{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,8,22]],"date-time":"2025-08-22T05:14:01Z","timestamp":1755839641573,"version":"3.41.0"},"publisher-location":"New York, NY, USA","reference-count":44,"publisher":"ACM","license":[{"start":{"date-parts":[[2023,11,26]],"date-time":"2023-11-26T00:00:00Z","timestamp":1700956800000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"funder":[{"name":"National Key R&D Program of China","award":["2021YFB2701000"],"award-info":[{"award-number":["2021YFB2701000"]}]},{"name":"Knowledge Innovation Program of Wuhan-Basic Research"},{"name":"National Natural Science Foundation of China","award":["grant No.62072046"],"award-info":[{"award-number":["grant No.62072046"]}]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2023,11,26]]},"DOI":"10.1145\/3605762.3624433","type":"proceedings-article","created":{"date-parts":[[2023,11,23]],"date-time":"2023-11-23T04:01:12Z","timestamp":1700712072000},"page":"59-64","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":3,"title":["Potential Risks Arising from the Absence of Signature Verification in Miniapp Plugins"],"prefix":"10.1145","author":[{"ORCID":"https:\/\/orcid.org\/0000-0001-8793-5367","authenticated-orcid":false,"given":"Yanjie","family":"Zhao","sequence":"first","affiliation":[{"name":"Monash University, Melbourne, Australia"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-7786-0231","authenticated-orcid":false,"given":"Yue","family":"Zhang","sequence":"additional","affiliation":[{"name":"Drexel University, Philadelphia, PA, USA"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-1100-8633","authenticated-orcid":false,"given":"Haoyu","family":"Wang","sequence":"additional","affiliation":[{"name":"Huazhong University of Science and Technology, Wuhan, China"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"320","published-online":{"date-parts":[[2023,11,26]]},"reference":[{"key":"e_1_3_2_1_1_1","unstructured":"[n. d.]. Feature Page of Payment | Weixin public doc - developers.weixin.qq.com. https:\/\/developers.weixin.qq.com\/miniprogram\/en\/dev\/ framework\/plugin\/functional-pages\/request-payment.html. [Accessed 10-08- 2023].  [n. d.]. Feature Page of Payment | Weixin public doc - developers.weixin.qq.com. https:\/\/developers.weixin.qq.com\/miniprogram\/en\/dev\/ framework\/plugin\/functional-pages\/request-payment.html. [Accessed 10-08- 2023]."},{"key":"e_1_3_2_1_2_1","unstructured":"[n. d.]. Feature Page of Plug-Ins | Weixin public doc - developers.weixin.qq.com. https:\/\/developers.weixin.qq.com\/miniprogram\/en\/dev\/ framework\/plugin\/functional-pages.html. [Accessed 10-08--2023].  [n. d.]. Feature Page of Plug-Ins | Weixin public doc - developers.weixin.qq.com. https:\/\/developers.weixin.qq.com\/miniprogram\/en\/dev\/ framework\/plugin\/functional-pages.html. [Accessed 10-08--2023]."},{"key":"e_1_3_2_1_3_1","unstructured":"[n. d.]. Limitation on Calling APIs via Plug-Ins | Weixin public doc - developers.weixin.qq.com. https:\/\/developers.weixin.qq.com\/miniprogram\/en\/dev\/ framework\/plugin\/api-limit.html. [Accessed 10-08--2023].  [n. d.]. Limitation on Calling APIs via Plug-Ins | Weixin public doc - developers.weixin.qq.com. https:\/\/developers.weixin.qq.com\/miniprogram\/en\/dev\/ framework\/plugin\/api-limit.html. [Accessed 10-08--2023]."},{"key":"e_1_3_2_1_4_1","unstructured":"[n. d.]. Mobile payments mini-programs are key features of Chinese super apps - spglobal.com. https:\/\/www.spglobal.com\/marketintelligence\/en\/newsinsights\/research\/mobile-payments-mini-programs-are-key-features-ofchinese-super-apps. [Accessed 10-08--2023].  [n. d.]