English (United Kingdom)

https://curated-unify.zendy.io/wp-json/zendy-region/v1/featured_content/oa?rat=en

https://curated-unify.zendy.io/wp-json/zendy-region/v1/highlighted_journal/

Global: Zendy Plus annual

Presents the access of premium content as premium feature

Premium Content

Presents the keyphrase highlighting as premium feature

Keyphrase Highlighting

Presents the summarisation as premium feature

Summarisation

Insights

Presents the pdf analysis as premium feature

PDF Analysis

Presents the zaia usage as premium feature

ZAIA

Global: Zendy Plus monthly

Global: Zendy Tools annual

Global: Zendy Tools monthly

Global: Zendy Free Plan

Mobile mini-programs in WeChat have gained significant popularity since theirdebut in 2017, reaching a scale similar to that of Android apps in the PlayStore. Like Google, Tencent, the provider of WeChat, offers APIs to support thedevelopment of mini-programs and also maintains a mini-program market withinthe WeChat app. However, mini-program APIs often manage sensitive user datawithin the social network platform, both on the WeChat client app and in thecloud. As a result, cryptographic protocols have been implemented to securedata access. In this paper, we demonstrate that WeChat should have required theuse of the "appsecret" master key, which is used to authenticate amini-program, to be used only in the mini-program back-end. If this key isleaked in the front-end of the mini-programs, it can lead to catastrophicattacks on both mini-program developers and users. Using a mini-program crawlerand a master key leakage inspector, we measured 3,450,586 crawled mini-programsand found that 40,880 of them had leaked their master keys, allowing attackersto carry out various attacks such as account hijacking, promotion abuse, andservice theft. Similar issues were confirmed through testing and measuring ofBaidu mini-programs too. We have reported these vulnerabilities and the list ofvulnerable mini-programs to Tencent and Baidu, which awarded us with bugbounties, and also Tencent recently released a new API to defend against theseattacks based on our findings.

Don't Leak Your Keys: Understanding, Measuring, and Exploiting the AppSecret Leaks in Mini-Programs