{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,9,10]],"date-time":"2026-09-10T23:23:58Z","timestamp":1789082638702,"version":"build-2803163510"},"publisher-location":"New York, NY, USA","reference-count":51,"publisher":"ACM","license":[{"start":{"date-parts":[[2019,7,2]],"date-time":"2019-07-02T00:00:00Z","timestamp":1562025600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"funder":[{"DOI":"10.13039\/501100007156","name":"Innovation and Technology Commission - Hong Kong","doi-asserted-by":"publisher","award":["ITS\/216\/15"],"award-info":[{"award-number":["ITS\/216\/15"]}],"id":[{"id":"10.13039\/501100007156","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100005956","name":"Chinese University of Hong Kong","doi-asserted-by":"publisher","award":["TBF18ENG001 & PIEF3133043"],"award-info":[{"award-number":["TBF18ENG001 & PIEF3133043"]}],"id":[{"id":"10.13039\/501100005956","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/100005801","name":"Facebook","doi-asserted-by":"publisher","award":["2018 Facebook\/USENIX Internet Defense Prize"],"award-info":[{"award-number":["2018 Facebook\/USENIX Internet Defense Prize"]}],"id":[{"id":"10.13039\/100005801","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2019,7,2]]},"DOI":"10.1145\/3321705.3329801","type":"proceedings-article","created":{"date-parts":[[2019,7,9]],"date-time":"2019-07-09T08:53:20Z","timestamp":1562662400000},"page":"269-282","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":20,"title":["MoSSOT: An Automated Blackbox Tester for Single Sign-On Vulnerabilities in Mobile Applications"],"prefix":"10.1145","author":[{"given":"Shangcheng","family":"Shi","sequence":"first","affiliation":[{"name":"The Chinese University of Hong Kong, Hong Kong, Hong Kong"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Xianbo","family":"Wang","sequence":"additional","affiliation":[{"name":"The Chinese University of Hong Kong, Hong Kong, Hong Kong"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Wing Cheong","family":"Lau","sequence":"additional","affiliation":[{"name":"The Chinese University of Hong Kong, Hong Kong, Hong Kong"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"320","published-online":{"date-parts":[[2019,7,2]]},"reference":[{"key":"e_1_3_2_1_1_1","doi-asserted-by":"publisher","DOI":"10.1145\/2351676.2351717"},{"key":"e_1_3_2_1_2_1","unstructured":"Apkpure. 2017. Apkpure. https:\/\/apkpure.com\/.  Apkpure. 2017. Apkpure. https:\/\/apkpure.com\/."},{"key":"e_1_3_2_1_3_1","doi-asserted-by":"publisher","DOI":"10.1145\/2544173.2509549"},{"key":"e_1_3_2_1_4_1","volume-title":"Prateek Saxena, Jun Sun, Yang Liu, and Jin Song Dong.","author":"Bai Guangdong","year":"2013","unstructured":"Guangdong Bai , Jike Lei , Guozhu Meng , Sai Sathyanarayan Venkatraman , Prateek Saxena, Jun Sun, Yang Liu, and Jin Song Dong. 2013 . AUTHSCAN : Automatic Extraction of Web Authentication Protocols from Implementations. In NDSS 13. Guangdong Bai, Jike Lei, Guozhu Meng, Sai Sathyanarayan Venkatraman, Prateek Saxena, Jun Sun, Yang Liu, and Jin Song Dong. 2013. AUTHSCAN: Automatic Extraction of Web Authentication Protocols from Implementations. In NDSS13."