Thread

Data-only attacks are easier than you think (2024)

102 points · 45 comments · segfaultbuserr

lemmegetthis · 1790174223 · focus · HN ↗
Is this article saying that this AI tool has found 944 NEW unpatched exploits in nginx, and a comparable number in other commonly used server software?
```
    Total  944
    Table 2: Confirmed exploits for nginx.
```
1. segfaultbuserr · 1790184256 · focus · HN ↗
  First, there is no "AI", the author showed even a simple static analysis as proposed by them was sufficient to find data-only attacks, in contrary to the common belief that you need heavily customized exploits per application for this kind of attacks. This is the whole point of the research.
  Next, I believe they found 944 available "data-only gadgets" usable by a pre-existing memory corruption bug. You still need to find a memory corruption bug first to use them, in the same sense that you need to hunt for ROP gadgets to get arbitrary code execution on a W^X system.
  1. segfaultbuserr · 1790300570 · focus · HN ↗
    correction: s/static analysis/data-flow analysis/

Unofficial Hacker News client; not affiliated with Y Combinator.