TrustSec

‼️ MAJOR ANNOUNCEMENT

TLDR:

- Trust Security is now TrustSec. New name, new logo, new website.
- We’re setting industry standards on how security teams communicate their work. Our entire portfolio is now on open display - every audit, bounty, contest win. Full transparency, zero gatekeeping.
- Going further, we present every competitor audit ran in parallel to us, on same commit. No cherry picking. It’s a pure measure of skill, and the results are conclusive.
- Same team, same standard, same depth. The quality never changed. Now the visibility catches up. Everything's in place to hit entirely new ceilings.

Full breakdown below ⤵️

TLDR: If DPRK are reading this, they should be saying "time for round 2".

Takeaways:
- critical infra engineers are free to download arbitrary software on work laptops.
- the day-to-day work setup can connect to billion dollar signing environments.
- no human oversight or physical confirmation for moving 10-figs of value / EIP-7702 code change.
- various AI vibe-based tools running in corp environments doing god knows what except serving as a remote compromise surface, framed as a good thing btw.
- none of the above labelled as the problem.
- instead, reads as blaming employees for falling for social engineering, and anti-virus not catching the malware. This is a dog-ate-my-homework level excuse deployed after a nuclear-failure level event.

Sincerely hoping binance have more reloads available to cover the next losses too. Reaching exchange hot wallets will never be near impossible, but it should not be this easy either.

Incredible work by the teams finding PHP2Shell and disclosing responsibly!

While many see this as a case study of how white hats and vendors collaborate to protect users, we want to share a more realistic take.

The log shows the finding was discoverable by AI tooling for 2 months prior to the public patch. That's an eternity for malicious actors to infiltrate ~70% of the world's servers, where they can steal data, launch watering hole attacks and pivot into organization networks. Companies like CrowdStrike reported in-the-wild exploitation prior to the announcement.

To believe that only a couple of WH teams knew about it is beyond wishful thinking. It will take years (if ever) to get a real damage report. If we ran PHP on our stack we would probably assume compromise and work from there.

The entire software mitigation paradigm needs to be rethought. Third-party software that is deployed everywhere should not be treated the same as first-party code that can be patched within hours and without a public trace.

The big players must show leadership in working towards mandatory atomic patching operations. Anything else will simply not be good enough when AI is able to parallel-discover 0days, or to read patch diff and develop exploits in minutes. We'll probably lose that fight too, but at least it will be a closer one than what we have now.

We're proud to be making such a profound impact on the DeFi landscape.

Being recognized by the leading platform as the #1 team on the leaderboard is a huge motivator to continue securing the space 🫡

TrustSec is heading to Singapore for @token2049, the world’s largest crypto gathering.

We’re looking forward to meeting builders, investors and partners shaping Web3.

Want to discuss premium-grade security? DM or find us around. Side event invites welcome.