MiniTracker: Large-Scale Sensitive Information Tracking in Mini Apps

Wei Li

doi:10.1109/TDSC.2023.3299945

MiniTracker: Large-Scale Sensitive Information Tracking in Mini Apps

2024-07-01

1

PRE

AI

DOI：10.1109/TDSC.2023.3299945

原文链接

原文求助

摘要

En 中文

Running on host mobile applications, mini apps have gained increasing popularity these days for its convenience in installation and usage. However, being easy to use allows mini apps to freely access a large amount of user information, mostly without close inspection of privacy violations. Hence it becomes a crucial issue to automatically track sensitive flows in mini apps. Although flow analysis has been widely studied, unique challenges emerge: the analysis tool should not only handle mini app-specific features such as flows that interweave between rendering and logic, and asynchronous executions, but also deal with problems raised by Javascript development: the performance tradeoff between precision and efficiency, and function aliases. To this end, we propose MiniTracker, an automatic sensitive flow tracking tool which well handles mini app features, constructs assignment flow graphs as common representation across different host apps, searches function aliases, and analyzes the graph by property chains. We show our design choices achieve a sweet spot in the tradeoff between precision and efficiency, with superior performance compared to the state-of-the-art. We also perform a large-scale study on 150 k mini apps, which reveals the common leakage patterns and offers insights into the privacy threats of mini apps.

Keyword:

Privacy

Social networking (online)

Message services

Data privacy

Web and internet services

Rendering (computer graphics)

Codes

Mobile applications

mini apps

privacy leakage

MiniTracker: Large-Scale Sensitive Information Tracking in Mini Apps

摘要

期刊

机构

引用论文