研究人员在USENIX Security 2024上发表论文，介绍了一款名为Einstein的自动化工具，能够便捷地生成数据攻击漏洞1。这类攻击无需改变程序的控制流，而是通过直接篡改数据来实现恶意操作1。
研究团队对包括httpd、lighttpd、nginx、postgres和redis在内的流行服务器进行了评估1。其中nginx表现最为令人担忧，其identity data flow比率达到84-98%1。在实际测试中，Einstein在nginx上确认了一个代码执行漏洞、17个Write-What-Where原语和41个Send-What-Where原语1。
约70%的Microsoft、Google和Mozilla的安全漏洞属于内存安全漏洞1，为数据攻击提供了广阔的可乘之机。这些发现挑战了长期以来关于数据攻击过于复杂而难以实施的传统认知。值得注意的是，测试套件的代码覆盖率仅为27-49%1，意味着更多潜在漏洞可能尚未被发现。
Researchers presenting at USENIX Security 2024 have introduced Einstein, an automated tool that can readily generate data-only attack vulnerabilities against popular servers and databases 1. Unlike traditional exploits that alter program control flow, these attacks execute malicious operations by modifying only data without injecting executable code 1. The tool challenges the long-held assumption that data attacks are too complex to be practical threats 1.
The Einstein tool was evaluated against widely-deployed systems including httpd, lighttpd, nginx, postgres, and redis 1. Testing revealed that nginx exhibited identity data flow rates as high as 84–98 percent 1. In nginx alone, the researchers confirmed one code-execution vulnerability alongside seventeen Write-What-Where primitives and forty-one Send-What-Where primitives 1. This discovery underscores the prevalence of such attack surfaces in production software, particularly given that approximately seventy percent of security vulnerabilities reported by Microsoft, Google, and Mozilla are memory safety issues 1.
评论
还没有评论，欢迎留下第一条。