Data-only attacks are easier than you think (2024)

Data-only attacks, once thought to be too complex and rare to pose a significant risk, have been shown to be surprisingly straightforward with the development of a tool called Einstein. These attacks, which manipulate data rather than control flow, have long been considered too application-specific or intricate to be a practical threat. However, this study demonstrates that the assumption is incorrect and that building data-only exploits is now quite accessible.

The researchers explain that while traditional exploits often involve redirecting a program's control flow—forcing it to execute malicious code—data-only attacks allow a hacker to leverage a memory safety bug to manipulate data instead. This can be achieved by overwriting variables or buffer contents, thereby changing the behavior of the program based on malicious input.

For instance, in the case of a vulnerable web server, an attacker can exploit a buffer overflow to alter a critical variable, like the CGI-BIN path, directing the server to execute malicious programs instead. Despite the complexity of traditional attacks, Einstein automates the generation of data-only exploits, making them within the reach of even low-effort attackers.

The findings from this research have significant implications for software vendors. Traditional mitigation strategies, which focus on preventing control-flow hijacking, may no longer be sufficient against these new types of attacks. As a result, it is essential for vendors to reassess and adapt their defense mechanisms to address the emerging threat of data-only exploits.