TY - GEN
T1 - MUID
T2 - 2023 ACM Workshop on Secure and Trustworthy Superapps, SaTS 2023
AU - Yan, Ziqiang
AU - Fan, Ming
AU - Wang, Yin
AU - Shi, Jifei
AU - Wang, Haoran
AU - Liu, Ting
N1 - Publisher Copyright:
© 2023 ACM.
PY - 2023/11/26
Y1 - 2023/11/26
N2 - In recent years, the rise of miniapps, lightweight applications based on WebView, has become a prominent trend in mobile app development. This trend has rapidly expanded on popular social platforms like WeChat, TikTok, Grab, and even Snapchat. In these miniapps, user data is pivotal for providing personalized services and improving user experience. However, there are still shortcomings in identifying the source of sensitive data in miniapps. This paper introduces MUID, an innovative method for detecting user input data in miniapps. MUID integrates an engine that can dynamically test miniapps to overcome the challenges in WebView page extraction, uses a hybrid analysis approach to identify sensitive components, and infers the type of information collected based on contextual hint words. In the evaluation of MUID across 30 popular miniapps randomly selected on WeChat, we demonstrated its high dynamic testing efficiency and its capability to recognize components with a recall rate of 95.74% and a precision rate of 81.32%. The overall precision of MUID is 78.31%, and the recall rate is 92.19%, demonstrating the effectiveness of MUID in conducting security and privacy analyses.
AB - In recent years, the rise of miniapps, lightweight applications based on WebView, has become a prominent trend in mobile app development. This trend has rapidly expanded on popular social platforms like WeChat, TikTok, Grab, and even Snapchat. In these miniapps, user data is pivotal for providing personalized services and improving user experience. However, there are still shortcomings in identifying the source of sensitive data in miniapps. This paper introduces MUID, an innovative method for detecting user input data in miniapps. MUID integrates an engine that can dynamically test miniapps to overcome the challenges in WebView page extraction, uses a hybrid analysis approach to identify sensitive components, and infers the type of information collected based on contextual hint words. In the evaluation of MUID across 30 popular miniapps randomly selected on WeChat, we demonstrated its high dynamic testing efficiency and its capability to recognize components with a recall rate of 95.74% and a precision rate of 81.32%. The overall precision of MUID is 78.31%, and the recall rate is 92.19%, demonstrating the effectiveness of MUID in conducting security and privacy analyses.
KW - miniapp security
KW - mobile security
KW - privacy
KW - user input
UR - https://www.scopus.com/pages/publications/85179550858
U2 - 10.1145/3605762.3624429
DO - 10.1145/3605762.3624429
M3 - 会议稿件
AN - SCOPUS:85179550858
T3 - SaTS 2023 - Proceedings of the 2023 ACM Workshop on Secure and Trustworthy Superapps
SP - 17
EP - 21
BT - SaTS 2023 - Proceedings of the 2023 ACM Workshop on Secure and Trustworthy Superapps
PB - Association for Computing Machinery, Inc
Y2 - 26 November 2023
ER -