New Tool "Einstein" Automates Data-Only Attack Generation, Challenging Mitigation Strategies

Automating Data-Only Attacks

Researchers have developed a tool named "Einstein" that automates the generation of data-only attacks. These attacks manipulate a program's data without altering its control flow, a method previously considered too complex or application-specific to be a practical threat. The development of Einstein challenges this assumption by demonstrating the ease with which such exploits can be created.

The Shift in Exploitation Methods

Historically, memory safety bugs, which account for approximately 70% of security vulnerabilities reported by major tech companies, were often weaponized through control-flow hijacking. This involved overwriting code pointers to execute malicious code. However, decades of research and the implementation of defenses like DEP, CFI, and CPI have made control-flow hijacking difficult to achieve in practice.

The new research focuses on an alternative: allowing a program to execute its intended code but with malicious data. This approach bypasses control-flow defenses, as the program's execution path remains unchanged, only its internal data is corrupted.

Implications for Security Defenses

The findings, presented at USENIX Security 2024, suggest that existing mitigation strategies, which largely focus on preventing control-flow manipulation, may be insufficient against these automated data-only attacks. The ease of generating these exploits, even for low-effort attackers, calls for researchers and vendors to rethink and adapt their security measures to address this emerging threat vector.