. Mobile payments mini-programs are key features of Chinese super apps - spglobal.com. https:\/\/www.spglobal.com\/marketintelligence\/en\/newsinsights\/research\/mobile-payments-mini-programs-are-key-features-ofchinese-super-apps. [Accessed 10-08--2023]."},{"key":"e_1_3_2_1_5_1","unstructured":"[n. d.]. Overview | Weixin public doc - developers.weixin.qq.com. https: \/\/developers.weixin.qq.com\/miniprogram\/en\/dev\/devtools\/devtools.html. [Accessed 10-08--2023].  [n. d.]. Overview | Weixin public doc - developers.weixin.qq.com. https: \/\/developers.weixin.qq.com\/miniprogram\/en\/dev\/devtools\/devtools.html. [Accessed 10-08--2023]."},{"key":"e_1_3_2_1_6_1","unstructured":"[n. d.]. Plug-in | Weixin public doc - developers.weixin.qq.com. https:\/\/ developers.weixin.qq.com\/miniprogram\/en\/dev\/framework\/plugin\/. [Accessed 10-08--2023].  [n. d.]. Plug-in | Weixin public doc - developers.weixin.qq.com. https:\/\/ developers.weixin.qq.com\/miniprogram\/en\/dev\/framework\/plugin\/. [Accessed 10-08--2023]."},{"key":"e_1_3_2_1_7_1","unstructured":"[n. d.]. Restrictions on the Use of Components by Plug-Ins | Weixin public doc - developers.weixin.qq.com. https:\/\/developers.weixin.qq.com\/miniprogram\/en\/ dev\/framework\/plugin\/component-limit.html. [Accessed 10-08--2023].  [n. d.]. Restrictions on the Use of Components by Plug-Ins | Weixin public doc - developers.weixin.qq.com. https:\/\/developers.weixin.qq.com\/miniprogram\/en\/ dev\/framework\/plugin\/component-limit.html. [Accessed 10-08--2023]."},{"key":"e_1_3_2_1_8_1","unstructured":"[n. d.]. Spoofing attack - Wikipedia - en.wikipedia.org. https:\/\/en.wikipedia.org\/ wiki\/Spoofing_attack. [Accessed 10-08--2023].  [n. d.]. Spoofing attack - Wikipedia - en.wikipedia.org. https:\/\/en.wikipedia.org\/ wiki\/Spoofing_attack. [Accessed 10-08--2023]."},{"key":"e_1_3_2_1_9_1","unstructured":"[n. d.]. Weixin public doc - developers.weixin.qq.com. https:\/\/developers.weixin. qq.com\/miniprogram\/en\/dev\/framework\/. [Accessed 10-08--2023].  [n. d.]. Weixin public doc - developers.weixin.qq.com. https:\/\/developers.weixin. qq.com\/miniprogram\/en\/dev\/framework\/. [Accessed 10-08--2023]."},{"key":"e_1_3_2_1_10_1","volume-title":"Prateek Saxena, Jun Sun, Yang Liu, and Jin Song Dong.","author":"Bai Guangdong","year":"2013","unstructured":"Guangdong Bai , Jike Lei , Guozhu Meng , Sai Sathyanarayan Venkatraman , Prateek Saxena, Jun Sun, Yang Liu, and Jin Song Dong. 2013 . Authscan : Automatic extraction of web authentication protocols from implementations. (2013). Guangdong Bai, Jike Lei, Guozhu Meng, Sai Sathyanarayan Venkatraman, Prateek Saxena, Jun Sun, Yang Liu, and Jin Song Dong. 2013. Authscan: Automatic extraction of web authentication protocols from implementations. (2013)."},{"key":"e_1_3_2_1_11_1","doi-asserted-by":"publisher","DOI":"10.1145\/2660267.2660323"},{"key":"e_1_3_2_1_12_1","volume-title":"The value of WeChat as a source of information on the COVID-19 in China. Preprint]","author":"Chen Xin","year":"2020","unstructured":"Xin Chen , Xi Zhou , Huan Li , Jinlan Li , and Hua Jiang . 2020. The value of WeChat as a source of information on the COVID-19 in China. Preprint] . Bull World Health Organ 30 ( 2020 ). Xin Chen, Xi Zhou, Huan Li, Jinlan Li, and Hua Jiang. 2020. The value of WeChat as a source of information on the COVID-19 in China. Preprint]. Bull World Health Organ 30 (2020)."},{"key":"e_1_3_2_1_13_1","doi-asserted-by":"publisher","DOI":"10.1145\/3551349.3561343"},{"key":"e_1_3_2_1_14_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.dss.2016.10.002"},{"key":"e_1_3_2_1_15_1","volume-title":"32nd USENIX Security Symposium (USENIX Security 23)","author":"Han Xing","year":"2023","unstructured":"Xing Han , Yuheng Zhang , Xue Zhang , Zeyuan Chen , Mingzhe Wang , Yiwei Zhang , Siqi Ma , Yu Yu , Elisa Bertino , and Juanru Li . 