Data-only attacks are easier than you think (2024)

July 1, 2024 Research Authors: Brian Johannesmeyer , Herbert Bos , Cristiano Giuffrida , Asia Slowinska Article shepherded by: Rik Farrow Data-only attacks, those that do not affect a program’s control flow, have long been considered too sophisticated and niche to pose a practical threat. With our research, however, we have built a tool that automatically generates them with surprising ease. We explain how such attacks work, and why our tool, Einstein, calls upon both researchers and vendors alike to rethink their mitigation strategies. Suppose you are a hacker and you just found a bug that allows you to overwrite data in a victim program. Such a scenario is not uncommon: Microsoft, Google, and Mozilla report that about 70% of their security bugs are indeed such memory safety bugs [ 1 , 2 , 3 ]. The question then becomes, as a hacker, how do you weaponize this bug into a real exploit? In the past, it would have been relatively straightforward: you could, for example, use the bug to conduct a control-flow hijacking attack , overwriting code pointers in the program [ 4 ], forcing it to execute your own malicious code . However, due to decades of research (resulting in defenses such as DEP, CFI, CPI, etc.), it is now very difficult to divert a program’s control flow away from the code that it intends to execute. Hence, weaponizing the bug in such a way is now often infeasible in practice. In our recently published paper at USENIX Security 2024 [ 5 ], we present a practical approach to an entirely different method of exploitation: letting the program execute all of its intended code (e.g., any benign functions, system calls, etc.), but with malicious data . These so-called data-only attacks have been known for quite some time [ 6 ], but were assumed to be too application-specific or complex to pose any practical threat [ 7 ]. In our work, we show that such assumptions are not justified. In particular, we implemented a scalable and automated solution, Einstein, that demonstrates that building data-only attacks is easy — well within reach of low-effort attackers. In this article, we will discuss the insights that allow Einstein to automatically generate such exploits with surprising ease, and the implications of our findings on software vendors. An example data-only attack Let us first walk through one of the classic data-only attacks described in the literature, which exploits a victim web server [ 6 ] (simplified for clarity). At start up, the server reads its configuration file to initialize its data. One such configuration option is the CGI-BIN path, which is the directory it uses to execute external programs. In our example, the server sets its cgi_bin_path variable to " /usr/local/server/cgi-bin ". We assume that the server has a program in its CGI-BIN directory, sort_script , that a client can use to sort numbers. Moreover, the server has a memory safety bug that allows a malicious client to overflow some buffer and overwrite, for instance, the