},{"key":"e_1_3_2_1_5_1","doi-asserted-by":"publisher","DOI":"10.1109\/CSF.2012.27"},{"key":"e_1_3_2_1_6_1","volume-title":"Brahmastra: Driving Apps to Test the Security of Third-Party Components.. In USENIX14.","author":"Bhoraskar Ravi","year":"2014","unstructured":"Ravi Bhoraskar , Seungyeop Han , Jinseong Jeon , Tanzirul Azim , Shuo Chen , Jaeyeon Jung , Suman Nath , Rui Wang , and David Wetherall . 2014 . Brahmastra: Driving Apps to Test the Security of Third-Party Components.. In USENIX14. Ravi Bhoraskar, Seungyeop Han, Jinseong Jeon, Tanzirul Azim, Shuo Chen, Jaeyeon Jung, Suman Nath, Rui Wang, and David Wetherall. 2014. Brahmastra: Driving Apps to Test the Security of Third-Party Components.. In USENIX14."},{"key":"e_1_3_2_1_7_1","unstructured":"Bruno Blanchet. 2014. The ProVerif homepage. http:\/\/prosecco.gforge.inria.fr\/personal\/bblanche\/proverif\/  Bruno Blanchet. 2014. The ProVerif homepage. http:\/\/prosecco.gforge.inria.fr\/personal\/bblanche\/proverif\/"},{"key":"e_1_3_2_1_8_1","doi-asserted-by":"publisher","DOI":"10.1145\/3197231.3197243"},{"key":"e_1_3_2_1_10_1","doi-asserted-by":"publisher","DOI":"10.1145\/2660267.2660323"},{"key":"e_1_3_2_1_11_1","doi-asserted-by":"publisher","DOI":"10.1145\/2544173.2509552"},{"key":"e_1_3_2_1_12_1","volume-title":"FrauDroid: An Accurate and Scalable Approach to Automated Mobile Ad Fraud Detection. arXiv preprint arXiv:1709.01213","author":"Dong Feng","year":"2017","unstructured":"Feng Dong , Haoyu Wang , Yuanchun Li , Yao Guo , Li Li , Shaodong Zhang , and Guoai Xu. 2017. FrauDroid: An Accurate and Scalable Approach to Automated Mobile Ad Fraud Detection. arXiv preprint arXiv:1709.01213 ( 2017 ). Feng Dong, Haoyu Wang, Yuanchun Li, Yao Guo, Li Li, Shaodong Zhang, and Guoai Xu. 2017. FrauDroid: An Accurate and Scalable Approach to Automated Mobile Ad Fraud Detection. arXiv preprint arXiv:1709.01213 (2017)."},{"key":"e_1_3_2_1_13_1","unstructured":"Facebook. 2017. Facebook SSO developer document. https:\/\/developers.facebook.com\/docs\/facebook-login\/.  Facebook. 2017. Facebook SSO developer document. https:\/\/developers.facebook.com\/docs\/facebook-login\/."},{"key":"e_1_3_2_1_14_1","volume-title":"A Comprehensive Formal Security Analysis of OAuth 2.0. CCS16","author":"Fett Daniel","year":"2016","unstructured":"Daniel Fett , Ralf K\u00fcsters , and Guido Schmitz . 2016. A Comprehensive Formal Security Analysis of OAuth 2.0. CCS16 ( 2016 ). Daniel Fett, Ralf K\u00fcsters, and Guido Schmitz. 2016. A Comprehensive Formal Security Analysis of OAuth 2.0. CCS16 (2016)."},{"key":"e_1_3_2_1_15_1","unstructured":"Genymotion. 2017. Genymotion. https:\/\/www.genymotion.com\/  Genymotion. 2017. Genymotion. https:\/\/www.genymotion.com\/"},{"key":"e_1_3_2_1_16_1","unstructured":"Google. 2017a. Android webview. http:\/\/developer.android.com\/reference\/android\/webkit\/WebView.html  Google. 2017a. Android webview. http:\/\/developer.android.com\/reference\/android\/webkit\/WebView.html"},{"key":"e_1_3_2_1_17_1","unstructured":"Google. 2017b. AVD. https:\/\/developer.android.com\/studio\/run\/emulator.  Google. 2017b. AVD. https:\/\/developer.android.com\/studio\/run\/emulator."},{"key":"e_1_3_2_1_18_1","unstructured":"Google. 2017c. Monkey. http:\/\/developer.android.com\/tools\/help\/monkey  Google. 