Bytecode Breakdown: Unraveling Factorio's Lua Security Flaws (memorycorruption.net)

Article summary

A security researcher discovered a vulnerability in the Lua implementation of the game Factorio, which allowed a malicious server to obtain arbitrary execution on clients. The vulnerability was patched in Factorio version 1.1.101. The researcher explains the details of the vulnerability, including how it was possible to execute malicious bytecode and create fake objects. The vulnerability was due to a combination of factors, including the use of deterministic lockstep in the game's multiplayer mode and the ability to execute Lua code on clients.

Main themes

• Lua security flaws
• Factorio multiplayer mode
• Bytecode execution
• Game security
• Exploitation techniques

What commenters say

• The use of JIT compilers and bytecode execution is inherently insecure and should be disabled in high-stakes systems.
• Verifying the security of bytecode is extremely hard and may be impossible, making it a significant challenge for developers.
• Allowing users to load raw bytecode is known to be unsafe and should be disabled by default, with some arguing that its legitimate uses are niche.
• Security through obscurity is not an effective strategy and can actually be counterproductive, as it may lead to a lack of transparency and accountability.
• The decision to allow loading raw bytecode in Factorio was likely a mistake, and the game's developers should have taken a more cautious approach to security.
• Disabling the debug library and restricting bytecode loading can help improve security, but may also limit the functionality of mods and other features.
• The trade-off between security and usability is a significant challenge in game development, and developers must carefully consider the risks and benefits of different design decisions.