[Paper Review] Don't Leak Your Keys: Understanding, Measuring, and Exploiting the AppSecret Leaks in Mini-Programs

Yue Zhang, Yuqing Yang+1 more|arXiv (Cornell University)|Jun 13, 2023

Advanced Malware Detection Techniques4 citations

TL;DR

This paper reveals that 40,880 out of 3.45 million WeChat mini-programs leaked their master keys (AppSecrets), enabling attackers to hijack user accounts, abuse promotions, and steal paid services. The authors developed a crawler and key inspector to measure leakage prevalence and disclosed findings to Tencent, leading to a new defensive API based on their recommendations.

ABSTRACT

Mobile mini-programs in WeChat have gained significant popularity since their debut in 2017, reaching a scale similar to that of Android apps in the Play Store. Like Google, Tencent, the provider of WeChat, offers APIs to support the development of mini-programs and also maintains a mini-program market within the WeChat app. However, mini-program APIs often manage sensitive user data within the social network platform, both on the WeChat client app and in the cloud. As a result, cryptographic protocols have been implemented to secure data access. In this paper, we demonstrate that WeChat should have required the use of the "appsecret" master key, which is used to authenticate a mini-program, to be used only in the mini-program back-end. If this key is leaked in the front-end of the mini-programs, it can lead to catastrophic attacks on both mini-program developers and users. Using a mini-program crawler and a master key leakage inspector, we measured 3,450,586 crawled mini-programs and found that 40,880 of them had leaked their master keys, allowing attackers to carry out various attacks such as account hijacking, promotion abuse, and service theft. Similar issues were confirmed through testing and measuring of Baidu mini-programs too. We have reported these vulnerabilities and the list of vulnerable mini-programs to Tencent and Baidu, which awarded us with bug bounties, and also Tencent recently released a new API to defend against these attacks based on our findings.

Motivation & Objective

• To understand the prevalence and impact of master key (AppSecret) leaks in WeChat mini-programs.
• To measure how many mini-programs expose their master keys in the untrusted front-end.
• To demonstrate real-world attacks possible due to leaked AppSecrets, including account hijacking and service theft.
• To analyze root causes of key leakage, especially among high-profile developers.
• To propose and validate countermeasures, leading to a new defensive API from Tencent.

Proposed method

• Built a mini-program crawler to collect and analyze 3,450,586 WeChat mini-programs.
• Developed a master key leakage inspector using static and dynamic analysis to detect AppSecrets in front-end code.
• Validated detected keys by testing API access to WeChat’s encrypted data and paid services.
• Conducted manual analysis on well-known mini-programs to confirm key leakage in production code.
• Reported vulnerabilities and lists of vulnerable apps to Tencent and Baidu, triggering responsible disclosure and bounties.
• Collaborated with Tencent to influence the design of a new security API to prevent future attacks.

Figure 1 . Sensitive data access protocols in WeChat mini-programs

Experimental results

Research questions

• RQ1 How prevalent is the leakage of master keys (AppSecrets) in WeChat mini-programs?
• RQ2 What are the real-world security consequences of leaked AppSecrets in the mini-program ecosystem?
• RQ3 Why do developers inadvertently expose master keys in the front-end despite known risks?
• RQ4 To what extent are high-profile and popular mini-programs affected by AppSecret leakage?
• RQ5 What systemic and technical countermeasures can prevent such leaks in the future?

Key findings

• 40,880 out of 3,450,586 analyzed WeChat mini-programs leaked their master keys, indicating a 1.18% leakage rate.
• The vulnerability affects not only obscure developers but also high-profile vendors such as Nestle, HP, and Tencent itself.
• Attackers can use leaked AppSecrets to decrypt user-encrypted data, including sensitive information like phone numbers, IDs, and shipping addresses.
• Leaked keys enable financial abuse, such as manipulating group-buying promotions to gain cashback and coupons.
• Attackers can consume paid services (e.g., OCR) on behalf of victims, leading to service theft and financial loss.
• Tencent responded by releasing a new defensive API based on the authors’ recommendations, validating the practical impact of the findings.

Figure 2 . Cloud services access protocols in WeChat mini-programs