Abstract:Mini-programs (MiniApps), lightweight versions of full-featured mobile apps that run inside a host app such as WeChat, have become increasingly popular due to their simplified and convenient user experiences. However, MiniApps raise new security and privacy concerns as they can access partially or all of host apps' system resources, including sensitive personal data. While taint detection has been proven effective in addressing this kind of concerns, existing taint detection techniques for mobile apps cannot be directly applied to MiniApps. The main reason is that the key logics of MiniApps are usually written in J avaScript, and its intrinsic characteristics (function-level scope, dynamic types, synchronous programming, and code obfuscation) prevent existing taint detection techniques from precisely propagating the taints. To address this problem, we propose a novel taint detection technique, Wemint, that detects sensitive information leaks in MiniApps. Specifically, Wemint facilitates taint propagation via building a context-based model based on the operational prin-ciple of MiniApps and J avaScript, and addresses asynchronous function calls by modeling their callbacks explicitly in taint rules. In addition, due to the adoption of Abstract Syntax Trees (ASTs) for code representation during taint detection, Wemint exhibits better robustness against the commonly-applied code obfuscation. Our experimental results show that Wemint can effectively detect sensitive information leaks in WeChat MiniApps, as well as trace the path of sensitive data flows. By applying Wemint to over 20K suspicious MiniApps, we found that over 7.5K (36.5 %) of them have sensitive data leaks, and Wemint outperforms the state-of-the-art DoubleX based techniques in detecting these leaks.

Research on Key Technology of WeChat Mini Program Based on Secure QR Code

Mqrcode

Secure QR Code Scheme Using Nonlinearity of Spatial Frequency.

ScreenID: Enhancing QRCode Security by Utilizing Screen Dimming Feature

Toward a Secure QR Code System by Fingerprinting Screens.

ScreenID: Enhancing QRCode Security by Fingerprinting Screens

Poster: Secure Visible Light Communication based on Nonlinearity of Spatial Frequency in Light

Research on Architecture Design of E-commerce Mini-program and its application in WeChat

Analysis of the Development of WeChat Mini Program

Don't Leak Your Keys: Understanding, Measuring, and Exploiting the AppSecret Leaks in Mini-Programs

Design and Analysis of a Campus Service Platform Based on WeChat Mini Program

Wemint:Tainting Sensitive Data Leaks in WeChat Mini-Programs

An IoT-Based Anti-Counterfeiting System Using Visual Features on QR Code

Application of WeChat Mini Program in Xindong Gate Project

A Measurement Study of Wechat Mini-Apps

Design and implementation of smart campus based on wechat mini program

Data Storage Analysis of Online Shopping Cart Based on WeChat Mini Program

A Three-Level QR Code Sharing Scheme Based on SLIC and Hamming Code.

Data Hiding Based on Mini Program Code

My Smartphone Recognizes Genuine QR Codes!

Utilizing Large LanguageModels to Detect Privacy Leaks in Mini-App Code