent auditor it operates, one of three signers that make server key substitution detectable.
Back