YHK - yet another hacker news clone

Data-only attacks are easier than you think (2024)

17 points segfaultbuserr 2 hours ago 7 comments

gumby 1 hour ago | parent

> Data-only attacks ... have long been considered too sophisticated and niche to pose a practical threat.

I thought the whole point of fuzzing was an example of finding data-only attacks.

segfaultbuserr 1 hour ago | parent

Corrupting program memory via malicious input data is known as a code-execution attack, not a data-only attack. The fuzzed program usually crashes because its executable code or the control flow got overwritten directly by the input, or indirectly by the program code itself when it tries to process bad data. An exploit involves injecting external code, or overwriting memory addresses (like a virtual table or a stack return address) to override the original logic flow to do something else.

A data-only attack would be an attack that reuses the original logic by only corrupting data inputs (such as a flag or a file path), without overwriting code or overriding the logic. W^X, stack canary, or CFI won't work in these cases since no code is tampered by the attacker. In almost ever talk about compiler mitigations, you always hear a passing-by mention of data-only attacks - before the speaker immediately dismisses them as an academic curiosity when the software industry is still facing a flood of stack smashing and ROP attacks.

Terr_ 1 hour ago | parent

> The attack effectively modifies only the arguments of the execve syscall

I feel this checklist of shell-tools [0] is relevant, although the focus is more on how setuid is dangerous because you might not know the fancier arguments someone could supply.

> GTFOBins is a curated list of Unix-like executables that can be used to bypass local security restrictions in misconfigured systems.

[0] https://gtfobins.org/

joa- 36 minutes ago | parent

This showed me that taint analysis is kind of slept on. Maybe we should invest in better tooling that allows us to reverse engineer with taint analysis easier. Do we think it is a UI problem? Of course over tainting is a thing, but maybe we can make it work with better UI.

setr 29 minutes ago | parent

Is that really the name for it? It sounds revolting

Can’t we just use prim and proper terms like provenance

ill-ion 22 minutes ago | parent

"Provenance" tracks where data came from, but "taint" tracks where unsafe data can flow. It's a uhh not so sexy term, but it is the industry standard term.

burgerone 12 minutes ago | parent

I'm positively surprised that their tool is not yet another LLM wrapper.

The quality of research (and by extent HN submissions) has really plummeted since LLMs have become marginally useful