WEMINT: Tainting Sensitive Data Leaks in WeChat Mini-Programs

Mini-programs (MiniApps), lightweight versions of full-featured mobile apps that run inside a host app such as WeChat, have become increasingly popular due to their simplified and convenient user experiences. However, MiniApps raise new security and privacy concerns as they can access partially or all of host apps' system resources, including sensitive personal data. While taint detection has been proven effective in addressing this kind of concerns, existing taint detection techniques for mobile apps cannot be directly applied to MiniApps. The main reason is that the key logics of MiniApps are usually written in JavaScript, and its intrinsic characteristics (function-level scope, dynamic types, synchronous programming, and code obfuscation) prevent existing taint detection techniques from precisely propagating the taints. To address this problem, we propose a novel taint detection technique, WEMINT, that detects sensitive information leaks in MiniApps. Specifically, WEMINT facilitates taint propagation via building a context-based model based on the operational principle of MiniApps and JavaScript, and addresses asynchronous function calls by modeling their callbacks explicitly in taint rules. In addition, due to the adoption of Abstract Syntax Trees (ASTs) for code representation during taint detection, WEMINT exhibits better robustness against the commonly-applied code obfuscation. Our experimental results show that WEMINT can effectively detect sensitive information leaks in WeChat MiniApps, as well as trace the path of sensitive data flows. By applying WEMINT to over 20K suspicious MiniApps, we found that over 7.5K (36.5%) of them have sensitive data leaks, and WEMINT outperforms the state-of-the-art DoubleX based techniques in detecting these leaks.