不要泄露你的密钥：小程序中AppSecret泄露的理解、测量与利用
Don't Leak Your Keys: Understanding, Measuring, and Exploiting the AppSecret Leaks in Mini-Programs
AI总结：
该研究针对微信等平台小程序的appsecret主密钥前端泄露风险，通过爬测数百万个小程序发现大量泄露案例，证实其可引发多种严重攻击，并推动厂商修复漏洞。
摘要：
微信移动端小程序自2017年推出以来已广受欢迎，规模已与谷歌应用商店中的安卓应用相当。与谷歌类似，微信的运营方腾讯提供API支持小程序开发，还在微信应用内运营着小程序市场。然而，小程序API通常会在社交网络平台内管理敏感用户数据，涉及微信客户端和云端两端。为此，平台已部署密码学协议以保障数据访问安全。本文中我们证明，微信本应要求用于小程序身份认证的“appsecret”主密钥仅在小程序后端使用。若该密钥在小程序前端泄露，会对小程序开发者和用户造成灾难性攻击。我们利用小程序爬虫和主密钥泄露检测工具，对爬取到的3450586个小程序进行测量，发现其中40880个存在主密钥泄露问题，攻击者可借此实施账户劫持、优惠滥用、服务盗用等多种攻击。我们通过对百度小程序的测试和测量也确认了类似问题。我们已将这些漏洞及受影响小程序列表上报给腾讯和百度，获得了漏洞赏金，腾讯近期还基于我们的发现发布了一款新API以防御此类攻击。
英文摘要：
Mobile mini-programs in WeChat have gained significant popularity since their debut in 2017, reaching a scale similar to that of Android apps in the Play Store. Like Google, Tencent, the provider of WeChat, offers APIs to support the development of mini-programs and also maintains a mini-program market within the WeChat app. However, mini-program APIs often manage sensitive user data within the social network platform, both on the WeChat client app and in the cloud. As a result, cryptographic protocols have been implemented to secure data access. In this paper, we demonstrate that WeChat should have required the use of the "appsecret" master key, which is used to authenticate a mini-program, to be used only in the mini-program back-end. If this key is leaked in the front-end of the mini-programs, it can lead to catastrophic attacks on both mini-program developers and users. Using a mini-program crawler and a master key leakage inspector, we measured 3,450,586 crawled mini-programs and found that 40,880 of them had leaked their master keys, allowing attackers to carry out various attacks such as account hijacking, promotion abuse, and service theft. Similar issues were confirmed through testing and measuring of Baidu mini-programs too. We have reported these vulnerabilities and the list of vulnerable mini-programs to Tencent and Baidu, which awarded us with bug bounties, and also Tencent recently released a new API to defend against these attacks based on our findings.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
