Re: call for presentations at the Lua Workshop 2011

[Peter Cawley <lua@...>]

On Wed, Jun 8, 2011 at 1:56 PM, Luiz Henrique de Figueiredo
<lhf@tecgraf.puc-rio.br> wrote:
> We are now planning the program for the Lua Workshop 2011. If you'd
> like to speak at the Workshop, please state it here, giving a tentative
> title and a short abstract.

* Mitigating the danger of malicious bytecode. *
In Lua 5.1 and 5.2, the family of load() functions permit the loading
of precompiled bytecode in addition to plain source code. We shall
look at some relevant details of the bytecode, and see how these
details can be maliciously abused to escape from a Lua sandbox (in
both 5.1 and 5.2). With the dangers presented, we shall then move to
look at two ways of mitigating them. Firstly, one can wrap the load()
functions as to reject bytecode before it is loaded. Secondly, and
more interestingly, one can attempt to algorithmically decide whether
a given piece of bytecode is malicious or not. We shall look at two
such algorithms for validating bytecode: LBCV [1], which tries to
reject as little as possible, and my current experimental verifier,
which tries to accept as little as possible.

[1] http://code.google.com/p/lbcv/