2023 . Medusa Attack: Exploring Security Hazards of {In-App} {QR} Code Scanning . In 32nd USENIX Security Symposium (USENIX Security 23) . 4607--4624. Xing Han, Yuheng Zhang, Xue Zhang, Zeyuan Chen, Mingzhe Wang, Yiwei Zhang, Siqi Ma, Yu Yu, Elisa Bertino, and Juanru Li. 2023. Medusa Attack: Exploring Security Hazards of {In-App} {QR} Code Scanning. In 32nd USENIX Security Symposium (USENIX Security 23). 4607--4624."},{"key":"e_1_3_2_1_16_1","series-title":"Journal of Physics: Conference Series","volume-title":"Analysis of the development of WeChat mini program","author":"Hao Lei","year":"2040","unstructured":"Lei Hao , Fucheng Wan , Ning Ma , and Yicheng Wang . 2018. Analysis of the development of WeChat mini program . In Journal of Physics: Conference Series , Vol. 1087 . IOP Publishing , 06 2040 . Lei Hao, Fucheng Wan, Ning Ma, and Yicheng Wang. 2018. Analysis of the development of WeChat mini program. In Journal of Physics: Conference Series, Vol. 1087. IOP Publishing, 062040."},{"key":"e_1_3_2_1_17_1","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2022.3168285"},{"key":"e_1_3_2_1_18_1","doi-asserted-by":"publisher","DOI":"10.1007\/s10515-021-00290-1"},{"key":"e_1_3_2_1_19_1","first-page":"54","article-title":"Construction of teaching model based on WeChat Mini-Program","volume":"16","author":"Liang Qinzhen","year":"2019","unstructured":"Qinzhen Liang and Chengyang Chang . 2019 . Construction of teaching model based on WeChat Mini-Program . International Journal of Science 16 , 1 (2019), 54 -- 59 . Qinzhen Liang and Chengyang Chang. 2019. Construction of teaching model based on WeChat Mini-Program. International Journal of Science 16, 1 (2019), 54--59.","journal-title":"International Journal of Science"},{"key":"e_1_3_2_1_20_1","first-page":"1","article-title":"Automatic protocol format reverse engineering through context-aware monitored execution","volume":"8","author":"Lin Zhiqiang","year":"2008","unstructured":"Zhiqiang Lin , Xuxian Jiang , Dongyan Xu , and Xiangyu Zhang . 2008 . Automatic protocol format reverse engineering through context-aware monitored execution .. In NDSS , Vol. 8. 1 -- 15 . Zhiqiang Lin, Xuxian Jiang, Dongyan Xu, and Xiangyu Zhang. 2008. Automatic protocol format reverse engineering through context-aware monitored execution.. In NDSS, Vol. 8. 1--15.","journal-title":"NDSS"},{"key":"e_1_3_2_1_21_1","doi-asserted-by":"publisher","DOI":"10.1145\/3533767.3534407"},{"key":"e_1_3_2_1_22_1","doi-asserted-by":"publisher","DOI":"10.1145\/3624737"},{"key":"e_1_3_2_1_23_1","doi-asserted-by":"publisher","DOI":"10.1109\/ISSRE55969.2022.00026"},{"key":"e_1_3_2_1_24_1","doi-asserted-by":"publisher","DOI":"10.1145\/3372297.3417255"},{"key":"e_1_3_2_1_25_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICSE43902.2021.00148"},{"key":"e_1_3_2_1_26_1","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2021.3050188"},{"key":"e_1_3_2_1_27_1","doi-asserted-by":"crossref","unstructured":"Meng Shi Liu Wang Shenao Wang Kailong Wang Xusheng Xiao Guangdong Bai and Haoyu Wang. 2023. WeMinT: Tainting Sensitive Data Leaks in WeChat Mini-Programs. In ASE.  Meng Shi Liu Wang Shenao Wang Kailong Wang Xusheng Xiao Guangdong Bai and Haoyu Wang. 2023. WeMinT: Tainting Sensitive Data Leaks in WeChat Mini-Programs. In ASE.","DOI":"10.1109\/ASE56229.2023.00151"},{"key":"e_1_3_2_1_28_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.ejon.2019.101707"},{"key":"e_1_3_2_1_29_1","doi-asserted-by":"publisher","DOI":"10.1145\/3551349.3561151"},{"key":"e_1_3_2_1_30_1","unstructured":"Chao Wang Ronny Ko Yue Zhang Yuqing Yang and Zhiqiang Lin. [n. d.]