Logo image
Back
Don't Leak Your Keys: Understanding, Measuring, and Exploiting the AppSecret Leaks in Mini-Programs
Conference proceeding   Open access

Don't Leak Your Keys: Understanding, Measuring, and Exploiting the AppSecret Leaks in Mini-Programs

Yue Zhang, Yuqing Yang, Zhiqiang Lin and ACM
Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security, pp 2411-2425
15 Nov 2023
DOI: https://doi.org/10.1145/3576915.3616591
url
https://arxiv.org/pdf/2306.08151View
Preprint (Author's original) Open arXiv.org - Non-exclusive license to distribute

Abstract

Security and privacy -- Network security -- Mobile and wireless security Security and privacy -- Security services -- Authorization Security and privacy -- Software and application security -- Software reverse engineering Security and privacy -- Software and application security -- Web application security
Mobile mini-programs in WeChat have gained significant popularity since their debut in 2017, reaching a scale similar to that of Android apps in the Play Store. Like Google, Tencent, the provider of WeChat, offers APIs to support the development of mini-programs and also maintains a mini-program market within the WeChat app. However, mini-program APIs often manage sensitive user data within the social network platform, both on the WeChat client app and in the cloud. As a result, cryptographic protocols have been implemented to secure data access. In this paper, we demonstrate that WeChat should have required the use of the "appsecret" master key, which is used to authenticate a mini-program, to be used only in the mini-program back-end. If this key is leaked in the front-end of the mini-programs, it can lead to catastrophic attacks on both mini-program developers and users. Using a mini-program crawler and a master key leakage inspector, we measured 3,450,586 crawled mini-programs and found that 40,880 of them had leaked their master keys, allowing attackers to carry out various attacks such as account hijacking, promotion abuse, and service theft. Similar issues were confirmed through testing and measuring of Baidu mini-programs too. We have reported these vulnerabilities and the list of vulnerable mini-programs to Tencent and Baidu, which awarded us with bug bounties, and also Tencent recently released a new API to defend against these attacks based on our findings.

Metrics

23 Record Views
15 citations in Web of Science
12 citations in Scopus

Details

InCites Highlights

Data related to this publication, from InCites Benchmarking & Analytics tool:

Collaboration types
Domestic collaboration
Web of Science research areas
Computer Science, Artificial Intelligence
Computer Science, Interdisciplinary Applications
Telecommunications
Logo image