Data-Only Attacks Are Easier Than You Think

Data-only attacks, which use only data manipulation and do not rely on code execution, were found to be more common and easier to execute than previously thought. A research paper presented at the 2022 USENIX Security Symposium demonstrated that data-only attacks can be used to gain unauthorized access to sensitive information. The researchers used publicly available tools to create a proof-of-concept attack that exploited a vulnerability in the Linux operating system. The attack was able to bypass security controls and gain access to sensitive data without executing any malicious code. The researchers also found that data-only attacks can be used to exploit vulnerabilities in web applications, such as SQL injection and cross-site scripting (XSS). The study highlights the need for improved security measures to protect against data-only attacks, which are becoming increasingly common.