. TAINTMINI: Detecting Flow of Sensitive Data in Mini-Programs with Static Taint Analysis. ([n. d.]).  Chao Wang Ronny Ko Yue Zhang Yuqing Yang and Zhiqiang Lin. [n. d.]. TAINTMINI: Detecting Flow of Sensitive Data in Mini-Programs with Static Taint Analysis. ([n. d.])."},{"key":"e_1_3_2_1_31_1","doi-asserted-by":"publisher","DOI":"10.48550\/arXiv.2306.08134"},{"key":"e_1_3_2_1_32_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.apnr.2017.09.008"},{"key":"e_1_3_2_1_33_1","doi-asserted-by":"publisher","DOI":"10.1145\/3442381.3450008"},{"key":"e_1_3_2_1_34_1","volume-title":"Accepted by MobiCom","author":"Wang Kailong","year":"2022","unstructured":"Kailong Wang , Yuwei Zheng , Qing Zhang , Guangdong Bai , Qin Mingchuang , Donghui Zhang , and Jin Song Dong . Accepted by MobiCom 2022 . Assessing Certificate Validation User Interfaces of WPA Supplicants . Kailong Wang, Yuwei Zheng, Qing Zhang, Guangdong Bai, Qin Mingchuang, Donghui Zhang, and Jin Song Dong. Accepted by MobiCom 2022. Assessing Certificate Validation User Interfaces of WPA Supplicants."},{"key":"e_1_3_2_1_35_1","doi-asserted-by":"publisher","DOI":"10.1145\/3334480.3383078"},{"key":"e_1_3_2_1_36_1","unstructured":"Yuqing Yang Chao Wang Yue Zhang and Zhiqiang Lin. [n. d.]. SoK: Decoding the Super App Enigma: The Security Mechanisms Threats and Trade-offs in OS-alike Apps. arXiv:2306.07495 [cs] http:\/\/arxiv.org\/abs\/2306.07495  Yuqing Yang Chao Wang Yue Zhang and Zhiqiang Lin. [n. d.]. SoK: Decoding the Super App Enigma: The Security Mechanisms Threats and Trade-offs in OS-alike Apps. arXiv:2306.07495 [cs] http:\/\/arxiv.org\/abs\/2306.07495"},{"volume-title":"Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security (Los Angeles CA USA","author":"Yang Yuqing","key":"e_1_3_2_1_37_1","unstructured":"Yuqing Yang , Yue Zhang , and Zhiqiang Lin . [n. d.]. Cross Miniapp Request Forgery: Root Causes, Attacks, and Vulnerability Detection . In Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security (Los Angeles CA USA , 2022--11-07). ACM, 3079--3092. https:\/\/doi.org\/10.1145\/ 3548606.3560597 Yuqing Yang, Yue Zhang, and Zhiqiang Lin. [n. d.]. Cross Miniapp Request Forgery: Root Causes, Attacks, and Vulnerability Detection. In Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security (Los Angeles CA USA, 2022--11-07). ACM, 3079--3092. https:\/\/doi.org\/10.1145\/ 3548606.3560597"},{"key":"e_1_3_2_1_38_1","volume-title":"31st USENIX Security Symposium (USENIX Security 22)","author":"Zhang Lei","year":"2022","unstructured":"Lei Zhang , Zhibo Zhang , Ancong Liu , Yinzhi Cao , Xiaohan Zhang , Yanjun Chen , Yuan Zhang , Guangliang Yang , and Min Yang . 2022 . Identity confusion in {WebView-based} mobile app-in-app ecosystems . In 31st USENIX Security Symposium (USENIX Security 22) . 1597--1613. Lei Zhang, Zhibo Zhang, Ancong Liu, Yinzhi Cao, Xiaohan Zhang, Yanjun Chen, Yuan Zhang, Guangliang Yang, and Min Yang. 2022. Identity confusion in {WebView-based} mobile app-in-app ecosystems. In 31st USENIX Security Symposium (USENIX Security 22). 1597--1613."},{"key":"e_1_3_2_1_39_1","doi-asserted-by":"publisher","DOI":"10.1145\/3460081"},{"key":"e_1_3_2_1_40_1","volume-title":"29th USENIX Security Symposium (USENIX Security 20)","author":"Zhang Yue","year":"2020","unstructured":"Yue Zhang , Jian Weng , Rajib Dey , Yier Jin , Zhiqiang Lin , and Xinwen Fu . 2020 . Breaking secure pairing of bluetooth low energy using downgrade attacks . In 29th USENIX Security Symposium (USENIX Security 20) . 