Wemint:Tainting Sensitive Data Leaks in WeChat Mini-Programs
Wemint:Tainting Sensitive Data Leaks in WeChat Mini-Programs
复制标题
DOI：
10.1109/ase56229.2023.00151
复制
发表时间：
2023-09
期刊：
影响因子：
--
通讯作者：
Shi Meng;Liu Wang;Shenao Wang;Kailong Wang;Xusheng Xiao;Guangdong Bai;Haoyu Wang
中科院分区：
文献类型：
--
作者：
Shi Meng;Liu Wang;Shenao Wang;Kailong Wang;Xusheng Xiao;Guangdong Bai;Haoyu Wang
迷你程序（MiniApps）是在微信等主机应用程序中运行的全功能移动应用程序的轻量级版本，由于其简化和方便的用户体验而越来越受欢迎。然而，MiniApps引发了新的安全和隐私问题，因为它们可以访问部分或全部主机应用程序的系统资源，包括敏感的个人数据。虽然污染检测已被证明在解决这类问题方面是有效的，但现有的移动应用程序污染检测技术不能直接应用于MiniApps。主要原因是MiniApps的关键逻辑通常是用javascript编写的，它的内在特征（函数级作用域、动态类型、同步编程和代码混淆）阻止了现有的污染检测技术精确地传播污染。为了解决这个问题，我们提出了一种新的污染检测技术，Wemint，它可以检测MiniApps中的敏感信息泄漏。具体来说，Wemint通过基于MiniApps和javascript的操作原理构建基于上下文的模型来促进污染传播，并通过在污染规则中显式地建模回调来解决异步函数调用。此外，由于在污染检测期间采用了抽象语法树（ast）来表示代码，Wemint对常用的代码混淆表现出更好的鲁棒性。实验结果表明，Wemint可以有效检测微信MiniApps中的敏感信息泄漏，并跟踪敏感数据流的路径。通过将Wemint应用于超过2万个可疑的MiniApps，我们发现其中超过7.5万个（36.5%）存在敏感数据泄露，并且Wemint在检测这些泄漏方面优于最先进的基于DoubleX的技术。
Mini-programs (MiniApps), lightweight versions of full-featured mobile apps that run inside a host app such as WeChat, have become increasingly popular due to their simplified and convenient user experiences. However, MiniApps raise new security and privacy concerns as they can access partially or all of host apps' system resources, including sensitive personal data. While taint detection has been proven effective in addressing this kind of concerns, existing taint detection techniques for mobile apps cannot be directly applied to MiniApps. The main reason is that the key logics of MiniApps are usually written in J avaScript, and its intrinsic characteristics (function-level scope, dynamic types, synchronous programming, and code obfuscation) prevent existing taint detection techniques from precisely propagating the taints. To address this problem, we propose a novel taint detection technique, Wemint, that detects sensitive information leaks in MiniApps. Specifically, Wemint facilitates taint propagation via building a context-based model based on the operational prin-ciple of MiniApps and J avaScript, and addresses asynchronous function calls by modeling their callbacks explicitly in taint rules. In addition, due to the adoption of Abstract Syntax Trees (ASTs) for code representation during taint detection, Wemint exhibits better robustness against the commonly-applied code obfuscation. Our experimental results show that Wemint can effectively detect sensitive information leaks in WeChat MiniApps, as well as trace the path of sensitive data flows. By applying Wemint to over 20K suspicious MiniApps, we found that over 7.5K (36.5 %) of them have sensitive data leaks, and Wemint outperforms the state-of-the-art DoubleX based techniques in detecting these leaks.