Data-only attacks, which do not affect a program’s control flow, have long been considered too sophisticated and niche to pose a practical threat. With our research, however, we have built a tool that automatically generates them with surprising ease.

Suppose you are a hacker and you just found a bug that allows you to overwrite data in a victim program. Microsoft, Google, and Mozilla report that about 70% of their security bugs are indeed such memory safety bugs. In the past, you could use the bug to conduct a control-flow hijacking attack, overwriting code pointers and forcing execution of your own malicious code. However, defenses such as DEP, CFI, and CPI now make this very difficult.

In our recently published paper at USENIX Security 2024, we present a practical approach: letting the program execute all of its intended code, but with malicious data. These so-called data-only attacks were assumed too application-specific or complex, but our scalable, automated tool, Einstein, shows they are easy and within reach of low-effort attackers.

A classic example exploits a victim web server by overwriting its cgi_bin_path variable from /usr/local/server/cgi-bin to /bin, enabling arbitrary code. Brian Johannesmeyer, Herbert Bos, Cristiano Giuffrida, and Asia Slowinska explain how this works and why software vendors should rethink mitigation strategies.