Data-Only Attacks Are Easier Than You Think
7 hours ago
- Data-only attacks, once considered impractical, are now easily automated with a tool called Einstein.
- About 70% of security bugs in software from major vendors (Microsoft, Google, Mozilla) are memory safety bugs exploitable for data-only attacks.
- Traditional control-flow hijacking attacks are increasingly difficult due to modern defenses like DEP and CFI.
- Einstein generates data-only attacks automatically by targeting syscall arguments with tainted attacker data, using identity data flows.
- The tool successfully found exploitable vulnerabilities in popular servers (httpd, lighttpd, nginx, postgres, redis), with up to 98% identity data flows.
- Einstein's evaluation of nginx revealed 944 attack primitives, including a code-execution primitive and numerous write and send primitives.
- Mitigating data-only attacks requires comprehensive defenses (e.g., memory safety, DFI) rather than practical but incomplete ones.
- The need for more practical comprehensive defenses is highlighted by Einstein's ability to bypass current state-of-the-art mitigations.