Data-Only Attacks Are Easier than You Think
Summary
The article profiles Einstein, a system that automatically generates data-only attacks by tracking attacker-controllable data through syscalls. It provides a concrete attack example against a web server and presents evaluation results across multiple servers, underscoring the need for comprehensive mitigations beyond traditional control-flow protections.