2017c. Monkey. http:\/\/developer.android.com\/tools\/help\/monkey"},{"key":"e_1_3_2_1_19_1","doi-asserted-by":"publisher","DOI":"10.1145\/2594368.2594390"},{"key":"e_1_3_2_1_20_1","doi-asserted-by":"crossref","unstructured":"Dick Hardt. 2012. The OAuth 2.0 authorization framework.  Dick Hardt. 2012. The OAuth 2.0 authorization framework.","DOI":"10.17487\/rfc6749"},{"key":"e_1_3_2_1_21_1","doi-asserted-by":"publisher","DOI":"10.1145\/2660460.2660463"},{"key":"e_1_3_2_1_22_1","doi-asserted-by":"crossref","unstructured":"Jonathan Jacky. 2011. PyModel: Model-based testing in Python. In SciPy11.  Jonathan Jacky. 2011. PyModel: Model-based testing in Python. In SciPy11.","DOI":"10.25080\/Majora-ebaa42b7-008"},{"key":"e_1_3_2_1_23_1","unstructured":"Wang Jing. 2017. Covert Redirect Vulnerability.  Wang Jing. 2017. Covert Redirect Vulnerability."},{"key":"e_1_3_2_1_25_1","unstructured":"Michael Jones Paul Tarjan Yaron Goland Nat Sakimura John Bradley John Panzer and Dirk Balfanz. 2012. JSON Web Token (JWT). (2012).  Michael Jones Paul Tarjan Yaron Goland Nat Sakimura John Bradley John Panzer and Dirk Balfanz. 2012. JSON Web Token (JWT). (2012)."},{"key":"e_1_3_2_1_26_1","doi-asserted-by":"publisher","DOI":"10.1145\/3106237.3117769"},{"key":"e_1_3_2_1_27_1","unstructured":"Wanpeng Li Chris J Mitchell and Tom Chen. 2018. Your code is my code: Exploiting a common weakness in OAuth 2.0 implementations.  Wanpeng Li Chris J Mitchell and Tom Chen. 2018. Your code is my code: Exploiting a common weakness in OAuth 2.0 implementations."},{"key":"e_1_3_2_1_28_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-40667-1_18"},{"key":"e_1_3_2_1_29_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICSE-C.2017.8"},{"key":"e_1_3_2_1_30_1","unstructured":"Torsten Lodderstedt Mark McGloin and Phil Hunt. 2013. OAuth 2.0 threat model and security considerations.  Torsten Lodderstedt Mark McGloin and Phil Hunt. 2013. OAuth 2.0 threat model and security considerations."},{"key":"e_1_3_2_1_31_1","doi-asserted-by":"publisher","DOI":"10.1145\/2491411.2491450"},{"key":"e_1_3_2_1_32_1","unstructured":"mitmproxy. 2017. Man in the Middle Proxy. https:\/\/mitmproxy.org\/  mitmproxy. 2017. Man in the Middle Proxy. https:\/\/mitmproxy.org\/"},{"key":"e_1_3_2_1_33_1","unstructured":"MoSSOT. 2019. MoSSOT. https:\/\/github.com\/MoSSOT\/MoSSOT.  MoSSOT. 2019. MoSSOT. https:\/\/github.com\/MoSSOT\/MoSSOT."},{"key":"e_1_3_2_1_34_1","doi-asserted-by":"publisher","DOI":"10.1145\/2435349.2435379"},{"key":"e_1_3_2_1_35_1","doi-asserted-by":"publisher","DOI":"10.1145\/3197231.3197241"},{"key":"e_1_3_2_1_36_1","unstructured":"Natsuhiko Sakimura J Bradley M Jones B de Medeiros and C Mortimore. 2014. OpenID Connect core 1.0. (2014).  Natsuhiko Sakimura J Bradley M Jones B de Medeiros and C Mortimore. 2014. OpenID Connect core 1.0. (2014)."},{"key":"e_1_3_2_1_37_1","doi-asserted-by":"publisher","DOI":"10.1109\/MobServ.2014.15"},{"key":"e_1_3_2_1_38_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-20550-2_13"},{"key":"e_1_3_2_1_39_1","unstructured":"Sina. 2017. Sina Developer Documentation. http:\/\/open.weibo.com\/wiki\/  Sina. 2017. Sina Developer Documentation. http:\/\/open.weibo.com\/wiki\/"},{"key":"e_1_3_2_1_40_1","unstructured":"Softonic. 