一句话：提出面向微信小程序的污点检测技术 Wemint，通过上下文建模与异步回调建模，有效发现并追踪敏感数据泄露。
微信小程序可访问宿主应用敏感资源，带来隐私泄露风险；但现有移动应用污点检测难以直接适用，因为小程序核心逻辑多用 JavaScript 编写，具有函数级作用域、动态类型、同步编程和代码混淆等特性，导致污点难以精确传播。本文提出 Wemint：基于小程序运行原理和 JavaScript 特性构建上下文模型进行污点传播，并在污点规则中显式建模异步函数回调；同时利用 AST 表示提升对常见代码混淆的鲁棒性。实验表明，Wemint 能有效检测微信小程序敏感信息泄露并追踪敏感数据流路径；在 2 万余个可疑小程序上发现超过 7.5K（36.5%）存在泄露，且优于基于 DoubleX 的现有技术。
Mini-programs (MiniApps), lightweight versions of full-featured mobile apps that run inside a host app such as WeChat, have become increasingly popular due to their simplified and convenient user experiences. However, MiniApps raise new security and privacy concerns as they can access partially or all of host apps' system resources, including sensitive personal data. While taint detection has been proven effective in addressing this kind of concerns, existing taint detection techniques for mobile apps cannot be directly applied to MiniApps. The main reason is that the key logics of MiniApps are usually written in J avaScript, and its intrinsic characteristics (function-level scope, dynamic types, synchronous programming, and code obfuscation) prevent existing taint detection techniques from precisely propagating the taints. To address this problem, we propose a novel taint detection technique, Wemint, that detects sensitive information leaks in MiniApps. Specifically, Wemint facilitates taint propagation via building a context-based model based on the operational prin-ciple of MiniApps and J avaScript, and addresses asynchronous function calls by modeling their callbacks explicitly in taint rules. In addition, due to the adoption of Abstract Syntax Trees (ASTs) for code representation during taint detection, Wemint exhibits better robustness against the commonly-applied code obfuscation. Our experimental results show that Wemint can effectively detect sensitive information leaks in WeChat MiniApps, as well as trace the path of sensitive data flows. By applying Wemint to over 20K suspicious MiniApps, we found that over 7.5K (36.5 %) of them have sensitive data leaks, and Wemint outperforms the state-of-the-art DoubleX based techniques in detecting these leaks.
@inproceedings{MengWWWXBW23,
title = {Wemint:Tainting Sensitive Data Leaks in WeChat Mini-Programs},
author = {Shi Meng and Liu Wang and Shenao Wang and Kailong Wang and Xusheng Xiao and Guangdong Bai and Haoyu Wang},
booktitle = {ASE},
year = {2023},
doi = {10.1109/ase56229.2023.00151}
}