An in-lined reference monitoring approach for mitigating use after free vulnetabilities in the implementation of Lua virtual machine

Since the pandemic, Internet of Things (IoT) devices and intelligent appliances have become widespread. This trend has accelerated cybersecurity research related to IoT devices. The lack of research on secure software and hardware in IoT environments, coupled with the multitude of factors affecting the security of IoT devices and the wide attack surface, has made ensuring hardware and software security increasingly challenging, thereby making IoT environments a new target for cyber-attackers. In our study, we investigated the usability of the Lua programming language, commonly used in IoT devices such as smart refrigerators. We observed that Lua can be used to integrate technologies into smart refrigerators and program microcontrollers directly. Our study is the first to implement In-lined Reference Monitoring (IRM) for the Lua programming language. Leveraging the LuaLight tool developed based on Lua's semantic and syntactic rules, we provided runtime solutions to vulnerabilities CVE-2021-44964 and CVE-2020-24371. Vulnerable Lua bytecode is patched based on security policies, making it more secure and preventing potential cyber-attacks. Due to LuaLight's small memory footprint of 28KB and its efficient performance, it can be integrated into IoT devices and companion applications. This thesis aims to ensure the security of applications written in the Lua programming language at runtime using the LuaLight tool, employing a language-based security approach to IoT security.