37--54. Yue Zhang, Jian Weng, Rajib Dey, Yier Jin, Zhiqiang Lin, and Xinwen Fu. 2020. Breaking secure pairing of bluetooth low energy using downgrade attacks. In 29th USENIX Security Symposium (USENIX Security 20). 37--54."},{"key":"e_1_3_2_1_41_1","doi-asserted-by":"publisher","DOI":"10.48550\/arXiv.2306.08151"},{"key":"e_1_3_2_1_42_1","volume-title":"Towards Automatically Repairing Compatibility Issues in Published Android Apps. In The 44th International Conference on Software Engineering (ICSE","author":"Zhao Yanjie","year":"2022","unstructured":"Yanjie Zhao , Li Li , Kui Liu , and John Grundy . 2022 . Towards Automatically Repairing Compatibility Issues in Published Android Apps. In The 44th International Conference on Software Engineering (ICSE 2022). Yanjie Zhao, Li Li, Kui Liu, and John Grundy. 2022. Towards Automatically Repairing Compatibility Issues in Published Android Apps. In The 44th International Conference on Software Engineering (ICSE 2022)."},{"key":"e_1_3_2_1_43_1","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1145\/3446905","article-title":"On the impact of sample duplication in machinelearning-based android malware detection","volume":"30","author":"Zhao Yanjie","year":"2021","unstructured":"Yanjie Zhao , Li Li , Haoyu Wang , Haipeng Cai , Tegawend\u00e9 F Bissyand\u00e9 , Jacques Klein , and John Grundy . 2021 . On the impact of sample duplication in machinelearning-based android malware detection . ACM Transactions on Software Engineering and Methodology (TOSEM) 30 , 3 (2021), 1 -- 38 . Yanjie Zhao, Li Li, Haoyu Wang, Haipeng Cai, Tegawend\u00e9 F Bissyand\u00e9, Jacques Klein, and John Grundy. 2021. On the impact of sample duplication in machinelearning-based android malware detection. ACM Transactions on Software Engineering and Methodology (TOSEM) 30, 3 (2021), 1--38.","journal-title":"ACM Transactions on Software Engineering and Methodology (TOSEM)"},{"key":"e_1_3_2_1_44_1","doi-asserted-by":"crossref","unstructured":"Kaina Zhou Wen Wang Wenqian Zhao Lulu Li Mengyue Zhang Pingli Guo Can Zhou Minjie Li Jinghua An Jin Li etal 2020. Benefits of a WeChat-based multimodal nursing program on early rehabilitation in postoperative women with breast cancer: a clinical randomized controlled trial. International journal of nursing studies 106 (2020) 103565  Kaina Zhou Wen Wang Wenqian Zhao Lulu Li Mengyue Zhang Pingli Guo Can Zhou Minjie Li Jinghua An Jin Li et al. 2020. Benefits of a WeChat-based multimodal nursing program on early rehabilitation in postoperative women with breast cancer: a clinical randomized controlled trial. International journal of nursing studies 106 (2020) 103565","DOI":"10.1016\/j.ijnurstu.2020.103565"}],"event":{"name":"CCS '23: ACM SIGSAC Conference on Computer and Communications Security","sponsor":["SIGSAC ACM Special Interest Group on Security, Audit, and Control"],"location":"Copenhagen Denmark","acronym":"CCS '23"},"container-title":["Proceedings of the 2023 ACM Workshop on Secure and Trustworthy Superapps"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3605762.3624433","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3605762.3624433","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,17]],"date-time":"2025-06-17T16:46:11Z","timestamp":1750178771000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3605762.3624433"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2023,11,26]]},"references-count":44,"alternative-id":["10.1145\/3605762.3624433","10.1145\/3605762"],"URL":"https:\/\/doi.org\/10.1145\/3605762.3624433","relation":{},"subject":[],"published":{"date-parts":[[2023,11,26]]},"assertion":[{"value":"2023-11-26","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}