2017. Softonic. https:\/\/bit.ly\/2DUAjhp.  Softonic. 2017. Softonic. https:\/\/bit.ly\/2DUAjhp."},{"key":"e_1_3_2_1_41_1","doi-asserted-by":"publisher","DOI":"10.1145\/3106237.3106298"},{"key":"e_1_3_2_1_42_1","doi-asserted-by":"publisher","DOI":"10.1145\/2382196.2382238"},{"key":"e_1_3_2_1_43_1","unstructured":"Tencent. 2017. WeChat SSO developer document. https:\/\/open.weixin.qq.com.  Tencent. 2017. WeChat SSO developer document. https:\/\/open.weixin.qq.com."},{"key":"e_1_3_2_1_44_1","unstructured":"Wandoujia. 2017. Wandoujia App Market. https:\/\/www.wandoujia.com\/.  Wandoujia. 2017. Wandoujia App Market. https:\/\/www.wandoujia.com\/."},{"key":"e_1_3_2_1_45_1","doi-asserted-by":"publisher","DOI":"10.1145\/2991079.2991105"},{"key":"e_1_3_2_1_46_1","doi-asserted-by":"publisher","DOI":"10.1145\/2818000.2818024"},{"key":"e_1_3_2_1_47_1","unstructured":"Xposed. 2017. Xposed Module Repository. https:\/\/repo.xposed.info  Xposed. 2017. Xposed Module Repository. https:\/\/repo.xposed.info"},{"key":"e_1_3_2_1_48_1","volume-title":"Wing Cheong Lau, and Shangcheng Shi","author":"Yang Ronghai","year":"2017","unstructured":"Ronghai Yang , Wing Cheong Lau, and Shangcheng Shi . 2017 . Breaking and Fixing Mobile App Authentication with OAuth2.0-based Protocols. In ACNS 17. Ronghai Yang, Wing Cheong Lau, and Shangcheng Shi. 2017. Breaking and Fixing Mobile App Authentication with OAuth2.0-based Protocols. In ACNS17."},{"key":"e_1_3_2_1_49_1","doi-asserted-by":"publisher","DOI":"10.1145\/2897845.2897874"},{"key":"e_1_3_2_1_50_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICECCS.2015.20"},{"key":"e_1_3_2_1_51_1","unstructured":"E. YOO. 2017. Technode. https:\/\/bit.ly\/2Zi1JVn.  E. YOO. 2017. Technode. https:\/\/bit.ly\/2Zi1JVn."},{"key":"e_1_3_2_1_52_1","unstructured":"Yuchen Zhou and David Evans. 2014. SSOScan: Automated Testing of Web Applications for Single Sign-On Vulnerabilities. In USENIX14.   Yuchen Zhou and David Evans. 2014. SSOScan: Automated Testing of Web Applications for Single Sign-On Vulnerabilities. In USENIX14."},{"key":"e_1_3_2_1_53_1","doi-asserted-by":"publisher","DOI":"10.1145\/3133956.3134089"}],"event":{"name":"Asia CCS '19: ACM Asia Conference on Computer and Communications Security","location":"Auckland New Zealand","acronym":"Asia CCS '19","sponsor":["SIGSAC ACM Special Interest Group on Security, Audit, and Control"]},"container-title":["Proceedings of the 2019 ACM Asia Conference on Computer and Communications Security"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3321705.3329801","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3321705.3329801","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,17]],"date-time":"2025-06-17T19:54:39Z","timestamp":1750190079000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3321705.3329801"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2019,7,2]]},"references-count":51,"alternative-id":["10.1145\/3321705.3329801","10.1145\/3321705"],"URL":"https:\/\/doi.org\/10.1145\/3321705.3329801","relation":{},"subject":[],"published":{"date-parts":[[2019,7,2]]},"assertion":[{"value":"2019-07-02","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}