[论文解读] Don't Leak Your Keys: Understanding, Measuring, and Exploiting the AppSecret Leaks in Mini-Programs

Yue Zhang, Yuqing Yang+1 more|arXiv (Cornell University)|Jun 13, 2023

Advanced Malware Detection Techniques被引用 4

一句话总结

本论文揭示，345万个微信小程序中有40,880个泄露了其主密钥（AppSecret），攻击者可借此劫持用户账户、滥用促销活动并窃取付费服务。作者开发了爬虫与密钥检测工具，用于测量泄露的普遍性，并已向腾讯报告，促使腾讯基于其建议推出了新的防御性API。

ABSTRACT

Mobile mini-programs in WeChat have gained significant popularity since their debut in 2017, reaching a scale similar to that of Android apps in the Play Store. Like Google, Tencent, the provider of WeChat, offers APIs to support the development of mini-programs and also maintains a mini-program market within the WeChat app. However, mini-program APIs often manage sensitive user data within the social network platform, both on the WeChat client app and in the cloud. As a result, cryptographic protocols have been implemented to secure data access. In this paper, we demonstrate that WeChat should have required the use of the "appsecret" master key, which is used to authenticate a mini-program, to be used only in the mini-program back-end. If this key is leaked in the front-end of the mini-programs, it can lead to catastrophic attacks on both mini-program developers and users. Using a mini-program crawler and a master key leakage inspector, we measured 3,450,586 crawled mini-programs and found that 40,880 of them had leaked their master keys, allowing attackers to carry out various attacks such as account hijacking, promotion abuse, and service theft. Similar issues were confirmed through testing and measuring of Baidu mini-programs too. We have reported these vulnerabilities and the list of vulnerable mini-programs to Tencent and Baidu, which awarded us with bug bounties, and also Tencent recently released a new API to defend against these attacks based on our findings.

研究动机与目标

• 了解微信小程序中主密钥（AppSecret）泄露的普遍性及其影响。
• 衡量有多少小程序在不受信任的前端代码中暴露其主密钥。
• 展示由于AppSecret泄露而可能发生的实际攻击，包括账户劫持和服务盗窃。
• 分析密钥泄露的根本原因，尤其是针对知名开发者的案例。
• 提出并验证应对措施，最终促成腾讯推出新的防御性API。

提出的方法

• 构建了一个小程序爬虫，用于收集并分析3,450,586个微信小程序。
• 开发了主密钥泄露检测工具，结合静态与动态分析技术，检测前端代码中的AppSecret。
• 通过测试对微信加密数据和付费服务的API访问，验证检测到的密钥。
• 对知名小程序进行人工分析，确认生产代码中存在密钥泄露。
• 向腾讯和百度报告漏洞及受影响应用列表，触发负责任的披露流程并获得奖励。
• 与腾讯合作，影响新安全API的设计，以防止未来类似攻击。

Figure 1 . Sensitive data access protocols in WeChat mini-programs

实验结果

研究问题

• RQ1 微信小程序中主密钥（AppSecret）的泄露普遍程度如何？
• RQ2 泄露的AppSecret在小程序生态系统中会造成哪些实际安全后果？
• RQ3 为何开发者在明知风险的情况下仍会无意中在前端暴露主密钥？
• RQ4 高知名度和高人气的小程序在AppSecret泄露方面受到多大程度的影响？
• RQ5 未来可采取哪些系统性与技术性对策来预防此类泄露？

主要发现

• 在分析的3,450,586个微信小程序中，有40,880个泄露了其主密钥，泄露率为1.18%。
• 该漏洞不仅影响普通开发者，也波及知名厂商，如雀巢、惠普以及腾讯自身。
• 攻击者可利用泄露的AppSecret解密用户加密数据，包括电话号码、身份证号和收货地址等敏感信息。
• 泄露的密钥可被用于金融滥用，例如操纵拼团促销活动以获取返现和优惠券。
• 攻击者可代表受害者使用付费服务（如OCR），导致服务被盗用和经济损失。
• 腾讯已根据作者建议推出新的防御性API，验证了本研究的实际影响。

Figure 2 . Cloud services access protocols in WeChat mini-programs